{ "generated_at": "2026-10-07T09:00:03+00:00", "source": "pqcrypta-proxy curated database + live observations", "total": 6826, "of": 6826, "tiers": { "curated": 179, "observed": 6647 }, "query": { "q": "", "class": "all", "tier": "all", "sort": "default" }, "license": "CC BY 4.0", "docs": "https://pqcrypta.com/ja4/", "entries": [ { "hash": "01319090aea981dde6fc8d6ae71ead54", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "vpnkit", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "028563cffc7a3a2e32090aee0294d636", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse,STS", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0411bbb5ff27ad46e1874a7a8beedacb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "093081b45872912be9a1f2a8163fe041", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0ef9ca1c10d3f186f5786e1ef3461a46", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "bitgo,ShapeShift", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0fe51fa93812c2ebb50a655222a57bf2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LINE Messaging", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "106ecbd3d14b4dc6e413494263720afe", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js,Postman,WhatsApp", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "107144b88827da5da9ed42d8776ccdc5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "116ffc8889873efad60457cd55eaf543", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Spark", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "187dfde7edc8ceddccd3deeccc21daeb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,java,studio,STS", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "190dfb280fe3b541acc6a2e5f00690e6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Quip,Spotify,Dropbox,GitHub Desktop,etc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "193349d34561d1d5d1a270172eb2d97e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LogMeIn Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "1fbe5382f9d8430fe921df747c46d95f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "FieldServiceApp,socialstudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2080bf56cb87e64303e27fcd781e7efd", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "225a24b45f0f1adbc2e245d4624c6e08", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2d3854d1cbcdceece83eabd85bdcc056", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2db6873021f2a95daa7de0d93a1d1bf2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,studio,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2e094913d88f0ad8dc69447cb7d2ce65", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LINE Messaging", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "32e4b8812cda0c0d50783b438492a769", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl 8.x (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "38cbe70b308f42da7c9980c0e1c89656", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "p4v,owncloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3959d0a1344896e9fb5c0564ca0a2956", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LeagueClientUx", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "39cf5b7a13a764494de562add874f016", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Steam OSX", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3afe1fb5976d0999abe833b14b7d6485", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3b844830bfbb12eb5d2f8dc281d349a9", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3e860202fc555b939e83e7a7ab518c38", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4056657a50a8a4e5cfac40ba48becfa2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "424008725394c634a4616b8b1f2828a5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Charles,java,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "488b6b601cb141b062d4da7f524b4b22", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Python,PHP,Git,dotnet,Adobe", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4990c9da08f44a01ecd7ddc3837caf25", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49a341a21f4fd4ac63b027ff2b1a331f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Skype", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49a6cf42956937669a01438f26e7c609", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AIM", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49de9b1c7e60bd3b8e1d4f7a49ba362e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "nwjs,Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4fcd1770545298cc119865aeba81daba", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Deezer", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "51a7ad14509fd614c7bb3a50c4982b8c", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "550628650380ff418de25d3d890e836e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5507277945374659a5b4572e1b6d9b9f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "561145462cfc7de1d6a97e93d3264786", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Airmail 3", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "56ac3a0bef0824c49e4b569941937088", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5af143afdbf58ec11ab3b3d53dd4e5e3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "IDSyncDaemon", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5b270b309ad8c6478586a15dece20a88", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5c1c89f930122bccc7a97d52f73bea2c", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5cfbaea088a6084eefed5c5e8c3972ec", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "GNU Wget (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5d7abe53ae15b4272a34f10431e06bf3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5ee1a653fb824db7182714897fd3b5df", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Citrix Viewer", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5f9b53f0d39dc9d940a3b5568fe5f0bb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,JavaApplicationStub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6003b52942a2e1e1ea72d802d153ec08", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Amazon Music", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "61d50e7771aee7f2f4b89a7200b4d45e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AcroCEF", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "62448833d8230241227c03b7d441e31b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "parsecd,apple.geod,apple.photomoments,photoanalysisd,FreedomProxy", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "641df9d6dbe7fdb74f70c8ad93def8cc", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6acb250ada693067812c3335705dae79", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "mono-sgen,Syncplicity,Axure RP 8,Amazon Drive", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "77310efe11f1943306ee317cf02150b7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7c7a68b96d2aab15d678497a12119f4f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "83e04bc58d402f9633983cbf22724b02", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Charles,Google Play Music Desktop Player,Postman,Slack,and other desktop programs", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "84071ea96fc8a60c55fc8a405e214c0f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many desktop apps,Quip,Spotify,GitHub Desktop", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "844166382cc98d98595e6778c470f5d5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Salesforce Files", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "84607748f3887541dd60fe974a042c71", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "wineserver", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "88afa0dea1608e28f50acbad32d7f195", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "88f1fd7a4ad8bf2abd56176f5455424b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "OpenSSL s_client (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8bd59c4b7f3193db80fd64318429bcec", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8c5a50f1e833ed581e9cfc690814719a", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,JavaApplicationStub,idea", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8ce6933b8c12ce931ca238e9420cc5dd", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8e3f1bf87bc652a20de63bfd4952b16a", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AnypointStudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "900c1fa84b4ea86537e1d148ee16eae8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Fuze", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "9811c1bb9f0f6835d5c13a831cca4173", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a585c632a2b49be1256881fb0c16c864", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a5aa6e939e4770e3b8ac38ce414fd0d5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a61299f9b501adcf680b9275d79d4ac6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a7823092705a5e91ce2b7f561b6e5b98", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Qsync Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9d17f74e55dd53fcf7c234f8a240919", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Covenant Eyes", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9fead344bf3ac09f62df3cd9b22c268", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ae340571b4fd0755c4a0821b18d8fa93", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Earth", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ba40fea2b2638908a3b3b482ac78d729", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod,parsecd,apple.photomoments", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bc0608d33dc64506b42f7f5f87958f37", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "cscan", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "be9f1360cf52dc1f61ae025252f192a3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c048d9f26a79e11ca7276499ef24daf3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "RescueTime,Plantronics Hub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c2b4710c6888a5d47befe865c8e6fb19", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "ZwiftApp", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c376061f96329e1020865a1dc726927d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "JavaApplicationStub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c46941d4de99445aef6b497679474cf4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c5c11e6105c56fd29cc72c3ac7a2b78b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AT&T Connect", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c882d9444412c00e71b643f3f54145ff", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Creative Cloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c9dbeed362a32f9a50a26f4d9b32bbd8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Messenger,Jumpshare", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ccaa60f6ccc701bde536ef409be3cf63", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl no-SNI", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "cd7c06b9459c9cfd4af2dba5696ea930", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "cdec81515ccc75a5aa41eb3db22226e6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "BlueJeans,CEPHtmlEngine", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d06acbe8ac31e753f40600a9d6717cba", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Inbox OSX", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d1f9f9b224387d2597f02095fcec96d7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d219efd07cbb8fbe547e6a5335843f0f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "ruby", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d27fb8deca6e3b9739db3fda2b229fe3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Drive File Stream", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d732ca39155f38942f90e9fc2b0f97f7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Maxthon", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d74778f454e2b047e030b291b94dd698", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "def8761e4bcaaf91d99801a22ac6f6d4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "df65746370dcabc9b4f370c6e14a8156", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "True Key", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e0224fc1c33658f2d3d963bfb0a76a85", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Viber", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e516ad69a423f8e0407307aa7bfd6344", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Kindle,stack,nextcloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e7d46c98b078477c4324031e0d3b22f5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Cisco AnyConnect Secure Mobility Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e846898acc767ebeb2b4388e58a968d4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "postbox-bin", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "eb149984fc9c44d85ed7f12c90d818be", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Amazon Music,Dreamweaver,Spotify", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ed36017db541879619c399c95e22067d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Cisco AnyConnect Secure Mobility Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f059212ce3de94b1e8253a7522cb1b44", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Photos Backup", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f22bdd57e3a52de86cda40da2d84e83b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse,Cyberduck", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f28d34ce9e732f644de2350027d74c3f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Quip,Aura,Spotify,Chatty", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f6fd83a21f9f3c5f9ff7b5c63bbc179d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Alation Compose", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f753495f2eab5155c61b760c838018f8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fa030dbcb2e3c7141d3c2803780ee8db", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Battle.net,Dropbox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fa106fe5beec443af7e211ef8902e7e0", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fc5cb0985a5f5e295163cc8ffff8a6e1", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fd10cc8cce9493a966c57249e074755f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "gramblr", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fe048fe8faf797796e278f2b4f1e9c24", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl SNI", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ff1040ba1e3d235855ef0d7cd9237fdc", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "002205d0f96c37c5e660b9f041363c11", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "073eede15b2a5a0302d823ecbd5ad15b", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "07b4162d4db57554961824a21c4a0fde", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox,thunderbird", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0a81538cf247c104edb677bdb8902ed5", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0b61c673ee71fe9ee725bd687c455809", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0b6592fd91d4843c823b75e49b43838d", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0e46737668fe75092919ee047a0b5945", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0ffee3ba8e615ad22535e7f771690a28", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "1c15aca4a38bad90f9c40678f6aface9", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "20dd18bdd3209ea718989030a6f93364", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs,Slack,Postman,Spotify,Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "39fa85654105398ee7ef6a3a1c81d685", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3e4e87dda5a3162306609b7e330441d2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,itunesstored", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3ee4aaac7147ff2b80ada31686db660c", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "node-webkit,Kindle", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "40fd0a5e81ebdcf0ec82a4710a12dec1", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "474e73aea21d1e0910f25c3e6c178535", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4ba7b7022f5f5e1e500bb19199d8b1a4", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4c40bf8baa7c301c5dba8a20bc4119e2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Dynalist,Postman,Google Chrome,Franz,GOG Galaxy", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5163bc7c08f57077bc652ec370459c2f", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5498cef2cca704eb01cf2041cc1089c1", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome,Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "618ee2509ef52bf0b8216e1564eea909", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "61d0d709fe7ac199ef4b2c52bc8cef75", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox,thunderbird", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "63de2b6188d5694e79b678f585b13264", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,Chatter,FieldServiceApp,socialstudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6cd1b944f5885e2cfbe98a840b75eeb8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "799135475da362592a4be9199d258726", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7b343af1092863fdd822d6f10645abfb", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,itunesstored", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7b530a25af9016a9d12de5abc54d9e74", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7e72698146290dd68239f788a452e7d8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8498fe4268764dbf926a38283e9d3d8f", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Franz,Google Chrome,Kiwi,Spotify,nwjs,Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8db4b0f8e9dd8f2fff38ee7c5a1e4496", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "SpotlightNetHelper,Safari", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "94c485bca29d5392be53f2b8cf7f4304", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a312f9162a08eeedf7feb7a13cd7e9bb", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,Spotify,WhatsApp,Skype,iTunes", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a88f1426c4603f2a8cd8bb41e875cb75", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9aecaa66ad9c6cfe1c361da31768506", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b03910cc6de801d2fcfa0c3b9f397df4", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b4f4e6164f938870486578536fc1ffce", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b8f81673c0e1d29908346f3bab892b9b", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "baaac9b6bf25ad098115c71c59d29e51", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bc6c386f480ee97b9d9e52d472b772d8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bfcc1a3891601edb4f137ab7ab25b840", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c05de18b01a054f2f6900ffe96b3da7a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c07cb55f88702033a8f52c046d23e0b2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c36fb08942cf19508c08d96af22d4ffc", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Safari", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ce694315cbb81ce95e6ae4ae8cbafde6", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d4693422c5ce1565377aca25940ad80c", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,CalendarAgent,Go for Gmail", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "da949afd9bd6df820730f8f171584a71", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e4d448cdfe06dc1243c1eb026c74ac9a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "eeeb5e7485f5e10cbc39db4cfb69b264", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f15797a734d0b4f171a86fd35c9a5e43", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f1c5cf087b959cec31bd6285407f689a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f58966d34ff9488a83797b55c804724d", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fd6314b03413399e4f23d1524d206692", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t10d640300_13a2a23d501b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "13a2a23d501b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710040, "last_seen": 1788842291, "transport": "t", "ja3_hash": "8f4558f961e7a3cf6353ec38ed7bed7f", "ja3_variant_count": 4, "ja3_variants": [ "8f4558f961e7a3cf6353ec38ed7bed7f", "a62471e0ef89283af324b0b17c4ba2d9", "1e04bd3007c72ce6c4708abaf5c26f86", "1cf8794db2c63b873adec843db18e142" ], "user_agents": [] } }, { "hash": "t10d640300_67f0ca237a44_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "67f0ca237a44", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710037, "last_seen": 1788842287, "transport": "t", "ja3_hash": "60539ffbec08c42fcab2660f70ce21ca", "ja3_variant_count": 4, "ja3_variants": [ "60539ffbec08c42fcab2660f70ce21ca", "dda124905371562b72d28ea0e1364241", "a08c2570a9135eb2d9a7f1743196e091", "29f7908a42e8346e0f36114a59093e3f" ], "user_agents": [] } }, { "hash": "t10d640300_a3acda31d846_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "a3acda31d846", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710036, "last_seen": 1791020293, "transport": "t", "ja3_hash": "ddb64773428ea1a717a1db2c4adadc0c", "ja3_variant_count": 5, "ja3_variants": [ "ddb64773428ea1a717a1db2c4adadc0c", "8bd378bc6eb2437401966e9671e51f65", "e8295a33a07fee21d46665a494a86d1c", "84aa4572e2eed72a96b16dfd7540de28", "3976f066db858683d58700f6b20a65dc" ], "user_agents": [] } }, { "hash": "t10d640300_e31a90cd0803_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "e31a90cd0803", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710037, "last_seen": 1791020293, "transport": "t", "ja3_hash": "fa2ce5a3078abb9c449e8fbb1fe0ea6f", "ja3_variant_count": 5, "ja3_variants": [ "fa2ce5a3078abb9c449e8fbb1fe0ea6f", "24a712a9ef23f5d514e47fffb5596245", "12b636358ea66419c16709def10d17c4", "deb61e94362e500c8eefe17a507235dc", "b6e9cbc3dd73884ce74e3851203f09a5" ], "user_agents": [] } }, { "hash": "t10d640300_e7b476f9520b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "e7b476f9520b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710033, "last_seen": 1791020292, "transport": "t", "ja3_hash": "c2d96b3eccae65ca252907adb1ad4124", "ja3_variant_count": 5, "ja3_variants": [ "c2d96b3eccae65ca252907adb1ad4124", "7064e70dc94279db549fc80a14f5679a", "c5f9dae86f8168fb85a1d40a368e9e37", "64f50b8bf471f53daa286f30e82ad40a", "9b4bb3689b30a5131184c4e5b6caed1e" ], "user_agents": [] } }, { "hash": "t10d640300_f559eb9565fd_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "f559eb9565fd", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710037, "last_seen": 1791020293, "transport": "t", "ja3_hash": "e53f411daff3deced39ac87d3ef6e65a", "ja3_variant_count": 5, "ja3_variants": [ "e53f411daff3deced39ac87d3ef6e65a", "55559d24913a32b13e6559b0bc63295e", "ac618ad4c83155431a3876dd4ada6d79", "4bc17aa9833ab551da3d2017dc0ecbf9", "50c627686a4b44282980524beb64e906" ], "user_agents": [] } }, { "hash": "t11d640300_13a2a23d501b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "13a2a23d501b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710039, "last_seen": 1788842289, "transport": "t", "ja3_hash": "8de9c7c43a53600a7b5e20dc77459331", "ja3_variant_count": 4, "ja3_variants": [ "8de9c7c43a53600a7b5e20dc77459331", "7281eb6b5b7a144d4aa9a87a2c63c45d", "bcac1c6a33bb1c7da989a42a27894e9b", "66295e0e528e74245f9f6ceb9de8e87d" ], "user_agents": [] } }, { "hash": "t11d640300_67f0ca237a44_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "67f0ca237a44", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710043, "last_seen": 1788842293, "transport": "t", "ja3_hash": "77d8246c50a0c1f2d98525dcea42ef29", "ja3_variant_count": 4, "ja3_variants": [ "77d8246c50a0c1f2d98525dcea42ef29", "40af735e9c434f039760391a794d3aa2", "8c86fd6889132179662580ad6e8780a2", "eed78583a98688831893f81d05e27c82" ], "user_agents": [] } }, { "hash": "t11d640300_a3acda31d846_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "a3acda31d846", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710041, "last_seen": 1791020292, "transport": "t", "ja3_hash": "520978d10abe048e7109ae4ae07c6c7b", "ja3_variant_count": 5, "ja3_variants": [ "520978d10abe048e7109ae4ae07c6c7b", "cecf4f0a803718be652f9fa623105a0a", "0bf272196481d0da5f4730cd63f1fa57", "c6110e78375b92ff48e1b450c22a3c88", "cc514bde9d1c3ae13be916c06e51cca8" ], "user_agents": [] } }, { "hash": "t11d640300_e31a90cd0803_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "e31a90cd0803", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710040, "last_seen": 1791020293, "transport": "t", "ja3_hash": "fdb52e11d68966be00fcb1347073e39a", "ja3_variant_count": 5, "ja3_variants": [ "fdb52e11d68966be00fcb1347073e39a", "b3d1bc7b276289d815dd513730dc61eb", "f625e4df6b7d68d7aacf37641c956175", "c3f81d67d0e52f81c773e0f62ee1ac4b", "a8c28a398a2a8a9d405d6f19397047f2" ], "user_agents": [] } }, { "hash": "t11d640300_e7b476f9520b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "e7b476f9520b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710040, "last_seen": 1791020293, "transport": "t", "ja3_hash": "dc3c9110c7a2cd3a24fa387147dd1779", "ja3_variant_count": 5, "ja3_variants": [ "dc3c9110c7a2cd3a24fa387147dd1779", "499a39d0686735e11bf4641098545dc4", "f0e9c8866d60282351c447d53ad69a0c", "416dacce2e6f8ee14248d993ed769de9", "90870570f66aeea1a1ec68c09cca7229" ], "user_agents": [] } }, { "hash": "t11d640300_f559eb9565fd_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "f559eb9565fd", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710041, "last_seen": 1791020292, "transport": "t", "ja3_hash": "627e21d18e5721958c0c7ae774b71231", "ja3_variant_count": 5, "ja3_variants": [ "627e21d18e5721958c0c7ae774b71231", "d4e98f040b64040e4249d6870af72345", "cc69b70d7a5c8f329b8894480122e802", "d8b071c520af654d2540d1ec71dbc680", "ea4a9b49f2b7805426249dfda2975607" ], "user_agents": [] } }, { "hash": "t12d190600_9c2f387b437f_82b0993b6ad8", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d190600", "b": "9c2f387b437f", "c": "82b0993b6ad8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 6, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_13a2a23d501b_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "13a2a23d501b", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_67f0ca237a44_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "67f0ca237a44", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_a3acda31d846_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "a3acda31d846", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_e31a90cd0803_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "e31a90cd0803", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_e7b476f9520b_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "e7b476f9520b", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_f559eb9565fd_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "f559eb9565fd", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "q13d0311h3_55b375c5d22e_e3b8e4ce5af0", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "quic-go \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "e3b8e4ce5af0", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-5-10-11-13-65281-16-18-43-51-57,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 86, "first_seen": 1787535365, "last_seen": 1791142911, "transport": "q", "ja3_hash": "3e9680842aa1ac1f48edc74e779ebc97", "ja3_variant_count": 1, "ja3_variants": [ "3e9680842aa1ac1f48edc74e779ebc97" ], "user_agents": { "quic-go-HTTP/3": 86 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_557329848ba7", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "557329848ba7", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,57-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790511645, "last_seen": 1791125314, "transport": "q", "ja3_hash": "f7c4c8ab987ac48634bec91f3c21a227", "ja3_variant_count": 1, "ja3_variants": [ "f7c4c8ab987ac48634bec91f3c21a227" ], "user_agents": { "curl/8.19.0": 4 }, "ua_disagreement": false } }, { "hash": "q13d0411h3_16476d049b0b_8d0f06507a4e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0411h3", "b": "16476d049b0b", "c": "8d0f06507a4e", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865-255,0-10-16-22-23-49-13-43-45-51-57,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788989704, "last_seen": 1788989723, "transport": "q", "ja3_hash": "d77d6df709f1b67a8e4c5c97a28518c5", "ja3_variant_count": 1, "ja3_variants": [ "d77d6df709f1b67a8e4c5c97a28518c5" ], "user_agents": { "curl/8.18.0-DEV": 2 }, "ua_disagreement": false } }, { "hash": "t12d080700_0df93f53a2f9_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (b871c60bacbc) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d080700", "b": "0df93f53a2f9", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 8, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49199-49192-49191-49196-49195-49188-49187,0-10-11-13-35-23-65281,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789575262, "last_seen": 1789578539, "transport": "t", "ja3_hash": "5b0ffbfa2ef37b8d4e4953c76f689d77", "ja3_variant_count": 1, "ja3_variants": [ "5b0ffbfa2ef37b8d4e4953c76f689d77" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150400_8daaf6152771_93b9751e4c3e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "93b9751e4c3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789130281, "last_seen": 1789130281, "transport": "t", "ja3_hash": "e921bfee618b8399a0f03c6bfc1842f8", "ja3_variant_count": 1, "ja3_variants": [ "e921bfee618b8399a0f03c6bfc1842f8" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_ee4b244473e1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "ee4b244473e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-10-11-65037-27-0-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791231313, "last_seen": 1791231313, "transport": "t", "ja3_hash": "136556117973c472f1080913507e1324", "ja3_variant_count": 1, "ja3_variants": [ "136556117973c472f1080913507e1324" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_7f2e73375223", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PerplexityBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "7f2e73375223", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-0-10-11-27-13-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790286322, "last_seen": 1790286322, "transport": "t", "ja3_hash": "5b7f6f514be450f630aca37259df314b", "ja3_variant_count": 1, "ja3_variants": [ "5b7f6f514be450f630aca37259df314b" ], "user_agents": { "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 2 }, "ua_disagreement": true } }, { "hash": "t12d1510h2_8daaf6152771_f54ed08efad8", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "f54ed08efad8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-65281-65037-16-18-5-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790338585, "last_seen": 1790338585, "transport": "t", "ja3_hash": "a9e4b8658467023ddd89b133831b61c4", "ja3_variant_count": 1, "ja3_variants": [ "a9e4b8658467023ddd89b133831b61c4" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_0247d2492af2", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "0247d2492af2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-18-11-0-17613-16-65281-35-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790731485, "last_seen": 1790731485, "transport": "t", "ja3_hash": "5bf726a1313ab7b82bd552cc316e8010", "ja3_variant_count": 1, "ja3_variants": [ "5bf726a1313ab7b82bd552cc316e8010" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_002c0579dc72", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "002c0579dc72", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-65281-45-35-18-27-0-65037-23-17613-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789699347, "last_seen": 1789699347, "transport": "t", "ja3_hash": "92c244e203cd171a7bb1ab8e0ff617f2", "ja3_variant_count": 1, "ja3_variants": [ "92c244e203cd171a7bb1ab8e0ff617f2" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12d180700_4b22cbed5bed_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (b871c60bacbc) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d180700", "b": "4b22cbed5bed", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 31, "first_seen": 1788460406, "last_seen": 1790107191, "transport": "t", "ja3_hash": "6a5d235ee78c6aede6a61448b4e9ff1e", "ja3_variant_count": 1, "ja3_variants": [ "6a5d235ee78c6aede6a61448b4e9ff1e" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d180800_5d04281c6031_021da7cd3809", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d180800", "b": "5d04281c6031", "c": "021da7cd3809", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49199-49195-49200-49196-49191-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788489054, "last_seen": 1791292785, "transport": "t", "ja3_hash": "e422b48cc39491764bf12f66fdef4771", "ja3_variant_count": 1, "ja3_variants": [ "e422b48cc39491764bf12f66fdef4771" ], "user_agents": { "Claude-User (claude-code/2.1.255; +https://support.anthropic.com/)": 1, "Claude-User (claude-code/2.1.278; +https://support.anthropic.com/)": 2, "Claude-User (claude-code/2.1.286; +https://support.anthropic.com/)": 3 }, "ua_disagreement": false } }, { "hash": "t12d200700_22c523c4c553_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (b871c60bacbc) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d200700", "b": "22c523c4c553", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 110, "first_seen": 1787451573, "last_seen": 1791291337, "transport": "t", "ja3_hash": "095a9cdf6fceacc9c38736015b7d1ec4", "ja3_variant_count": 1, "ja3_variants": [ "095a9cdf6fceacc9c38736015b7d1ec4" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d210700_76e208dd3e22_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d210700", "b": "76e208dd3e22", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 21, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 250, "first_seen": 1787464644, "last_seen": 1791303663, "transport": "t", "ja3_hash": "3b5074b1b5d032e5620f69f9f700ff0e", "ja3_variant_count": 1, "ja3_variants": [ "3b5074b1b5d032e5620f69f9f700ff0e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_18ecb20ebe77", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "18ecb20ebe77", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791273420, "last_seen": 1791273420, "transport": "t", "ja3_hash": "b0e5ad26f2f622776d704eab3f355b33", "ja3_variant_count": 1, "ja3_variants": [ "b0e5ad26f2f622776d704eab3f355b33" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_ce6db83f2c68", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "ce6db83f2c68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-18-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789431216, "last_seen": 1789431216, "transport": "t", "ja3_hash": "0418de22d706e126bef1088d93cb9de4", "ja3_variant_count": 1, "ja3_variants": [ "0418de22d706e126bef1088d93cb9de4" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_6399a569455a", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "6399a569455a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-65281-51-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790513169, "last_seen": 1790513169, "transport": "t", "ja3_hash": "9fb8cd6b40f18752a8b5c7c3cafae118", "ja3_variant_count": 1, "ja3_variants": [ "9fb8cd6b40f18752a8b5c7c3cafae118" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_6ae18c926a97", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "6ae18c926a97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-10-18-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789816515, "last_seen": 1789816515, "transport": "t", "ja3_hash": "29e69b087bb9d3b2a10923480d265244", "ja3_variant_count": 1, "ja3_variants": [ "29e69b087bb9d3b2a10923480d265244" ], "user_agents": { "Sogou web spider/4.0": 23 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_c9644b0143dc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "c9644b0143dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-51-23-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790569402, "last_seen": 1790569402, "transport": "t", "ja3_hash": "883e006b95ceafa29866aafc0bc24779", "ja3_variant_count": 1, "ja3_variants": [ "883e006b95ceafa29866aafc0bc24779" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f74b1484f78c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f74b1484f78c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-23-5-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789695451, "last_seen": 1789695451, "transport": "t", "ja3_hash": "35419aadc6bfdff2d43a3ab9671eb8cb", "ja3_variant_count": 1, "ja3_variants": [ "35419aadc6bfdff2d43a3ab9671eb8cb" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_11627799d1d4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "11627799d1d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-16-65281-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789097067, "last_seen": 1789097067, "transport": "t", "ja3_hash": "92303393732623c2e67d5fe434e7ba81", "ja3_variant_count": 1, "ja3_variants": [ "92303393732623c2e67d5fe434e7ba81" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3a59c9940562", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3a59c9940562", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-65037-16-35-45-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789702692, "last_seen": 1789702692, "transport": "t", "ja3_hash": "904514155566cdc487937059d0e81c9b", "ja3_variant_count": 1, "ja3_variants": [ "904514155566cdc487937059d0e81c9b" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_97e3b743d3ba", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "97e3b743d3ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-16-5-45-10-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789665448, "last_seen": 1789665448, "transport": "t", "ja3_hash": "55fce89808c1ac6c3eb02e8d30422dbd", "ja3_variant_count": 1, "ja3_variants": [ "55fce89808c1ac6c3eb02e8d30422dbd" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t13d031200_55b375c5d22e_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python aiohttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d031200", "b": "55b375c5d22e", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865,65281-0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788725718, "last_seen": 1790398077, "transport": "t", "ja3_hash": "1c48fac858875a4fce78dde2a602b093", "ja3_variant_count": 1, "ja3_variants": [ "1c48fac858875a4fce78dde2a602b093" ], "user_agents": { "Python/3.11 aiohttp/3.14.3": 4 }, "ua_disagreement": false } }, { "hash": "t13d0312h2_55b375c5d22e_8da9a2619b0b", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d0312h2", "b": "55b375c5d22e", "c": "8da9a2619b0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865,65281-0-10-16-22-23-49-13-43-45-51-27,514,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1791323249, "last_seen": 1791323847, "transport": "t", "ja3_hash": "f505c740c6b5cc76bbdb6ae65ddf62ad", "ja3_variant_count": 1, "ja3_variants": [ "f505c740c6b5cc76bbdb6ae65ddf62ad" ], "user_agents": { "curl/8.18.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d0312h2_55b375c5d22e_91cb082f3657", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d0312h2", "b": "55b375c5d22e", "c": "91cb082f3657", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865,0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788725711, "last_seen": 1788725711, "transport": "t", "ja3_hash": "d24be7db5080cb337fcc018702787f84", "ja3_variant_count": 1, "ja3_variants": [ "d24be7db5080cb337fcc018702787f84" ], "user_agents": { "curl/8.18.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d0313h2_55b375c5d22e_90ed1dadcdd2", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d0313h2", "b": "55b375c5d22e", "c": "90ed1dadcdd2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791323249, "last_seen": 1791323847, "transport": "t", "ja3_hash": "9f74b0a625c106ce58a596a90ae450d4", "ja3_variant_count": 1, "ja3_variants": [ "9f74b0a625c106ce58a596a90ae450d4" ], "user_agents": { "curl/8.18.0": 1, "Mozilla/5.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_01def6fbf02e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PerplexityBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "01def6fbf02e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-5-13-10-0-35-43-51-11-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 220, "first_seen": 1787567858, "last_seen": 1791348516, "transport": "t", "ja3_hash": "d819bfceb5b843d1b942ccc74894b673", "ja3_variant_count": 197, "ja3_variants": [ "d819bfceb5b843d1b942ccc74894b673", "8da829f28229706d148f7c39177ffc54", "5ed65227f5a8a35d890f55fc08ded128", "1387ce8a0d028da1f7be8cb5447018b4", "e94b14739f3154d2f9852be7763e67f9", "4e1a75cd7222bb2ca9ca2a9b889abf57", "6a15043f593bcd30c22970c194cd5cf2", "2e0e92b90c8e79e19fbcc7652a348bb8", "1ecb20e35f039d74cddacbbcc9d4e1ff", "46a5130b83cd4feec97691733fe480f5", "5cdcc9cc1ebed0136464371ac640d90f", "47478c2bb7b91a62cda457f5c463cb0c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 2, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 20 }, "ua_disagreement": true } }, { "hash": "t13d101000_61a7ad8aa9b6_815af8d700c8", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PerplexityBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "815af8d700c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-13-23-0-51-35-10-43-5-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789652063, "last_seen": 1791315171, "transport": "t", "ja3_hash": "ef18f791c09a7ee259889d68618961ca", "ja3_variant_count": 5, "ja3_variants": [ "ef18f791c09a7ee259889d68618961ca", "1f5f9b42226c3bbbf8965dcf1bb66bb7", "690dcf0eff78c40c4c67bfc235041555", "6eb63241f84df2b18084f68770a6e6e2", "08d4b80ccbe1ed3b2517d94c5862770a" ], "user_agents": { "ccfetch/1.0": 5, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 1 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_c46b846b2fb1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PerplexityBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "c46b846b2fb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-11-35-10-43-13-23-5-0-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4537, "first_seen": 1787716863, "last_seen": 1791361845, "transport": "t", "ja3_hash": "3af2e09bef4eb5670a57ce98d09e15cf", "ja3_variant_count": 4346, "ja3_variants": [ "3af2e09bef4eb5670a57ce98d09e15cf", "469624846357eeae24a45cf3a32e35d1", "ec06a85ac0b133c81d3bbe86fcda9ce6", "213819a8d711c5c4ff6449894ed6eb3e", "ef27e10894ace65f274881e5585168b9", "5f4d78ba8bfeb2411a1a3ef80a01f4be", "6b40bafce5c0da483086d532739c96b7", "a80231747c2649180cf781405548e1af", "e87bfb6c8421a671e84c61391240b457", "7bc30788f0143a096851f3999338cc54", "0a23c0d057b0be4884d0798b3b4dce24", "d522455e1b05ef7c5760f4363d207bda" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 4525, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 8 }, "ua_disagreement": true } }, { "hash": "t13d1011h2_18ef40b21276_6204cfc135c8", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "18ef40b21276", "c": "6204cfc135c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49200-52393-52392-49195-49199-49191,0-23-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 61, "first_seen": 1787537070, "last_seen": 1791131616, "transport": "t", "ja3_hash": "705a350d22d8835722a0a4ed7ff0d573", "ja3_variant_count": 1, "ja3_variants": [ "705a350d22d8835722a0a4ed7ff0d573" ], "user_agents": { "curl/8.7.1": 932 }, "ua_disagreement": false } }, { "hash": "t13d1011h2_61a7ad8aa9b6_861bc38b0be4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "ClaudeBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "861bc38b0be4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-11-10-13-23-5-0-51-45-16-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16555, "first_seen": 1787458578, "last_seen": 1791363330, "transport": "t", "ja3_hash": "41b2ed70c1a5d19f22d74bb1859bc7e5", "ja3_variant_count": 14067, "ja3_variants": [ "41b2ed70c1a5d19f22d74bb1859bc7e5", "b3702d33d4709e13cc4ede4382d572ec", "28524fb3a33e4145959f3fb5d8bd2bcb", "ccbdba4668146bc77186c3d867c79ef0", "7d906f69c5bc2c9770408e7bb3bf32e2", "665006e81ca97edd67cfe82aa8ef064a", "a7eceb7a5bf4c35c3cbc15980a4ddc9e", "a94dbc28338ba86dc4bc5d86b657efba", "c9115c3da314383dbf7c9972a18a1dfd", "ad19dd053786cd06a150ecc930a41925", "4ed37bf14db63b73e10cf737dd735ad8", "9bf139dae0680a25b3895661732eb330" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 10782, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 6710, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 1265, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.co": 581, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 357, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 (compatible; AionBot/1.0)": 584, "PQCrypta-Discovery-Agent/1.0.45": 391, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 1061, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0": 34, "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)": 56, "Mozilla/5.0 (compatible; Reflectionbot/1.0; +https://reflection.ai/bot)": 67, "crusader-worker/1.0": 90, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 11, "PQCrypta-Discovery-Agent/1.0.38": 342, "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0": 25, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (compatible; GitFinder/1.0)": 6, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 8, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15": 26, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Mobile Safari/537.36": 30, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; SEOJuice-SearchBot/1.0; +https://seojuice.io/bot": 28, "Mozilla/5.0 (Linux; Android 13; Infinix X688B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.48 Mobile Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 12; TECNO CK6n) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.50 Mobile Safari/537.36": 3, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6540.18 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186]": 16, "Mozilla/5.0 (compatible; MatchboxBot/1.0; +https://askmatchbox.com/about-the-crawler) (variant; SupabaseEdgeRuntime/1.77.0; ref=hnqciyxvnaupbukeggwk)": 4, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.90 Safari/537.36": 2, "Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)": 7, "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0": 1, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edg/128.0.2790.25 Chrome/128.0.6540.22 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.2792.65": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.70 Safari/537.36 Vivaldi/6.7.3200.25": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; Xbox; Xbox One) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edge/44.18363.8131": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1011ht_61a7ad8aa9b6_861bc38b0be4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "ClaudeBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "861bc38b0be4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-23-5-35-0-43-13-16-11-45-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 22, "first_seen": 1787465155, "last_seen": 1791345571, "transport": "t", "ja3_hash": "2b691e81dc805047c32f05e9056d7d0e", "ja3_variant_count": 10, "ja3_variants": [ "2b691e81dc805047c32f05e9056d7d0e", "05594529409294cc37b4e0d762808ab5", "aaa9e92287e1ec7e426e19ebd8f8c6e3", "df2e48b15372e89d3c84655a0938301e", "1e6b85619b3c224e3860e05e4ec6e27f", "93d590668db5cca2c5577a601a9d933e", "2eed5d5f8f0e3360934281775bff21fe", "b34b849644376d0399d995432b56d2b5", "246475982a962f3f045d8975f0075023", "a266deab455539358459dd30ac11b615" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; SEOJuice-SearchBot/1.0; +https://seojuice.io/bot": 8, "crusader-worker/1.0": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 1 }, "ua_disagreement": true } }, { "hash": "t13d1113h2_5e2a75874763_0b2c8cf08c1b", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "CCBot (Common Crawl) \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1113h2", "b": "5e2a75874763", "c": "0b2c8cf08c1b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172,0-5-10-11-13-50-16-17-23-43-45-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 27, "first_seen": 1788342650, "last_seen": 1791319054, "transport": "t", "ja3_hash": "4f0bda65793e2d63b24d640f10d7a51c", "ja3_variant_count": 1, "ja3_variants": [ "4f0bda65793e2d63b24d640f10d7a51c" ], "user_agents": { "CCBot/2.0 (https://commoncrawl.org/faq/)": 161, "ClueWeb-Crawler/1.0 (+https://boston.lti.cs.cmu.edu/CMU-ClueWeb-Crawler/; mailto:cmu-clueweb-crawler@andrew.cmu.edu)": 7 }, "ua_disagreement": false } }, { "hash": "t13d1114h2_5e2a75874763_352e3a9193bf", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "CCBot (Common Crawl) \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1114h2", "b": "5e2a75874763", "c": "352e3a9193bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172,0-5-10-11-13-50-16-17-23-43-45-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 39, "first_seen": 1788410963, "last_seen": 1791323261, "transport": "t", "ja3_hash": "0a84269fcc8452ac11db9e0d0b6728db", "ja3_variant_count": 1, "ja3_variants": [ "0a84269fcc8452ac11db9e0d0b6728db" ], "user_agents": { "ClueWeb-Crawler/1.0 (+https://boston.lti.cs.cmu.edu/CMU-ClueWeb-Crawler/; mailto:cmu-clueweb-crawler@andrew.cmu.edu)": 5, "CCBot/2.0 (https://commoncrawl.org/faq/)": 143 }, "ua_disagreement": false } }, { "hash": "t13d121000_0ed44715e6cd_badae892920c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "C\u1ed1c C\u1ed1c bot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d121000", "b": "0ed44715e6cd", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49196-49195-49199-49200-49171-49172-156-47-53,0-23-65281-10-11-35-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 135, "first_seen": 1787446534, "last_seen": 1791326136, "transport": "t", "ja3_hash": "ab1caf6ada0c339e22931167c1fd0e05", "ja3_variant_count": 2, "ja3_variants": [ "ab1caf6ada0c339e22931167c1fd0e05", "e5d57694631abb5452ce9ae9bd3b6d3d" ], "user_agents": { "Mozilla/5.0 (compatible; coccocbot-web/1.0; +http://help.coccoc.com/searchengine)": 56, "LinkedInBot/1.0 (compatible; Mozilla/5.0; Apache-HttpClient +http://www.linkedin.com)": 25, "Mozilla/5.0 (compatible; coccocbot-image/1.0; +http://help.coccoc.com/searchengine)": 49 }, "ua_disagreement": false } }, { "hash": "t13d121100_0ed44715e6cd_996dcf38c216", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "LinkedInBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d121100", "b": "0ed44715e6cd", "c": "996dcf38c216", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49196-49195-49199-49200-49171-49172-156-47-53,0-23-65281-10-11-35-13-51-45-43-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789742575, "last_seen": 1791062035, "transport": "t", "ja3_hash": "a0b9fbc7a85132d822cc23c44d648452", "ja3_variant_count": 1, "ja3_variants": [ "a0b9fbc7a85132d822cc23c44d648452" ], "user_agents": { "LinkedInBot/1.0 (compatible; Mozilla/5.0; Apache-HttpClient +http://www.linkedin.com)": 1, "Mozilla/5.0 (compatible; coccocbot-image/1.0; +http://help.coccoc.com/searchengine)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1311h2_f57a46bbacb6_2f5041364463", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1311h2", "b": "f57a46bbacb6", "c": "2f5041364463", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 60, "first_seen": 1787475044, "last_seen": 1791361919, "transport": "t", "ja3_hash": "ceb419f4203d3159e7a7cb3aa7efd5bd", "ja3_variant_count": 2, "ja3_variants": [ "ceb419f4203d3159e7a7cb3aa7efd5bd", "50982bb7732015b00f10d5024747686f" ], "user_agents": { "Mozilla/5.0": 57, "Go-http-client/2.0": 42, "Mozilla/5.0 (X11; Linux x86_64) Gecko/20100101 Firefox/117.0": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (compatible; SparixEmailScraper/1.0; +https://sparix.ai)": 16 }, "ua_disagreement": true } }, { "hash": "t13d150800_8daaf6152771_0eb8ed479027", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "0eb8ed479027", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-0-23-65281-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789971693, "last_seen": 1790591316, "transport": "t", "ja3_hash": "d8cf47ef65f8cc58dbd57090e396945d", "ja3_variant_count": 2, "ja3_variants": [ "d8cf47ef65f8cc58dbd57090e396945d", "1ce0dc86f18ea1b916a236b674dd50ad" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2, "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": true } }, { "hash": "t13d1508h2_8daaf6152771_89f5817ff61e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "ClaudeBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "89f5817ff61e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-0-16-18-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790261943, "last_seen": 1790261943, "transport": "t", "ja3_hash": "e70da9ec2f88e8eb3e3d53f29263d420", "ja3_variant_count": 1, "ja3_variants": [ "e70da9ec2f88e8eb3e3d53f29263d420" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_049d0d80589f", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "049d0d80589f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-16-0-5-65037-45-17613-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791047668, "last_seen": 1791047668, "transport": "t", "ja3_hash": "5e48e879becff1ed980dd51c2e073946", "ja3_variant_count": 1, "ja3_variants": [ "5e48e879becff1ed980dd51c2e073946" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_3e1e5eacdaa9", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3e1e5eacdaa9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-16-23-5-45-18-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789943175, "last_seen": 1789943175, "transport": "t", "ja3_hash": "278e7ee6c0d40ca8a402240fbcdc91f7", "ja3_variant_count": 1, "ja3_variants": [ "278e7ee6c0d40ca8a402240fbcdc91f7" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_a7f1d7275918", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "a7f1d7275918", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-17613-16-65037-5-43-23-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790693464, "last_seen": 1790693464, "transport": "t", "ja3_hash": "4daf08852984264796019dbf03840804", "ja3_variant_count": 1, "ja3_variants": [ "4daf08852984264796019dbf03840804" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_e47e1425a0a4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "e47e1425a0a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-23-13-11-17613-65281-27-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790693460, "last_seen": 1790693460, "transport": "t", "ja3_hash": "21e473664409c29064e01f1b7eb8e4ad", "ja3_variant_count": 1, "ja3_variants": [ "21e473664409c29064e01f1b7eb8e4ad" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_1b8cdd526c76_bdb8e2a68208", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "1b8cdd526c76", "c": "bdb8e2a68208", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4867-4865-4866-156-52393-60-49196-49195-49200-49199-49191-47-49161-53-10,51-65281-23-35-5-13-0-10-43-45-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788858275, "last_seen": 1788858275, "transport": "t", "ja3_hash": "fb6d895b41182c7bf490c9fabfbdd8b2", "ja3_variant_count": 1, "ja3_variants": [ "fb6d895b41182c7bf490c9fabfbdd8b2" ], "user_agents": { "Go-http-client/1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a1c857e0187c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "DuckDuckGo app \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a1c857e0187c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-51-45-43-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790651506, "last_seen": 1790651506, "transport": "t", "ja3_hash": "d75e7289c86c15b305ac36097bfa0487", "ja3_variant_count": 1, "ja3_variants": [ "d75e7289c86c15b305ac36097bfa0487" ], "user_agents": { "DuckDuckGo/5 (com.duckduckgo.mobile.android; Android API 37)": 2 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_aea78d538e14", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "DuckDuckGo app \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "aea78d538e14", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 40, "first_seen": 1787494413, "last_seen": 1791236481, "transport": "t", "ja3_hash": "1d714db2228763eab228fc28ce7f8e4f", "ja3_variant_count": 2, "ja3_variants": [ "1d714db2228763eab228fc28ce7f8e4f", "f79b6bad2ad0641e1921aef10262856b" ], "user_agents": { "GoogleMessages/20.2 facebookexternalhit/1.1 Facebot Twitterbot/1.0": 2, "slack/26.08.40.0.90016107 (samsung SM-S901B; Android 16; store com.android.vending)": 3, "slack/26.08.40.0.90016107 (samsung SM-S911B; Android 16; store com.android.vending)": 3, "DuckDuckGo/5 (com.duckduckgo.mobile.android; Android API 36)": 14, "Mozilla/5.0 (Linux; Android 8.0.0; SM-J330G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36 EdgA/114.0.1823.74": 2, "DuckDuckGo/5 (com.duckduckgo.mobile.android; Android API 37)": 15 }, "ua_disagreement": true } }, { "hash": "t13d160900_693fa8a1e7ee_53d4e768415e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d160900", "b": "693fa8a1e7ee", "c": "53d4e768415e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49200-49195-49199-49191-157-156-49162-49172-49161-49171-53-47-255,0-11-10-23-13-43-45-51-21,23-24-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790696982, "last_seen": 1790696982, "transport": "t", "ja3_hash": "778ab9e2a3b6019122bd2331d5aca8c4", "ja3_variant_count": 1, "ja3_variants": [ "778ab9e2a3b6019122bd2331d5aca8c4" ], "user_agents": { "Claude-User (claude-code/2.1.284; +https://support.anthropic.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13d160900_6d57ae910dcb_73b007f92d04", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d160900", "b": "6d57ae910dcb", "c": "73b007f92d04", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4867-4866-60-49196-49200-156-49195-52393-52392-49187-10-47-49170-49161-49172,45-65281-5-0-18-35-10-43-51,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789304607, "last_seen": 1789304607, "transport": "t", "ja3_hash": "373d937c28ac363f0b372884eea7bff9", "ja3_variant_count": 1, "ja3_variants": [ "373d937c28ac363f0b372884eea7bff9" ], "user_agents": { "Go-http-client/1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1611h2_e3d26ca8fde7_7b6bd56f487f", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1611h2", "b": "e3d26ca8fde7", "c": "7b6bd56f487f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-156-49200-52392-49187-52393-49191-157-49196-49199-10-53-49170-49172-47,16-11-43-0-35-13-45-65281-10-5-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791145389, "last_seen": 1791145389, "transport": "t", "ja3_hash": "4d6a39c7a577a33a6fa1d20cf45e3949", "ja3_variant_count": 1, "ja3_variants": [ "4d6a39c7a577a33a6fa1d20cf45e3949" ], "user_agents": { "Go-http-client/2.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1616h2_46e7e9700bed_f6824c026247", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1616h2", "b": "46e7e9700bed", "c": "f6824c026247", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-51-45-43-10-27-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 30032, "name": "30032 (0x7550)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787497302, "last_seen": 1791144626, "transport": "t", "ja3_hash": "6a958df291c3f2ee216e80434750d4e1", "ja3_variant_count": 1, "ja3_variants": [ "6a958df291c3f2ee216e80434750d4e1" ], "user_agents": { "Go-http-client/2.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 OPR/89.0.4447.98": 1 }, "ua_disagreement": true } }, { "hash": "t13d171000_5b57614c22b0_badae892920c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d171000", "b": "5b57614c22b0", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1789075005, "last_seen": 1790119848, "transport": "t", "ja3_hash": "203503b7023848ab87b9836c336b8e81", "ja3_variant_count": 1, "ja3_variants": [ "203503b7023848ab87b9836c336b8e81" ], "user_agents": { "Claude-User (claude-code/2.1.196; +https://support.anthropic.com/)": 1, "Claude-User (claude-code/2.1.228; +https://support.anthropic.com/)": 2, "Dart/3.11 (dart:io)": 13 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_ab0a1bf427ad_23c7dd8c4d5c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "23c7dd8c4d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 133, "first_seen": 1787444795, "last_seen": 1791298816, "transport": "t", "ja3_hash": "86dab2109182b6bbaa644647d7db2997", "ja3_variant_count": 1, "ja3_variants": [ "86dab2109182b6bbaa644647d7db2997" ], "user_agents": { "python-requests/2.33.1": 52, "Mozilla/5.0 (compatible; url-crawler/1.0)": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0 Safari/537.36 NWSIP-Stage1": 17 }, "ua_disagreement": true } }, { "hash": "t13d181000_0b3ac25db417_282979f8dc72", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181000", "b": "0b3ac25db417", "c": "282979f8dc72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49200-49196-49195-52392-49187-49199-49191-52393-157-156-49171-49170-47-49161-53,51-43-35-45-0-11-5-10-65281-13,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789721637, "last_seen": 1789721637, "transport": "t", "ja3_hash": "49185a94c0c857c72b0738a235d97ca4", "ja3_variant_count": 1, "ja3_variants": [ "49185a94c0c857c72b0738a235d97ca4" ], "user_agents": { "Go-http-client/1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d181000_5d04281c6031_badae892920c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181000", "b": "5d04281c6031", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49199-49195-49200-49196-49191-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51-45-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1788536351, "last_seen": 1791139874, "transport": "t", "ja3_hash": "5355e3851d76d069ab8a98fdb51cf1b4", "ja3_variant_count": 2, "ja3_variants": [ "5355e3851d76d069ab8a98fdb51cf1b4", "71dc8c533dd919ae9f4963224a4ba8fd" ], "user_agents": { "Claude-User (claude-code/2.1.266; +https://support.anthropic.com/)": 2, "Claude-User (claude-code/2.1.260; +https://support.anthropic.com/)": 5, "WhatsApp/2": 6, "GrokBot-LinkPreview/1.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d181100_5d04281c6031_996dcf38c216", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181100", "b": "5d04281c6031", "c": "996dcf38c216", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49199-49195-49200-49196-49191-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51-45-43-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790179603, "last_seen": 1791139875, "transport": "t", "ja3_hash": "d76a5a80b4bb0c75ac45782b0b53da91", "ja3_variant_count": 2, "ja3_variants": [ "d76a5a80b4bb0c75ac45782b0b53da91", "f692ab6e3ffc6d9558b71841ac52ee67" ], "user_agents": { "GrokBot-LinkPreview/1.0": 2, "Claude-User (claude-code/2.1.280; +https://support.anthropic.com/)": 2 }, "ua_disagreement": false } }, { "hash": "t13d181300_e8a523a41297_184ca06a0196", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Googlebot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181300", "b": "e8a523a41297", "c": "184ca06a0196", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-52393-52392-49196-49200-49161-49171-49162-49172-156-157-47-53-10,0-23-65281-10-11-35-5-13-18-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 17777, "first_seen": 1787442670, "last_seen": 1791363381, "transport": "t", "ja3_hash": "b4da7f95e46bf2cf5285fd609cf726e4", "ja3_variant_count": 1, "ja3_variants": [ "b4da7f95e46bf2cf5285fd609cf726e4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.137 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.": 541, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 4366, "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.137 Mobile Safari/537.36 (compatible; GoogleOther)": 145 }, "ua_disagreement": true } }, { "hash": "t13d1815h2_e8a523a41297_2b6791c0b3dd", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1815h2", "b": "e8a523a41297", "c": "2b6791c0b3dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-21,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 17, "first_seen": 1787507638, "last_seen": 1791200239, "transport": "t", "ja3_hash": "6b5e0cfe988c723ee71faf54f8460684", "ja3_variant_count": 1, "ja3_variants": [ "6b5e0cfe988c723ee71faf54f8460684" ], "user_agents": { "Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01": 1, "Go-http-client/2.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d190900_9dc949149365_a38838ecc1fa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Baiduspider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d190900", "b": "9dc949149365", "c": "a38838ecc1fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1215, "first_seen": 1787445448, "last_seen": 1791359414, "transport": "t", "ja3_hash": "473cd7cb9faa642487833865d516e578", "ja3_variant_count": 12, "ja3_variants": [ "473cd7cb9faa642487833865d516e578", "1f24dbdea9cbd448a034e5d87c14168f", "df669e7ea913f1ac0c0cce9a201a2ec1", "b32a7b2beb4672901621249925410fc4", "fa4850aa84412d860833b8fc4e25ed4c", "5dfe3d28c0b8413a2d0c432220456a3c", "ac0c792b27ec00af1100e3fefa06d37c", "3c2356f00ce5d22d40e9265a27f16a89", "75395445c5b459a9809fdda2daeef677", "47a36c0c58b105f3f70b6f6bd0eb0df0", "2fd96257308ca655ad45df9c551ef27f", "77345ff2ee9432a9b2d096ffcd8b36b9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:63.0) Gecko/20100101 Firefox/63.0.3": 1, "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.143 Safari/537.36": 1, "Go-http-client/1.1": 6, "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)": 162, "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36": 67, "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)": 518 }, "ua_disagreement": true } }, { "hash": "t13d1912h2_9dc949149365_649d7e7da4f5", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "ClaudeBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1912h2", "b": "9dc949149365", "c": "649d7e7da4f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-35-13-65281-16-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1790507910, "last_seen": 1790549948, "transport": "t", "ja3_hash": "c51e7c302014a5bc35f63c466c247fb4", "ja3_variant_count": 1, "ja3_variants": [ "c51e7c302014a5bc35f63c466c247fb4" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic.com)": 2, "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)": 1, "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)": 1 }, "ua_disagreement": false } }, { "hash": "t13d2012h2_272d1fb6f253_654875230aab", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2012h2", "b": "272d1fb6f253", "c": "654875230aab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-52392-49200-52393-60-157-156-49199-49187-49195-49196-49161-10-49170-49172-49171-47-53,16-45-10-51-43-17513-11-18-35-0-23-13,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788603928, "last_seen": 1788603928, "transport": "t", "ja3_hash": "13956809fa5c182adaae30aa0dd2b623", "ja3_variant_count": 1, "ja3_variants": [ "13956809fa5c182adaae30aa0dd2b623" ], "user_agents": { "Go-http-client/2.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d2013ht_2b729b4bf6f3_b9165cb4b096", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2013ht", "b": "2b729b4bf6f3", "c": "b9165cb4b096", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-43-13-35-10-11-16-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788937263, "last_seen": 1790959072, "transport": "t", "ja3_hash": "fae0e5d973c96ae1888b99538efa0363", "ja3_variant_count": 1, "ja3_variants": [ "fae0e5d973c96ae1888b99538efa0363" ], "user_agents": { "curl/8.21.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d250900_b78ed14e2fd0_a38838ecc1fa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (a38838ecc1fa) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d250900", "b": "b78ed14e2fd0", "c": "a38838ecc1fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 9, "alpn": null } }, "ja3_string": "771,10-47-53-156-157-49161-49162-49170-49171-49172-49195-49196-49199-49200-52392-52393-5-60-49159-49169-49187-49191-4867-4865-4866,0-5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787969606, "last_seen": 1791001297, "transport": "t", "ja3_hash": "ab9a771514223079d9b13419b45c50c7", "ja3_variant_count": 1, "ja3_variants": [ "ab9a771514223079d9b13419b45c50c7" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d260900_3309cf098094_a38838ecc1fa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (a38838ecc1fa) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d260900", "b": "3309cf098094", "c": "a38838ecc1fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 9, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49161-158-52392-52394-51-61-22-49162-57-49171-10-49172-156-157-47-53-49170-4867-4865-4866,0-5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 43, "first_seen": 1787995880, "last_seen": 1790681466, "transport": "t", "ja3_hash": "43421e3931de5c5355809e68ec542a8d", "ja3_variant_count": 1, "ja3_variants": [ "43421e3931de5c5355809e68ec542a8d" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d291300_723694b0fccc_ff9189fa9ce3", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "wget \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d291300", "b": "723694b0fccc", "c": "ff9189fa9ce3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,65281-13-0-43-11-35-5-49-28-51-45-10-21,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789496449, "last_seen": 1789496449, "transport": "t", "ja3_hash": "9722ed5304debc3067288b8876635ae1", "ja3_variant_count": 1, "ja3_variants": [ "9722ed5304debc3067288b8876635ae1" ], "user_agents": { "Wget/1.25.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d3013h2_1d37bd780c83_23c7dd8c4d5c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PQCrypta IP heartbeat \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3013h2", "b": "1d37bd780c83", "c": "23c7dd8c4d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 28690, "first_seen": 1787442794, "last_seen": 1791363291, "transport": "t", "ja3_hash": "32e4b8812cda0c0d50783b438492a769", "ja3_variant_count": 2, "ja3_variants": [ "32e4b8812cda0c0d50783b438492a769", "7a73fb0bdeaa2a79fadf356c34e7577e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Mozilla/5.0": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0": 2, "pqcrypta-ip-update/1.0 (us-midwest heartbeat)": 11421, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 552 }, "ua_disagreement": true } }, { "hash": "t13d3013ht_1d37bd780c83_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python aiohttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3013ht", "b": "1d37bd780c83", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 10133, "first_seen": 1787442802, "last_seen": 1791363082, "transport": "t", "ja3_hash": "8ecf4858a704c8936042f20a8bedee04", "ja3_variant_count": 1, "ja3_variants": [ "8ecf4858a704c8936042f20a8bedee04" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (compatible; GlobRadarBot/1.0; +https://globradar.com/bot)": 51, "Python/3.14 aiohttp/3.14.1": 10 }, "ua_disagreement": true } }, { "hash": "t13d3014ht_1d37bd780c83_ed8524ea7a97", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3014ht", "b": "1d37bd780c83", "c": "ed8524ea7a97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5826, "first_seen": 1788093984, "last_seen": 1791210710, "transport": "t", "ja3_hash": "88f1fd7a4ad8bf2abd56176f5455424b", "ja3_variant_count": 1, "ja3_variants": [ "88f1fd7a4ad8bf2abd56176f5455424b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 4, "Python-urllib/3.14": 2, "Mozilla/5.0 (compatible; SiteScan/1.0; read-mostly QA gate; respects robots)": 4 }, "ua_disagreement": false } }, { "hash": "t13d311000_e8f1e7e78f70_436cb0bc5860", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "OkHttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "e8f1e7e78f70", "c": "436cb0bc5860", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 70, "first_seen": 1787463142, "last_seen": 1791232386, "transport": "t", "ja3_hash": "5cc600468c246704e1699c12f51eb3ab", "ja3_variant_count": 1, "ja3_variants": [ "5cc600468c246704e1699c12f51eb3ab" ], "user_agents": { "Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/5931-08-10 02:36:48.102402 Firefox/3.6.9": 1, "Mozilla/5.0 (Windows; U; Windows NT 5.2) AppleWebKit/535.17.5 (KHTML, like Gecko) Version/4.1 Safari/535.17.5": 1, "okhttp/3.0": 10 }, "ua_disagreement": true } }, { "hash": "t13d311000_e8f1e7e78f70_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "e8f1e7e78f70", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 484, "first_seen": 1787471737, "last_seen": 1791358541, "transport": "t", "ja3_hash": "a267e5aa93a4cd7f93a715ac4491fa0b", "ja3_variant_count": 2, "ja3_variants": [ "a267e5aa93a4cd7f93a715ac4491fa0b", "40adfd923eb82b89d8836ba37a19bca1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36": 2, "ALittle Client": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36": 39, "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 426 }, "ua_disagreement": true } }, { "hash": "t13d3112h2_e8f1e7e78f70_9d3cd320fc9b", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Baiduspider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112h2", "b": "e8f1e7e78f70", "c": "9d3cd320fc9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 40, "first_seen": 1787478199, "last_seen": 1791256572, "transport": "t", "ja3_hash": "976771cc12ab6391a021ebc6c1d77991", "ja3_variant_count": 1, "ja3_variants": [ "976771cc12ab6391a021ebc6c1d77991" ], "user_agents": { "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)": 28, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36": 12 }, "ua_disagreement": true } }, { "hash": "t13d3112ht_1d947a95fc68_68567893068e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "SeznamBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112ht", "b": "1d947a95fc68", "c": "68567893068e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-13-50-16-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 935, "first_seen": 1787443874, "last_seen": 1791362420, "transport": "t", "ja3_hash": "dc78674c6c856f9f22389e8180ee8350", "ja3_variant_count": 1, "ja3_variants": [ "dc78674c6c856f9f22389e8180ee8350" ], "user_agents": { "Mozilla/5.0 (compatible; SeznamBot/4.0; +https://o-seznam.cz/napoveda/vyhledavani/en/seznambot-crawler/)": 935 }, "ua_disagreement": false } }, { "hash": "t13d3112ht_e8f1e7e78f70_64f78f54e6a2", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "YandexBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112ht", "b": "e8f1e7e78f70", "c": "64f78f54e6a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2098, "first_seen": 1787448896, "last_seen": 1791347549, "transport": "t", "ja3_hash": "bc29aa426fc99c0be1b9be941869f88a", "ja3_variant_count": 1, "ja3_variants": [ "bc29aa426fc99c0be1b9be941869f88a" ], "user_agents": { "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)": 1993, "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0": 34, "Mozilla/5.0 (compatible; YandexRenderResourcesBot/1.0; +http://yandex.com/bots) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0": 47 }, "ua_disagreement": true } }, { "hash": "t13d4907h2_0d8feac7bc37_f58b2dd76f93", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4907h2", "b": "0d8feac7bc37", "c": "f58b2dd76f93", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865-52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,43-51-0-11-10-13-16,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 67, "first_seen": 1787472770, "last_seen": 1791344896, "transport": "t", "ja3_hash": "375c6162a492dfbf2795909110ce8424", "ja3_variant_count": 1, "ja3_variants": [ "375c6162a492dfbf2795909110ce8424" ], "user_agents": { "curl/8.7.1": 45, "Mozilla/5.0": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d491200_bd868743f55c_f0d148687978", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "LinkedInBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d491200", "b": "bd868743f55c", "c": "f0d148687978", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1432, "first_seen": 1787488884, "last_seen": 1791352290, "transport": "t", "ja3_hash": "8bd06f4341a65d44a68bd2cef7cbedc6", "ja3_variant_count": 1, "ja3_variants": [ "8bd06f4341a65d44a68bd2cef7cbedc6" ], "user_agents": { "LinkedInBot/1.0 (compatible; Mozilla/5.0; Apache-HttpClient +http://www.linkedin.com)": 72, "Mozilla/5.0 (compatible; Barkrowler/0.9; +https://babbar.tech/crawler)": 65, "Mozilla/5.0 (compatible; IbouBot/1.0; +bot@ibou.io; +https://ibou.io/iboubot.html)": 31 }, "ua_disagreement": true } }, { "hash": "t13d521200_b262b3658495_b722ecb35a82", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "axios \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d521200", "b": "b262b3658495", "c": "b722ecb35a82", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789360806, "last_seen": 1790639480, "transport": "t", "ja3_hash": "3071e91916919685206127280b6af9bf", "ja3_variant_count": 1, "ja3_variants": [ "3071e91916919685206127280b6af9bf" ], "user_agents": { "axios/1.18.1": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d7512ht_479067518aa3_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d7512ht", "b": "479067518aa3", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 75, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787621168, "last_seen": 1791221540, "transport": "t", "ja3_hash": "8a889e7a3d15642aeb93d20a85a5a1ca", "ja3_variant_count": 1, "ja3_variants": [ "8a889e7a3d15642aeb93d20a85a5a1ca" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0": 1, "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)": 1, "python-requests/2.31.0": 3 }, "ua_disagreement": true } }, { "hash": "t13i1010h2_18ef40b21276_ed9a35a78dfa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1010h2", "b": "18ef40b21276", "c": "ed9a35a78dfa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49200-52393-52392-49195-49199-49191,23-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790948739, "last_seen": 1791346052, "transport": "t", "ja3_hash": "a1b77074bab81e5056ba398e26f31871", "ja3_variant_count": 1, "ja3_variants": [ "a1b77074bab81e5056ba398e26f31871" ], "user_agents": { "curl/8.7.1": 34 }, "ua_disagreement": false } }, { "hash": "t13i131100_f57a46bbacb6_9249cab70c77", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Amazonbot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131100", "b": "f57a46bbacb6", "c": "9249cab70c77", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-43-51-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1787501113, "last_seen": 1789208914, "transport": "t", "ja3_hash": "d8e37a40e57dedd5cdf50f846ffca8f8", "ja3_variant_count": 1, "ja3_variants": [ "d8e37a40e57dedd5cdf50f846ffca8f8" ], "user_agents": { "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)": 3, "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)": 5, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 2 }, "ua_disagreement": false } }, { "hash": "t13i1311h2_f57a46bbacb6_d86ca3cca451", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1311h2", "b": "f57a46bbacb6", "c": "d86ca3cca451", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 85, "first_seen": 1787461147, "last_seen": 1791317039, "transport": "t", "ja3_hash": "8c5b2f378e481f94b4f82c131798f4d4", "ja3_variant_count": 3, "ja3_variants": [ "8c5b2f378e481f94b4f82c131798f4d4", "ee4dbd7875058c5fdff9c33a744fc786", "d5de6ac0e5cfb85b9a91508128424b99" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.1; itel it1407 Build/LMY47D) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/39.0.0.0 Mobile Safari/537.36": 5, "curl/7.74.0": 47, "Mozilla/5.0 (Linux; U; Android 2.2; en-us; Droid Build/FRG22D) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1": 5 }, "ua_disagreement": true } }, { "hash": "t13i140900_cbb2034c60b8_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i140900", "b": "cbb2034c60b8", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 14, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 198, "first_seen": 1787451681, "last_seen": 1791351619, "transport": "t", "ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7", "ja3_variant_count": 2, "ja3_variants": [ "ea4a9ae049cfc614efbb3c244abb3fc7", "1487bd354c20f20dd642bebc7f706e95" ], "user_agents": { "Go-http-client/1.1": 106, "Mozilla/5.0": 61, "-": 61, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 47, "net-research-scan/1.0 (+https://example.org/scan-info; abuse contact)": 3 }, "ua_disagreement": true } }, { "hash": "t13i150700_8daaf6152771_04c8947933f4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "04c8947933f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-10-18-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077822, "last_seen": 1791077822, "transport": "t", "ja3_hash": "fae739f09fb293735a4b057c8b119070", "ja3_variant_count": 1, "ja3_variants": [ "fae739f09fb293735a4b057c8b119070" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_6987ffba45e0", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Bingbot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "6987ffba45e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-35-10-43-17613-5-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790890826, "last_seen": 1790890826, "transport": "t", "ja3_hash": "8b04702696d4113f07ca5fe6d955e0e0", "ja3_variant_count": 1, "ja3_variants": [ "8b04702696d4113f07ca5fe6d955e0e0" ], "user_agents": { "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_3f473c87c81c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Googlebot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "3f473c87c81c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-43-35-16-65037-5-10-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791007041, "last_seen": 1791007041, "transport": "t", "ja3_hash": "b43be59569dfb1a1270774cb2da45e33", "ja3_variant_count": 1, "ja3_variants": [ "b43be59569dfb1a1270774cb2da45e33" ], "user_agents": { "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_e6dcd7dc0a04", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "e6dcd7dc0a04", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-65281-35-13-45-18-10-16-27-5-65037-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790773539, "last_seen": 1791244358, "transport": "t", "ja3_hash": "32c4566985c1d785c0b9d55a7c819218", "ja3_variant_count": 3, "ja3_variants": [ "32c4566985c1d785c0b9d55a7c819218", "1e0ad6c3b9461f25677294248afd5ff4", "f3a416a970b0aa2c941c154d79727d59" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1, "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": true } }, { "hash": "t13i1811ht_85036bcba153_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1811ht", "b": "85036bcba153", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 129, "first_seen": 1787577812, "last_seen": 1791331142, "transport": "t", "ja3_hash": "b885946e72ad51dca6c70abc2f773506", "ja3_variant_count": 2, "ja3_variants": [ "b885946e72ad51dca6c70abc2f773506", "4b510481e2e54d5956f56d2177fb122d" ], "user_agents": { "python-requests/2.31.0": 4, "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30": 5, "python-requests/2.32.5": 43, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13i190900_9dc949149365_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i190900", "b": "9dc949149365", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 243, "first_seen": 1787475204, "last_seen": 1791259779, "transport": "t", "ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c", "ja3_variant_count": 3, "ja3_variants": [ "d6828e30ab66774a91a96ae93be4ae4c", "9460af62ae0af667130bf0d36514f084", "dca978999497239c063576533ea34cce" ], "user_agents": { "Mozilla/5.0 Gecko/20100101": 1, "NTRIP GNSSInternetRadio": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 23, "Go-http-client/1.1": 25, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 4, "l9explore/1.2.2": 93, "l9tcpid/v1.1.0": 7 }, "ua_disagreement": true } }, { "hash": "t13i191000_9dc949149365_e5728521abd4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i191000", "b": "9dc949149365", "c": "e5728521abd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 123, "first_seen": 1787571422, "last_seen": 1791080975, "transport": "t", "ja3_hash": "96458b3de39df5d47bc5c4a9f10f8f26", "ja3_variant_count": 2, "ja3_variants": [ "96458b3de39df5d47bc5c4a9f10f8f26", "cc66f637ab6a9fd90b341744adf47775" ], "user_agents": { "l9tcpid/v1.1.0": 8, "Go-http-client/1.1": 20, "l9explore/1.2.2": 68, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13i3111h2_e8f1e7e78f70_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3111h2", "b": "e8f1e7e78f70", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 70, "first_seen": 1788139566, "last_seen": 1791196573, "transport": "t", "ja3_hash": "78f0dc5ac5b19daf131a133cfdee9691", "ja3_variant_count": 1, "ja3_variants": [ "78f0dc5ac5b19daf131a133cfdee9691" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64)": 33, "curl/8.18.0-DEV": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 3 }, "ua_disagreement": true } }, { "hash": "t13i3111ht_e8f1e7e78f70_a3954c448de3", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python aiohttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3111ht", "b": "e8f1e7e78f70", "c": "a3954c448de3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 23, "first_seen": 1787831223, "last_seen": 1790589394, "transport": "t", "ja3_hash": "755cbaaa441626ab9e759e8982278df5", "ja3_variant_count": 1, "ja3_variants": [ "755cbaaa441626ab9e759e8982278df5" ], "user_agents": { "Python/3.12 aiohttp/3.13.5": 2, "python-urllib3/2.7.0": 42, "PAN GlobalProtect": 6 }, "ua_disagreement": false } }, { "hash": "t13i351400_8f004308c246_d8a2da3f94cd", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i351400", "b": "8f004308c246", "c": "d8a2da3f94cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-49191-49187-49161-49162-52394-158-159-103-107-51-57-60-49170-22-10-5-49169-49159-52243-52244,18-65281-5-65037-51-27-45-17613-11-10-23-43-13-35,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1790499863, "last_seen": 1791345726, "transport": "t", "ja3_hash": "f7194fa120a1c2bbff67ee49b8e78ee0", "ja3_variant_count": 20, "ja3_variants": [ "f7194fa120a1c2bbff67ee49b8e78ee0", "d0c9edfdaf46347f9de1c113e87e7d38", "b00b682600cb734cd0d86e51888b2873", "773d3cad3100f710627f6016ea83e7e4", "a737d88ddbab0ff97b48c86996d5df4d", "d352a2c84426ecc21529cab12beb72a5", "4c4982ae5f58e8f41dc1dc31d0870125", "20b75c5c6569952e2cfcca55f545159a", "b430ef0f07d2e12ec7d91efe273362e7", "31d72c031ff7907baa82992f00dfb6c8", "0400cfc260f90a86f2d466afdde50c72", "3e07cf7c4d12f1d8e29bd7cef77cc06a" ], "user_agents": { "Go-http-client/1.1": 14 }, "ua_disagreement": false } }, { "hash": "t13i3514h2_bfa337485184_45c22c8f5b22", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3514h2", "b": "bfa337485184", "c": "45c22c8f5b22", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-11-10-13172-16-22-23-49-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789042915, "last_seen": 1790194599, "transport": "t", "ja3_hash": "63ca17cf3b8345665a5c45e90ffeb33e", "ja3_variant_count": 1, "ja3_variants": [ "63ca17cf3b8345665a5c45e90ffeb33e" ], "user_agents": { "curl/7.76.1": 5 }, "ua_disagreement": false } }, { "hash": "t13i3612ht_bcee18a5b459_cde28b4b7b1f", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3612ht", "b": "bcee18a5b459", "c": "cde28b4b7b1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 55, "first_seen": 1787558092, "last_seen": 1791299020, "transport": "t", "ja3_hash": "d18b223ce817c861b7829130500395c2", "ja3_variant_count": 1, "ja3_variants": [ "d18b223ce817c861b7829130500395c2" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/50.0.3109.73 Safari/537.32": 1, "python-requests/2.32.5": 25, "python-requests/2.34.2": 21 }, "ua_disagreement": true } }, { "hash": "q13d0310h3_55b375c5d22e_6da5d9173cfb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0310h3", "b": "55b375c5d22e", "c": "6da5d9173cfb", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-45-51-57-17613-16-27-43-10-13,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 19, "first_seen": 1789268788, "last_seen": 1791236481, "transport": "q", "ja3_hash": "a43dbc8b1fa728fc6781aac91565525a", "ja3_variant_count": 19, "ja3_variants": [ "a43dbc8b1fa728fc6781aac91565525a", "a8acb2b7b1d1c3c286abc17015f25cfb", "634a67cd8d11152117274a45e2daaa48", "dcc2d36031cfc8f1758dec50cf4dbba5", "13291f7e989ef9078829bdacc727003d", "bb3b67225f7a87185108b048e35eac8d", "d83fbbc710c843a84e0c52617b56030b", "c41d38f80b35c932352cfb7c2d1f39d2", "bfc03ebb14860d45c31fac28af7269e8", "69d67176b9e408cfb0aa49a6e81cbf52", "0844c0fd0891648cbd77e963906d2815", "275c834bc7c0031d298aecfa910c79b1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 197, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 34, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "q13d0310h3_55b375c5d22e_85bcee6495dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0310h3", "b": "55b375c5d22e", "c": "85bcee6495dd", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,51-45-57-27-10-0-17513-13-43-16,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 38, "first_seen": 1788567468, "last_seen": 1791287664, "transport": "q", "ja3_hash": "3acc9be08663b630e73665c650ebc690", "ja3_variant_count": 38, "ja3_variants": [ "3acc9be08663b630e73665c650ebc690", "6660763d347770520fc6d0db7adf9c32", "e9952e1b1acebde913b7d2eab13bc18b", "af8ae509d596a31558989f6503bcf0ce", "d3bcafded2c3c4a457ee9b567396dec4", "274f089feba48f910773bd3b807e5f31", "2291471f6c6dcfa2af8e373209ec9d21", "1821e41fd84d5fe59ffbb08530545831", "c5f39795fe5df4425b4c93c332a16a4b", "0e2261aa81aadb49dd3b2f89f59b9dd3", "26cf82d32e696f6dc033683906958cc8", "693a5b28ce544303805530643a37495c" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Mobile/15E148 Safari/604.1": 106, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36": 138, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 196, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/114.0.5720.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15": 9 }, "ua_disagreement": true } }, { "hash": "q13d0311h3_55b375c5d22e_00d49a47e7d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "00d49a47e7d1", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,51-65037-10-43-27-16-13-0-57-17513-45,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 19, "first_seen": 1788460631, "last_seen": 1791363053, "transport": "q", "ja3_hash": "43d56a1330872c15cd59a003ea511df6", "ja3_variant_count": 19, "ja3_variants": [ "43d56a1330872c15cd59a003ea511df6", "3173dc24950f17c77df156278708de28", "918062656dddf6a99ed3057c367cd752", "6ca6f6a7aa5df2210d97469f937a49d0", "517a0accc488aaeb9724326e5fc9bb94", "d41f14b4b586b486a6902318983297b4", "545ec20959a7f012cfd66dfbd7d67ff0", "71f87b2c83f60c7c9183e872fdf6460f", "c1261074d1c8a9b412d85bf895f1150b", "17a6afe8f7023de9860d0f571f00149c", "4c23198d1a564f0a46db1fa9503da8a8", "d1f464eec1fe3dc4b425e3a57e54fa7c" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.78 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 UnveilPhishingML/1.0 (+https://sitereview.unveiltech.com/)": 1, "Mozilla/5.0 (Linux; arm_64; Android 15; 2505DRP06G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.94 YaBrowser/25.4.5.94.01 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_2680ea4b03be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "2680ea4b03be", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-10-5-13-34-28-16-51-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788727395, "last_seen": 1788727504, "transport": "q", "ja3_hash": "be6737014bc03094c57d5fe1515c5c60", "ja3_variant_count": 2, "ja3_variants": [ "be6737014bc03094c57d5fe1515c5c60", "3ff1351e93027ca6fe52733bd6f2dab6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 38 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_36ae49fd04fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "36ae49fd04fe", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,0-10-16-5-13-18-51-45-43-57-27,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 386, "first_seen": 1787488747, "last_seen": 1791338316, "transport": "q", "ja3_hash": "48d08f334704479db85d91df80039756", "ja3_variant_count": 3, "ja3_variants": [ "48d08f334704479db85d91df80039756", "9a78264e64e221797705e75a3c55df01", "2f9431e877b01e163774ae4ae0df9ded" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Safari/605.1.15 Ddg/26.5": 128, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15": 11, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1": 31, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS/151.0.4129.72 Version/26.0 Mobile/15E148 Safari/604.1": 1738, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.53 Mobile/15E148 Safari/604.1": 271, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 105 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_6f167c9f8fb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "6f167c9f8fb3", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,27-10-45-51-0-57-13-17613-16-43-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790651506, "last_seen": 1790651506, "transport": "q", "ja3_hash": "9c5d6cea449054e90f886645e11d2cb6", "ja3_variant_count": 1, "ja3_variants": [ "9c5d6cea449054e90f886645e11d2cb6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_902c7b017c92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "902c7b017c92", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,51-43-13-17513-16-0-57-27-45-10-41,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790220350, "last_seen": 1790230986, "transport": "q", "ja3_hash": "d3bcf2bd1ec3d83faa34e88574d43f0c", "ja3_variant_count": 2, "ja3_variants": [ "d3bcf2bd1ec3d83faa34e88574d43f0c", "cd413a2ff5e0f59ffeb0fc9a6d0af12e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 51 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_08ad80460652", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "08ad80460652", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,65037-10-43-45-27-57-16-51-0-13-17513-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788555910, "last_seen": 1790349872, "transport": "q", "ja3_hash": "b37fea1b291ec2f8d7f15080574d5122", "ja3_variant_count": 2, "ja3_variants": [ "b37fea1b291ec2f8d7f15080574d5122", "d52220cd211a7ba2a7de88755f370c80" ], "user_agents": { "Mozilla/5.0 (Linux; arm_64; Android 15; 2505DRP06G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.94 YaBrowser/25.4.5.94.01 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_35ab28bf858e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "35ab28bf858e", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,0-10-16-5-13-18-51-45-43-57-27-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 372, "first_seen": 1787488761, "last_seen": 1791227759, "transport": "q", "ja3_hash": "94f0e94ff0087a03f09b681a965a4d96", "ja3_variant_count": 1, "ja3_variants": [ "94f0e94ff0087a03f09b681a965a4d96" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.53 Mobile/15E148 Safari/604.1": 134, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 62, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.15": 24 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_c5d60a76a678", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "c5d60a76a678", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-65037-13-57-17613-27-51-43-16-45-10-4832,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1788481429, "last_seen": 1789754315, "transport": "q", "ja3_hash": "b6bf59ce68a24a1ada4f165a51fbeb34", "ja3_variant_count": 8, "ja3_variants": [ "b6bf59ce68a24a1ada4f165a51fbeb34", "2a66fd8944ed02242c20ca291445eed7", "36c062110eec376c4e6df97cd5409d44", "f9afc880877274fcc4d4f28a264dda93", "33a7b4f60646ef4d0b69298d9b2371a7", "dac581476ede4357205bc467420b4d4a", "8359acd81e8b9e530a1a50cecef7689f", "1548284409ad6d5583a05409ac78f458" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 76, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_da69250d5c8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "da69250d5c8d", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,16-43-13-51-57-45-10-17613-27-65037-0-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1160, "first_seen": 1788442761, "last_seen": 1791362031, "transport": "q", "ja3_hash": "45698e925850bd8b27e92afb827704fe", "ja3_variant_count": 1160, "ja3_variants": [ "45698e925850bd8b27e92afb827704fe", "03b84ff4246c0b7b03f4b9d85544a51a", "792aac0bdce0e56523277398e048acb3", "76dc10c472d51acb14f1a9596bd35ddd", "a8955f9f9e9b593c2feaea34f1367ab0", "8d3ef8c16f24befc2795ac257d4152db", "25d852dee4cdd58e75c7a365d89ab42f", "e83d80ab3f13425b6c83cd60a19450e6", "4596a6a73de5567e7989a046f248adde", "66083c0a0a6676f168ae44aeaba72732", "09973bb89b6b4c8046980e6814486f2b", "8cc6f54ad4c44dd029452936784d5f84" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1010, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 880, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 585, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2771, "PromptingBot/1.0.0": 10, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 758, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 114, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2546, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2122, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1594, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1044, "Mozilla/5.0 (compatible; ev-crawler/1.0; +https://headline.com/web-crawler)": 39, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 704, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 59, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/152.0.0.0 Safari/537.36 PTST/260802.202201": 53, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 25, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 46, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 534, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 41, "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 32, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15": 5, "Mozilla/5.0 (Linux; Android 13; SM-A037U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 PTST/260802.202201": 90, "SEBot-WA": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 45, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0": 32, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 24, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36": 19, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 22 }, "ua_disagreement": true } }, { "hash": "q13d0312h3_55b375c5d22e_f60bf7ff48f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "f60bf7ff48f5", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,65037-0-10-45-43-51-16-17613-13-57-27-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2302, "first_seen": 1788441546, "last_seen": 1791363007, "transport": "q", "ja3_hash": "75c40f085ce1152bc3d074d2f3cd2cb4", "ja3_variant_count": 2302, "ja3_variants": [ "75c40f085ce1152bc3d074d2f3cd2cb4", "30822cf89ce0e54ca444991b30c6aa82", "dc7365524d0a20db49f27ff151f9a20e", "857f1e4a00b4dd4f5d68326014e6549e", "6ad44dd7c2c9543aad9658c0bb781372", "182de0aec4780b3b23a1d595c1ccd19e", "16de5dbc3d71845f8f3edcfeec52f5fa", "96882e0b0b1c60ea655f9fd755f76029", "8a52b23ba89780ee002f46e8a6d18a39", "049252bfc0435a3bb8971771c1ff8fcf", "e4a7a9db18e865a9d609e4110895889b", "874554331e70c066709f1b4471086a6a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 39260, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1650, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1248, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 25447, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0 Safari/537.36": 8, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36": 227, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 227, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 348, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 82, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.175 Safari/537.36": 29, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 2356, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 87, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 171, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 12, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 554, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.163 Safari/537.36": 9, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 465, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 454, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 143, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0 Safari/537.36": 18, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 135, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.162 Safari/537.36": 21, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 20, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 223, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7339.0 Safari/537.36": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 74, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36": 27, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0 Safari/537.36": 8, "RootEvidence/1.0": 49, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 66, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.7390.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "q13d0312h3_55b375c5d22e_f9238592c0a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "f9238592c0a5", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-28-16-45-13-5-51-34-10-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 33, "first_seen": 1788446645, "last_seen": 1791217956, "transport": "q", "ja3_hash": "5776261b3ce6c4c7d05f901ce62165f7", "ja3_variant_count": 33, "ja3_variants": [ "5776261b3ce6c4c7d05f901ce62165f7", "3322a1c43ff79f72e0e83591f9b142c4", "03b3dcb69cb6a762a4b032f866d8b97c", "1a0ab41f4ab23238d205d1f69b328604", "9fadfcd58c76b1c3fc44640324a9f163", "699026e40bd954fb456fa6b32216cb98", "dc4c1a0978cd75bd44b0c6005b34294d", "aec815024c7270e1861cfd3fdcebc515", "59438ad8f8a7fd7a6b1bd68ff64679fd", "02f140af56039b2c1e1b50aa225271e3", "3934f9d62eb3afc9a02f33725a9abf61", "49e1c09a2ab60ae639afabf33b4664a3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 6297, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0": 18, "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 28, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 20 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_0701f65b5a7a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "0701f65b5a7a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,65037-0-45-10-4832-13-57-51-43-27-17613-16-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 20, "first_seen": 1788496339, "last_seen": 1788730480, "transport": "q", "ja3_hash": "379f02c7b880df917cd61dcac8fc6114", "ja3_variant_count": 20, "ja3_variants": [ "379f02c7b880df917cd61dcac8fc6114", "bf18c550a1f31d0f147ccf082c3d0d97", "7f4e788488ebceceb2826737748d90cd", "060b7156193eba8f2729eabe406247fe", "d18645d7f76db942d387264436559db9", "835f7a5cccfdbdda6917ca8d051b875f", "9b8f9bee4e88b2aa78bf0be18d4d2c71", "c278dc170ac3f23b87f08a35fb4ffc70", "40e701f90f97164b75eae346488a9193", "c5b929953bfaf243a91f46b4bec101df", "f43823ef0a39c780fc59ae55d8ec9058", "5552dc60543646b205ed9930098b903d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 36 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_53a8b841c459", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "53a8b841c459", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-57-45-51-34-28-10-27-5-16-13,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 41, "first_seen": 1789548608, "last_seen": 1791337028, "transport": "q", "ja3_hash": "d1cab55146dbbd7ff5db78fbe13510f0", "ja3_variant_count": 41, "ja3_variants": [ "d1cab55146dbbd7ff5db78fbe13510f0", "b9159905556a70f79e02b1a8f057a5c8", "fca334d53aafc05805c2ca735b030ab4", "a432debc44afd56e5652ab118647f3a6", "fa56e3d49955bc26515b7d6121f76fda", "90c6d015d81000f6ec25553824842259", "211ab27a1d4b3d08224d626b8ae69640", "4285e8d7e5707674ec965e278d10fe72", "d66e2015f043e46372e02ecea0976030", "356a8344e6afc24f0098cd8e20ff7429", "f2f06521f5e99ef9c2c8ce2679256150", "3a06e36442e8a4b63321985cce12f8dd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 1132, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 249, "Mozilla/5.0 (Android 13; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 139, "Mozilla/5.0 (Android 16; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 63, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 146, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 503 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_6ca3580cd977", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "6ca3580cd977", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-65037-17613-57-27-45-51764-16-43-13-51-10-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 970, "first_seen": 1788454684, "last_seen": 1791363377, "transport": "q", "ja3_hash": "4d0ac714e5325e71e4cada3551d04aae", "ja3_variant_count": 970, "ja3_variants": [ "4d0ac714e5325e71e4cada3551d04aae", "582de2c3b019f7e6bc8beea880706dea", "ec305dff78a3c0515f50e3dc63b75510", "8cd3351ce642088b754b6f6621d3096c", "61e547969ec6741d743c85c17c2c7c5e", "649eef9cf1c573c964fa42e352943d10", "806dae6a35563e6cb6d556b35f48e65d", "766aa75f96fa1c28d3f817b57ca26de6", "bc4e79cc29a4de61f66b65875944e45f", "bcbe477789423d2ebc7063d95589c095", "d58aa42873e230c761f58ebb38d87b3c", "9c61bb5e06060969c20c0899eaf93e55" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2071, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 301, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 11245, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1511, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 300, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 281, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1417, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1506, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 98, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 468, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 294, "Mozilla/5.0 (compatible; ev-crawler/1.0; +https://headline.com/web-crawler)": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 51 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_7b1c3b3675f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "7b1c3b3675f6", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-10-16-45-13-51-28-34-5-57-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1791017360, "last_seen": 1791224643, "transport": "q", "ja3_hash": "579c3942fcd7158810ed68c7aa3e857d", "ja3_variant_count": 4, "ja3_variants": [ "579c3942fcd7158810ed68c7aa3e857d", "01392c383c796c97b7158cb65dfca163", "a91db7c6ad94f1040c29f115892447be", "f36f8df68fc24c75118a34de3a5338d2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 807 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_824790d21c68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "824790d21c68", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-57-34-16-45-10-27-5-51-13-28,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 69, "first_seen": 1788441814, "last_seen": 1791285222, "transport": "q", "ja3_hash": "829f87ed97f4e6914f18b188320a3b39", "ja3_variant_count": 69, "ja3_variants": [ "829f87ed97f4e6914f18b188320a3b39", "0f6bb16e172eeb4c660d7f55132004da", "60aef5de4589346d6824338114f367f8", "8b89592f35c1dc2993c23fe114c39093", "9dd5ec25481c6eaab1932a93159f40ef", "dde14aa945f2b9f62d18a23419acd60e", "1c8eb7b4cb1886cd4c085757ab120b73", "f9d9424d668b33e3084c4fb4975bb28c", "b9a75788632c94addcfeb161c3b4d118", "4a67a55820fa4ef701c9f30604981cec", "a62620bb71b13899ddc32355910fbc5e", "7be520b8472675e56326c1a5328d4278" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 267, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 546, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 74, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 86, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 51, "Mozilla/5.0 (X11; Linux x86_64; rv:158.0) Gecko/20100101 /158.0a1": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 89, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0": 28, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 23, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 23, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 200, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 37, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 39, "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0": 24, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 83, "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 23, "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 24, "Mozilla/5.0 (Android 16; Mobile; rv:155.0) Gecko/155.0 Firefox/155.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 18, "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0": 33 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_b895d4c2708b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "b895d4c2708b", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-57-10-13-5-45-16-27-28-51-34,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789400943, "last_seen": 1790017838, "transport": "q", "ja3_hash": "54844bf5884ac8adfc421690aced3612", "ja3_variant_count": 4, "ja3_variants": [ "54844bf5884ac8adfc421690aced3612", "9e0da737aef14932f1730c0013363308", "16942382da54c033b8fc40adeb96262f", "d8a66593f67258a047a3f6fb326d8d9a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 14 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_bc972749234a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "bc972749234a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,17613-43-51-65037-10-0-51764-45-16-13-27-4832-57,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 55, "first_seen": 1788445298, "last_seen": 1791258879, "transport": "q", "ja3_hash": "bccad3404a6e67413f7d70ba200459d7", "ja3_variant_count": 55, "ja3_variants": [ "bccad3404a6e67413f7d70ba200459d7", "9753f780fb554a7fbe0964d83703c41d", "23e5aaa74602bf000ede9ca744dbb3a7", "1490d038b7801706723e004d5a2793d1", "3eb2fb4057aa616059aee4ef8fd4b6e0", "8892dddd759e06080d1fe394733c5c7e", "0b0c650a0b9e3c0112c99d19c27acd5b", "e50be14746cca50346601d3daaf8e4b9", "4b6880acf6de085aa2e0801a19d72d6d", "afa72ac574decd9ecee944237c84d10d", "a2c2f48e55df3c55591868d83a758b17", "f07335c8bd5c6dac6b7fc7f27c8ed213" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 158, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 169, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 89, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 48, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 80, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2159.1780 Safari/537.36": 24, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 46, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 93, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.7129.1365 Safari/537.36": 9, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 29 }, "ua_disagreement": true } }, { "hash": "q13d0313h3_55b375c5d22e_bea67a3397ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "bea67a3397ee", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-57-28-45-51-34-10-13-16-27-5,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789051689, "last_seen": 1789396788, "transport": "q", "ja3_hash": "4a5d6609e481058da9ba363272945d26", "ja3_variant_count": 4, "ja3_variants": [ "4a5d6609e481058da9ba363272945d26", "92be168b2b749bbcddaeb7789d403da6", "bc8edbb49ffe9bf28b4030f6409db086", "b141832ba9c6f84a8d34b1a229c5f174" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 131 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_e08d512f6d51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "e08d512f6d51", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,13-28-5-34-65281-16-43-23-51-0-10-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 20, "first_seen": 1789762406, "last_seen": 1791207821, "transport": "q", "ja3_hash": "b377ded32b1df94ad7b2fb01921894d7", "ja3_variant_count": 20, "ja3_variants": [ "b377ded32b1df94ad7b2fb01921894d7", "42a3b5d42be8815f85f14c9df2711f96", "28a62590709824a21fcae694f4151d41", "4e0bbc17cd92bc2efe9dd097d6ebca96", "af98a172935c7c98cbfa3fea312c0176", "a0328f03f93fd2edd66c20208d1c9e56", "b42c397e3bb69d33777a26af5f98226f", "be2ca4339ea240a600fff8b173399680", "d1fb7b5faa5917774d04ebcfd347fb53", "0c965bddf6a6c592ff2af5561bbd2b83", "40d1e9b6128019d51970c09f2ff0932b", "8f08dfb6d7e69850b5e85c3f9af78980" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 36, "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 101 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_5e8caae252b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "5e8caae252b6", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,0-23-65281-10-16-5-34-51-43-13-45-28-57-65037,29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 146, "first_seen": 1788446648, "last_seen": 1791141949, "transport": "q", "ja3_hash": "7a8e625dea44f20fe8d8d657583506d1", "ja3_variant_count": 144, "ja3_variants": [ "7a8e625dea44f20fe8d8d657583506d1", "b5d172cec8236605c3472f870c8ea641", "1b21c971f14aac40fb8af3ecf1e71494", "9309e9a7b0ab48aa31ced69b79bd8020", "e54e1faea723f1a3a20abf2a48d8cb64", "869687a477e0a18d14cd4dcf7058c639", "8fd0e9b9d76dee47a320f158dd2feaeb", "f6700f3326a434ec57e2518f6fc97697", "f30e9eaf42e97709cdef36c9c0d37d3e", "d9cd584bd5c8f1d89c4ed4f2157e0f79", "e5d42316feb4c01fbc101c7b2a2af09b", "7bf2baa074e588fcf66c5d196105d32b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 3162, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0": 10, "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0": 4 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_7dbaeef5f02a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "7dbaeef5f02a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,45-4832-17613-0-13-65037-27-43-57-16-10-51764-51-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1788811479, "last_seen": 1790979359, "transport": "q", "ja3_hash": "f6d3c931e8614e9858709b843b98cef4", "ja3_variant_count": 11, "ja3_variants": [ "f6d3c931e8614e9858709b843b98cef4", "b5dede9b5811efc4592be84d3b7c172a", "4222021a5fb88a22590dd16ab4c964b0", "3b1ce8c435514a1053011925abe796c1", "d6545d96f3f443a924b0afb60901edb5", "c663f9a007d9b871fbfe199274f2935f", "65e1683ac75288d08b840fa3f01d91cb", "5d0d20f646564014e75debf0db954d14", "ad282db31426f0f7bafb3f3a00f79cbf", "3a6d7bcf30b51b87943694b72822c25d", "2b741b5fc52cb2d3823c0ccda7e1303c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_911ef5bc091a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "911ef5bc091a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,0-23-65281-10-16-5-34-51-43-13-45-28-57-21,29-23-24-25-256-257-258-259-260,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788638692, "last_seen": 1790583459, "transport": "q", "ja3_hash": "b719940c5ab9a3373cb4475d8143ff88", "ja3_variant_count": 1, "ja3_variants": [ "b719940c5ab9a3373cb4475d8143ff88" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:109.0) Gecko/20100101 Firefox/115.0": 7, "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0": 38, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/115.0": 32 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_bc0999561792", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "bc0999561792", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-57-16-5-27-13-10-28-51-34-45-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 10, "first_seen": 1790603271, "last_seen": 1790663151, "transport": "q", "ja3_hash": "0d0432a67eda9793a53b7042972faa80", "ja3_variant_count": 10, "ja3_variants": [ "0d0432a67eda9793a53b7042972faa80", "d5b385c70ef24a826bcdd329848a8b4f", "32ced76233b0f94eed4d0d3d765389ec", "ef0e6fb3b2a1c96573c9bce55c8688cb", "18a959ed1cbb2410dbd9078f0143deb2", "5f663475441c103e3c946bca249fe6db", "ab53789cbee9ec976c2ba918233529d7", "3ee19e68e98a26a0418d892c259c5988", "5a430dfdd31d42c2af01b22dcabd9ccc", "f80db168ebc9e12888fe9d91509ccfad" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 294, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 614, "Mozilla/5.0 (Android 13; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 15 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_e4435efaeef9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "e4435efaeef9", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-57-34-16-10-27-28-51-45-5-13-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790867872, "last_seen": 1791285278, "transport": "q", "ja3_hash": "1d3fd2ff4d4775e9cdaf3a96627946c4", "ja3_variant_count": 2, "ja3_variants": [ "1d3fd2ff4d4775e9cdaf3a96627946c4", "7240a7bef8f9f6ccf741be05fe8ba833" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 3 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_2473069875c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "2473069875c4", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,51-23-65281-13-10-34-45-5-28-0-43-16-27-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 255, "first_seen": 1788441812, "last_seen": 1791303151, "transport": "q", "ja3_hash": "96bcae9b35ea9da3b0a26ee5fbeacc3e", "ja3_variant_count": 255, "ja3_variants": [ "96bcae9b35ea9da3b0a26ee5fbeacc3e", "42e550527eef2cd22ac7076c147d79ae", "57d2808272ed4ba60ad0b126ad7b8e8b", "f02acbb6fa43ba4cf706662112940e34", "daded486e94eb5b59ef252d4b5fedff8", "73b5aa4a1693b697fc13c1f222b74b2f", "f9451a72b39a916acbf23a73c35b5327", "7988fc0c2f022e5dcfb86f3191dd71b5", "b2ccff7ad1d3e12faa3b93e47a5c3b94", "44eb4c179b33abe2c15c2194644c85f3", "be692ef4d8eb1809079f8ffcb4fe1357", "56a145f4ccf33dae58b7a8f1e478d922" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 653, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 1170, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 109, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 136, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 123, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 80, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 19, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 240, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 151, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 65, "Mozilla/5.0 (Android 17; Mobile; rv:155.0) Gecko/155.0 Firefox/155.0": 19, "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0": 14, "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 228, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0": 495, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:157.0) Gecko/20100101 Firefox/157.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 7, "Mozilla/5.0 (Android 16; Mobile; rv:155.0) Gecko/155.0 Firefox/155.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0": 45, "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 2 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_626768ae0108", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "626768ae0108", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,34-45-65281-27-16-28-43-5-51-13-23-10-0-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 660, "first_seen": 1788556931, "last_seen": 1791149129, "transport": "q", "ja3_hash": "b9c77f39fba78e218703bdafb907afe6", "ja3_variant_count": 660, "ja3_variants": [ "b9c77f39fba78e218703bdafb907afe6", "5842b45d783a8147feeddd8f1f10345a", "22050d5fb1c5c10a0dc3d3a96eac9e19", "a194c2e60edcf606ddef57c6d4587047", "0a8e372680320f7e7fb67af99d43e4f3", "b4a088aea0af2190d0600b4d7afac39e", "db71bf1b8749bb2aab46c4c33591d2e2", "198b04c5df010f144d74d5ed2da8e0db", "4131a8f2beea6d40192a0f4135ff4490", "346c51b6fab1ad92147328860e7e563e", "4916bf0acb27e1d1fef6f87e6df7c429", "8c29100efd25e55180a6b7fbdc85f613" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 2028, "Mozilla/5.0 (Android 14; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 78, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 1080, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 459, "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0": 70, "Mozilla/5.0 (Android 13; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 13, "Mozilla/5.0 (Android 16; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 72, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 8 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_6af405fcf435", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "6af405fcf435", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,45-43-28-23-16-65281-0-51-13-5-10-27-34-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 93, "first_seen": 1789051694, "last_seen": 1789399140, "transport": "q", "ja3_hash": "e7cfd7ca025f9bb364b87c3ffa6d25e9", "ja3_variant_count": 93, "ja3_variants": [ "e7cfd7ca025f9bb364b87c3ffa6d25e9", "b6a9a18200406467ae65adb80c5c52e0", "f1379a0a1a690bca23ec9fd22457d680", "cfd0fb492830bb79206810838b6d2957", "fdf691e91166561e863f6f17176f4f46", "eeb7348dd72739c964d6f973bbc3005a", "c816e0ff64b33a7a5b342333beb760fa", "e984b8335c92ffd7f3c49e30c7314e98", "c2522b0d468520f02ef89904392138be", "4b98bb4d270c4fe36848447ebf853702", "2dbc09c4f8bfe07eeb4ffb79491ff728", "2cfcc47571a482e88b42cfc4f6b423a2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 133 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_725e25c74efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "725e25c74efd", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,13-23-16-65281-34-43-10-45-28-27-51-5-0-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789472425, "last_seen": 1789652357, "transport": "q", "ja3_hash": "8b52796f45070fc15ab3952715a513bc", "ja3_variant_count": 2, "ja3_variants": [ "8b52796f45070fc15ab3952715a513bc", "af4243cffdd3f4cade734ab99dda1439" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 8 }, "ua_disagreement": false } }, { "hash": "q13d0316h3_55b375c5d22e_1c63e1c09786", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0316h3", "b": "55b375c5d22e", "c": "1c63e1c09786", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,28-23-0-51-65281-16-5-34-10-43-45-27-13-57-65037-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 28, "name": "record_size_limit", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791002548, "last_seen": 1791002548, "transport": "q", "ja3_hash": "0562f80ef0d308c251ae29af37f1f727", "ja3_variant_count": 1, "ja3_variants": [ "0562f80ef0d308c251ae29af37f1f727" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 9 }, "ua_disagreement": false } }, { "hash": "q13d0316h3_55b375c5d22e_67ff8e38dd8c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0316h3", "b": "55b375c5d22e", "c": "67ff8e38dd8c", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,16-10-0-65281-13-45-5-23-28-27-34-51-43-57-65037-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1790602535, "last_seen": 1790623455, "transport": "q", "ja3_hash": "492ac74f50c8c0b9f659ce045b189836", "ja3_variant_count": 4, "ja3_variants": [ "492ac74f50c8c0b9f659ce045b189836", "4747cceba11bbea78a15091b9e91fec8", "d20dedc8f49a6ff5ea0765a490558bf3", "b68c365c7bca9c980a9d65d158ec6194" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 126, "Mozilla/5.0 (Android 13; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 1 }, "ua_disagreement": false } }, { "hash": "q13d0413h3_16476d049b0b_745ab6f97f32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0413h3", "b": "16476d049b0b", "c": "745ab6f97f32", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-16-22-23-49-13-43-45-51-57-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4413, "first_seen": 1787442711, "last_seen": 1791363085, "transport": "q", "ja3_hash": "42125b8d3d7a27886a9600b9a38e8559", "ja3_variant_count": 3, "ja3_variants": [ "42125b8d3d7a27886a9600b9a38e8559", "3fdff4d24f9789bafa145c6e30e8031d", "e8eac859d9939ad67c1b133a9ba103c0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 3919, "Go-http-client/2.0": 3, "curl/8.18.0-DEV": 170 }, "ua_disagreement": true } }, { "hash": "t12d0309h2_55b375c5d22e_4234f4f8d875", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d0309h2", "b": "55b375c5d22e", "c": "4234f4f8d875", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 3, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866,0-23-65281-10-16-5-34-18-51,4588-29-23-24-25-256-257,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [] }, "observed": { "count": 18, "first_seen": 1790842592, "last_seen": 1790842598, "transport": "t", "ja3_hash": "22f55bb0bd09950a3cbbf22292800da0", "ja3_variant_count": 1, "ja3_variants": [ "22f55bb0bd09950a3cbbf22292800da0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 38 }, "ua_disagreement": false } }, { "hash": "t12d130200_f57a46bbacb6_e756749613b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d130200", "b": "f57a46bbacb6", "c": "e756749613b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 2, "alpn": null } }, "ja3_string": "771,52393-52392-49195-49199-49196-49200-49161-49171-49162-49172-4867-4865-4866,0-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790628400, "last_seen": 1790628400, "transport": "t", "ja3_hash": "e2cbd84848ec221c6d8f1e665fec21e5", "ja3_variant_count": 1, "ja3_variants": [ "e2cbd84848ec221c6d8f1e665fec21e5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d130800_f57a46bbacb6_da269a3f638a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d130800", "b": "f57a46bbacb6", "c": "da269a3f638a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 27, "first_seen": 1787471562, "last_seen": 1790966586, "transport": "t", "ja3_hash": "d8f17d41fba1d5b9f88fff3a2bf0df6c", "ja3_variant_count": 1, "ja3_variants": [ "d8f17d41fba1d5b9f88fff3a2bf0df6c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.5599.130 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.6111.87 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.5690.62 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1310h2_8b80da21ef18_6c199d4894a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d1310h2", "b": "8b80da21ef18", "c": "6c199d4894a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-11-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 58, "first_seen": 1787772522, "last_seen": 1790863627, "transport": "t", "ja3_hash": "bc6c386f480ee97b9d9e52d472b772d8", "ja3_variant_count": 1, "ja3_variants": [ "bc6c386f480ee97b9d9e52d472b772d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1310h2_f57a46bbacb6_fdfedcf8c354", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1310h2", "b": "f57a46bbacb6", "c": "fdfedcf8c354", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-52393-49199-52392-49162-49161-49172-49171,0-23-65281-10-11-16-5-13-18-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789355904, "last_seen": 1790068320, "transport": "t", "ja3_hash": "9223f20a70d5753741a78e5b06e9648c", "ja3_variant_count": 2, "ja3_variants": [ "9223f20a70d5753741a78e5b06e9648c", "ebd040121a56b6c06b9f24a33d45434f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.4 facebookexternalhit/1.1 Facebot Twitterbot/1.0": 2, "DeepSeek Chat/2.5.2 (com.deepseek.chat; build:7; iOS 27.2.0) Alamofire/5.10.2": 1 }, "ua_disagreement": false } }, { "hash": "t12d1311h2_8b80da21ef18_bc4a777cfdc5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d1311h2", "b": "8b80da21ef18", "c": "bc4a777cfdc5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 30032, "name": "30032 (0x7550)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789405268, "last_seen": 1790181004, "transport": "t", "ja3_hash": "94c485bca29d5392be53f2b8cf7f4304", "ja3_variant_count": 1, "ja3_variants": [ "94c485bca29d5392be53f2b8cf7f4304" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150200_8daaf6152771_1b12d417929b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150200", "b": "8daaf6152771", "c": "1b12d417929b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 15, "first_seen": 1788147669, "last_seen": 1791299125, "transport": "t", "ja3_hash": "ce3c89f378314f9ab654c09f0b60df1e", "ja3_variant_count": 1, "ja3_variants": [ "ce3c89f378314f9ab654c09f0b60df1e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_1037bdebdd62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "1037bdebdd62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788620851, "last_seen": 1790223256, "transport": "t", "ja3_hash": "ba422d220df57d21232e88ed18a71df0", "ja3_variant_count": 3, "ja3_variants": [ "ba422d220df57d21232e88ed18a71df0", "436a49d8bffc70281ec2f871088227a0", "ed36d5b86808bab06feb806f040bfe21" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_27e267d15e11", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "27e267d15e11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788836146, "last_seen": 1791020227, "transport": "t", "ja3_hash": "f66da1a354d437f56843f5892eddc4e3", "ja3_variant_count": 2, "ja3_variants": [ "f66da1a354d437f56843f5892eddc4e3", "1b4ae136bf5dda8ede24a09db9f07c95" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_2968ded16f02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "2968ded16f02", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788780984, "last_seen": 1790201326, "transport": "t", "ja3_hash": "0a2c9c111fd3419a7e16fe442a72a745", "ja3_variant_count": 2, "ja3_variants": [ "0a2c9c111fd3419a7e16fe442a72a745", "c0b2779eb8abfe8680a2fa2a6282eb93" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_a537042d8382", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "a537042d8382", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790214341, "last_seen": 1790563273, "transport": "t", "ja3_hash": "dee8f5b5ddd86c6247fccb40ece1568b", "ja3_variant_count": 3, "ja3_variants": [ "dee8f5b5ddd86c6247fccb40ece1568b", "362843bea6640eea3d36b268def4fc3c", "9525b2e52df363abd83e20b46ae533bb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788965189, "last_seen": 1788965189, "transport": "t", "ja3_hash": "2764fcba8d3ecd74cc33de5ee5e3af0e", "ja3_variant_count": 1, "ja3_variants": [ "2764fcba8d3ecd74cc33de5ee5e3af0e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_c988acfa4f19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "c988acfa4f19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789646815, "last_seen": 1790699605, "transport": "t", "ja3_hash": "50f106f4a102447a2efa16bfbd8a8020", "ja3_variant_count": 2, "ja3_variants": [ "50f106f4a102447a2efa16bfbd8a8020", "6828d4d0938451ac917a74cafc1783aa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_cb0c27a6e9f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "cb0c27a6e9f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789829295, "last_seen": 1791247955, "transport": "t", "ja3_hash": "5d1c020f6a474330da91583569e71fc1", "ja3_variant_count": 2, "ja3_variants": [ "5d1c020f6a474330da91583569e71fc1", "b8a7dbf836dd5abfd314c15d4023e35d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_d50387acfe72", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "d50387acfe72", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790188471, "last_seen": 1790188471, "transport": "t", "ja3_hash": "abb4b79fac099c3e5f3fc2def5553885", "ja3_variant_count": 1, "ja3_variants": [ "abb4b79fac099c3e5f3fc2def5553885" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3456.23 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_ef9d29fa14b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "ef9d29fa14b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787827866, "last_seen": 1791285263, "transport": "t", "ja3_hash": "64649f6616902001c5ac6b8b9f3cba14", "ja3_variant_count": 2, "ja3_variants": [ "64649f6616902001c5ac6b8b9f3cba14", "b60e990260b58b75280a622a3e6196b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12d1503h1_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1503h1", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790978176, "last_seen": 1790978176, "transport": "t", "ja3_hash": "e76751cdff2796470a1e821ba73864d9", "ja3_variant_count": 1, "ja3_variants": [ "e76751cdff2796470a1e821ba73864d9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1503h2_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (baf0a4827efd) with 4 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d1503h2", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552174, "last_seen": 1788552174, "transport": "t", "ja3_hash": "bd8ab30ac2691412f699cecb6a9b15ac", "ja3_variant_count": 1, "ja3_variants": [ "bd8ab30ac2691412f699cecb6a9b15ac" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150400_8daaf6152771_01b6db3acd9a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "01b6db3acd9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790561714, "last_seen": 1791215867, "transport": "t", "ja3_hash": "90fbe91afeb9b0ed1fe551bd88ca30cf", "ja3_variant_count": 1, "ja3_variants": [ "90fbe91afeb9b0ed1fe551bd88ca30cf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_088cf4770d0f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "088cf4770d0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-0-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790227780, "last_seen": 1790227780, "transport": "t", "ja3_hash": "9ebac4f608d199fcb169d3b7823c28dc", "ja3_variant_count": 1, "ja3_variants": [ "9ebac4f608d199fcb169d3b7823c28dc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_08f4e96ed339", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "08f4e96ed339", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790212855, "last_seen": 1791149173, "transport": "t", "ja3_hash": "802d342e67755d73b926b7ff720a4de2", "ja3_variant_count": 2, "ja3_variants": [ "802d342e67755d73b926b7ff720a4de2", "55c5ce86b56636a6f48c29c441310a5a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_11f55bce4215", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "11f55bce4215", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790615495, "last_seen": 1790615495, "transport": "t", "ja3_hash": "372d40dcbb20cd8478e4cb959e9c406f", "ja3_variant_count": 1, "ja3_variants": [ "372d40dcbb20cd8478e4cb959e9c406f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_1afacb3113b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "1afacb3113b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776182, "last_seen": 1789776182, "transport": "t", "ja3_hash": "d604dc4f0e3ff9eaa09df2506c3382e9", "ja3_variant_count": 1, "ja3_variants": [ "d604dc4f0e3ff9eaa09df2506c3382e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_21d4e6433b0e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "21d4e6433b0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-13-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790029249, "last_seen": 1790029249, "transport": "t", "ja3_hash": "a91169ce2b8480074e25e2e4d8569001", "ja3_variant_count": 1, "ja3_variants": [ "a91169ce2b8480074e25e2e4d8569001" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_24be3a94643d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "24be3a94643d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788824793, "last_seen": 1790236575, "transport": "t", "ja3_hash": "888c634bb1c0b4f0306013f510d7e277", "ja3_variant_count": 2, "ja3_variants": [ "888c634bb1c0b4f0306013f510d7e277", "bd96bc091e480c41ed05813f08208da3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_2d266b4c4422", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "2d266b4c4422", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788788507, "last_seen": 1791275511, "transport": "t", "ja3_hash": "f7761981a5691fa13a81fb416dfa4cef", "ja3_variant_count": 2, "ja3_variants": [ "f7761981a5691fa13a81fb416dfa4cef", "17907122c2db39607f33038ee89c12bc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_45d94bed0bc4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "45d94bed0bc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790029174, "last_seen": 1790029174, "transport": "t", "ja3_hash": "2a7e5be1860ec9810164848c89303e20", "ja3_variant_count": 1, "ja3_variants": [ "2a7e5be1860ec9810164848c89303e20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_497e282bcdb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "497e282bcdb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788380818, "last_seen": 1791135131, "transport": "t", "ja3_hash": "32c3a4cbf210de5419fa47d999960100", "ja3_variant_count": 1, "ja3_variants": [ "32c3a4cbf210de5419fa47d999960100" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_55a0f8a19a8e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "55a0f8a19a8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788791350, "last_seen": 1791013029, "transport": "t", "ja3_hash": "c4d6d08d075f88f3660a815691bbf144", "ja3_variant_count": 3, "ja3_variants": [ "c4d6d08d075f88f3660a815691bbf144", "6c20163d091dfb5fd4cc24825332725f", "a734d22871183ae97839df0eb98a710f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_5607da189e96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "5607da189e96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789224354, "last_seen": 1789224354, "transport": "t", "ja3_hash": "1d7ed160de91d8ea379f670d89b63ed5", "ja3_variant_count": 1, "ja3_variants": [ "1d7ed160de91d8ea379f670d89b63ed5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_5643bfcee586", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "5643bfcee586", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790702244, "last_seen": 1790702244, "transport": "t", "ja3_hash": "36fa034a5c3df0267597f2b617004d57", "ja3_variant_count": 1, "ja3_variants": [ "36fa034a5c3df0267597f2b617004d57" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_572e9f68f086", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "572e9f68f086", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790313419, "last_seen": 1790313419, "transport": "t", "ja3_hash": "c38247d4910bb0bb74acef3b1b62cc34", "ja3_variant_count": 1, "ja3_variants": [ "c38247d4910bb0bb74acef3b1b62cc34" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_5e7d57c5c4e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "5e7d57c5c4e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790361983, "last_seen": 1790361983, "transport": "t", "ja3_hash": "bcd263185dbef358c1091f24b75a3f9e", "ja3_variant_count": 1, "ja3_variants": [ "bcd263185dbef358c1091f24b75a3f9e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_6228070e188e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "6228070e188e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789870183, "last_seen": 1791032234, "transport": "t", "ja3_hash": "632b789e10d0256f10ad45c71d2e97f3", "ja3_variant_count": 2, "ja3_variants": [ "632b789e10d0256f10ad45c71d2e97f3", "76f92d429e51b946f61357e697d0a4da" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_644b8bc94a83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "644b8bc94a83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790222308, "last_seen": 1791284957, "transport": "t", "ja3_hash": "d80318171f6fbd27dfd2d58b8751e448", "ja3_variant_count": 2, "ja3_variants": [ "d80318171f6fbd27dfd2d58b8751e448", "0ffc54f0cd919d8f4ae16677dd970b29" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_762b5886a455", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (762b5886a455) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "762b5886a455", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790230739, "last_seen": 1791123324, "transport": "t", "ja3_hash": "509c538880fd49ee9ba25614b51a1dc5", "ja3_variant_count": 2, "ja3_variants": [ "509c538880fd49ee9ba25614b51a1dc5", "560e9c785abc7b3f2a870600a2e3c6b3" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150400_8daaf6152771_7ecc11558ac0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "7ecc11558ac0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791085757, "last_seen": 1791085757, "transport": "t", "ja3_hash": "66bde0b2e10f0a7d7551d2606451e770", "ja3_variant_count": 1, "ja3_variants": [ "66bde0b2e10f0a7d7551d2606451e770" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_81de017437bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "81de017437bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791235598, "last_seen": 1791235598, "transport": "t", "ja3_hash": "e3865414573a877ce772994ff5a86e89", "ja3_variant_count": 1, "ja3_variants": [ "e3865414573a877ce772994ff5a86e89" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_89ce44e3989a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "89ce44e3989a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790243782, "last_seen": 1790243782, "transport": "t", "ja3_hash": "a157ccdc82069889bbfbab5016a811a3", "ja3_variant_count": 1, "ja3_variants": [ "a157ccdc82069889bbfbab5016a811a3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_9f1d7398a82c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "9f1d7398a82c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788763480, "last_seen": 1788763480, "transport": "t", "ja3_hash": "8d66bb52100efc87be8494a7ff952da4", "ja3_variant_count": 1, "ja3_variants": [ "8d66bb52100efc87be8494a7ff952da4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_ae39024d9ed9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "ae39024d9ed9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790539209, "last_seen": 1790539209, "transport": "t", "ja3_hash": "e68ffe2fc5012446b0a58d2d25c51d50", "ja3_variant_count": 1, "ja3_variants": [ "e68ffe2fc5012446b0a58d2d25c51d50" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_b393474956ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "b393474956ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788973911, "last_seen": 1788973911, "transport": "t", "ja3_hash": "47636259c8e34a1451d78b583d633d85", "ja3_variant_count": 1, "ja3_variants": [ "47636259c8e34a1451d78b583d633d85" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_b5c8f20dbb54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "b5c8f20dbb54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241026, "last_seen": 1790241026, "transport": "t", "ja3_hash": "49f6a1e16209aa18f85b942e79cde4bc", "ja3_variant_count": 1, "ja3_variants": [ "49f6a1e16209aa18f85b942e79cde4bc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_bce43051f4df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (bce43051f4df) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "bce43051f4df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-51-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788512720, "last_seen": 1788512720, "transport": "t", "ja3_hash": "75fd5531de3dbb956b250a752db9cf05", "ja3_variant_count": 1, "ja3_variants": [ "75fd5531de3dbb956b250a752db9cf05" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150400_8daaf6152771_bdc91fe8a595", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "bdc91fe8a595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788790790, "last_seen": 1790910326, "transport": "t", "ja3_hash": "75103551cf572caf25a00a7c6ed9650d", "ja3_variant_count": 4, "ja3_variants": [ "75103551cf572caf25a00a7c6ed9650d", "a43ebe16a0ef24109a7d018f44d0bdfb", "0900dbc867d8b5032d14fd27f5e7febc", "69a9b21fd44593456306a63b6c599686" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_d843c6637762", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "d843c6637762", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790510901, "last_seen": 1790510901, "transport": "t", "ja3_hash": "a15338c85798b70ae9c1d562ffdd5517", "ja3_variant_count": 1, "ja3_variants": [ "a15338c85798b70ae9c1d562ffdd5517" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_f359bec8aaa4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "f359bec8aaa4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788515788, "last_seen": 1788989492, "transport": "t", "ja3_hash": "d41915d1c528be97702a9e76df6a805d", "ja3_variant_count": 1, "ja3_variants": [ "d41915d1c528be97702a9e76df6a805d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_fe8352abbea0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "fe8352abbea0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788833257, "last_seen": 1788833257, "transport": "t", "ja3_hash": "99b464e16aec80d69ec528d8afaa49b0", "ja3_variant_count": 1, "ja3_variants": [ "99b464e16aec80d69ec528d8afaa49b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1504h2_8daaf6152771_40894e57892c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1504h2", "b": "8daaf6152771", "c": "40894e57892c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790415878, "last_seen": 1791245170, "transport": "t", "ja3_hash": "3822e822897b68b2774ac54fbccb1324", "ja3_variant_count": 3, "ja3_variants": [ "3822e822897b68b2774ac54fbccb1324", "9b16098aa59fab415a7ca363c3c16580", "620b7178d69981b655ae48441dffa578" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d1504h2_8daaf6152771_5270fb343167", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1504h2", "b": "8daaf6152771", "c": "5270fb343167", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788777959, "last_seen": 1791279244, "transport": "t", "ja3_hash": "757e25d9e13d08a4fcba4ec6a8cffcf2", "ja3_variant_count": 3, "ja3_variants": [ "757e25d9e13d08a4fcba4ec6a8cffcf2", "f4e736d63269075fb2a230f3520c0d82", "67289aa1306c79320cb3268748654987" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1504h2_8daaf6152771_91f3c070d38b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1504h2", "b": "8daaf6152771", "c": "91f3c070d38b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790281520, "last_seen": 1790281520, "transport": "t", "ja3_hash": "a06cc17b7f2dd0e36be51994d10ac64e", "ja3_variant_count": 1, "ja3_variants": [ "a06cc17b7f2dd0e36be51994d10ac64e" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1504h2_8daaf6152771_a3de4d7beb08", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1504h2", "b": "8daaf6152771", "c": "a3de4d7beb08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790968481, "last_seen": 1791040362, "transport": "t", "ja3_hash": "b6706bf2bc6f7fcd523973175650596c", "ja3_variant_count": 2, "ja3_variants": [ "b6706bf2bc6f7fcd523973175650596c", "dd165899a15dd86c8a4e5e5a29b172ea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_007001663a17", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "007001663a17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-51-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790207897, "last_seen": 1790207897, "transport": "t", "ja3_hash": "38947c1ec76a0c67601dcde96c6165cc", "ja3_variant_count": 1, "ja3_variants": [ "38947c1ec76a0c67601dcde96c6165cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_01b551f0285a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "01b551f0285a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-51764-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790643774, "last_seen": 1790643774, "transport": "t", "ja3_hash": "d6269f2deb83311a1b805a1cd7efda45", "ja3_variant_count": 1, "ja3_variants": [ "d6269f2deb83311a1b805a1cd7efda45" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_05b8361b8cd8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "05b8361b8cd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-13-51-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790192509, "last_seen": 1790192509, "transport": "t", "ja3_hash": "40f4aac36c5f0c9ed587cbca4eefdf5a", "ja3_variant_count": 1, "ja3_variants": [ "40f4aac36c5f0c9ed587cbca4eefdf5a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_0a4f5daca207", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "0a4f5daca207", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789192699, "last_seen": 1789192699, "transport": "t", "ja3_hash": "0f2a4d9dbd16c812f4877b279fa83e3d", "ja3_variant_count": 1, "ja3_variants": [ "0f2a4d9dbd16c812f4877b279fa83e3d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_0d19229a8da4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "0d19229a8da4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-0-13-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790221419, "last_seen": 1790221419, "transport": "t", "ja3_hash": "ce9826d35e70f13187b84147e09bce07", "ja3_variant_count": 1, "ja3_variants": [ "ce9826d35e70f13187b84147e09bce07" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_14b11f3ff465", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "14b11f3ff465", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789054646, "last_seen": 1789054646, "transport": "t", "ja3_hash": "3e689b4ba65a8e0df0ebb877279e6cad", "ja3_variant_count": 1, "ja3_variants": [ "3e689b4ba65a8e0df0ebb877279e6cad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_1bf5e79c9bf2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "1bf5e79c9bf2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-23-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790760783, "last_seen": 1790760783, "transport": "t", "ja3_hash": "ad722c72d0dbced5890a2f4451c69867", "ja3_variant_count": 1, "ja3_variants": [ "ad722c72d0dbced5890a2f4451c69867" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_1c4fc591205b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "1c4fc591205b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-0-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791176886, "last_seen": 1791176886, "transport": "t", "ja3_hash": "78cc4ef268e34abbcd88fe99c45c48ac", "ja3_variant_count": 1, "ja3_variants": [ "78cc4ef268e34abbcd88fe99c45c48ac" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_2723e6fcfe73", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "2723e6fcfe73", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788567602, "last_seen": 1788567602, "transport": "t", "ja3_hash": "b5ee3dbf11a44ed29a0dd4a2dd0e51cb", "ja3_variant_count": 1, "ja3_variants": [ "b5ee3dbf11a44ed29a0dd4a2dd0e51cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_2959dded2a39", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "2959dded2a39", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-35-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790247371, "last_seen": 1790247371, "transport": "t", "ja3_hash": "7e291676dcff52016ee7abfc24a8ef5d", "ja3_variant_count": 1, "ja3_variants": [ "7e291676dcff52016ee7abfc24a8ef5d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_2f4d6073885a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "2f4d6073885a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790236676, "last_seen": 1790236676, "transport": "t", "ja3_hash": "c96e56b6f8578e905c2e6e836383f0fe", "ja3_variant_count": 1, "ja3_variants": [ "c96e56b6f8578e905c2e6e836383f0fe" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_35b6f56c7eb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "35b6f56c7eb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789830198, "last_seen": 1790509506, "transport": "t", "ja3_hash": "d4246604fa65c83014dd528ae4a88c95", "ja3_variant_count": 3, "ja3_variants": [ "d4246604fa65c83014dd528ae4a88c95", "f67a3853c4edb192b23e9a51b8031ae0", "1f4d8c317f9ecdadcf41e1fb5d1f0b68" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_422e79384709", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "422e79384709", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-51-5-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790720692, "last_seen": 1790720692, "transport": "t", "ja3_hash": "45cbb6b40bd64756376cbc508aa31beb", "ja3_variant_count": 1, "ja3_variants": [ "45cbb6b40bd64756376cbc508aa31beb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_49e314b495ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "49e314b495ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-5-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457566, "last_seen": 1789457566, "transport": "t", "ja3_hash": "7e7c5a62cac942be51216f743a2ff71b", "ja3_variant_count": 1, "ja3_variants": [ "7e7c5a62cac942be51216f743a2ff71b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_4b474f64fce1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "4b474f64fce1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790729584, "last_seen": 1790781926, "transport": "t", "ja3_hash": "e8b4f5b583242a06b731934b989e1baf", "ja3_variant_count": 2, "ja3_variants": [ "e8b4f5b583242a06b731934b989e1baf", "771c01e8bef3a59fb90810041c0bb2b4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_577fd7d1a7ef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "577fd7d1a7ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613-65281-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789928045, "last_seen": 1791256249, "transport": "t", "ja3_hash": "d5d88e62ad09f6efb3661036d6378abd", "ja3_variant_count": 2, "ja3_variants": [ "d5d88e62ad09f6efb3661036d6378abd", "58ef74737812cb729b4b1ce6bd22b5af" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.2213.67 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.2745.61 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_5f8d5c2177c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "5f8d5c2177c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-35-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791221845, "last_seen": 1791221845, "transport": "t", "ja3_hash": "e3f7b9703dd44a8cc156829f550862cf", "ja3_variant_count": 1, "ja3_variants": [ "e3f7b9703dd44a8cc156829f550862cf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_65625441a93e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "65625441a93e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-65281-5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791241557, "last_seen": 1791241557, "transport": "t", "ja3_hash": "899d731b4d759a6a2d658f2bc38a1e2c", "ja3_variant_count": 1, "ja3_variants": [ "899d731b4d759a6a2d658f2bc38a1e2c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_7066f31dd90e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "7066f31dd90e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790053083, "last_seen": 1791230284, "transport": "t", "ja3_hash": "0b1b69eafa0dfaa25535025f1ece69d1", "ja3_variant_count": 2, "ja3_variants": [ "0b1b69eafa0dfaa25535025f1ece69d1", "97069977f7279a6a3e21cefc32bb8c6a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_7d93667b39c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "7d93667b39c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-17613-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790538512, "last_seen": 1790538512, "transport": "t", "ja3_hash": "c8a26652a3bc5c6fb4a9de6728271cb1", "ja3_variant_count": 1, "ja3_variants": [ "c8a26652a3bc5c6fb4a9de6728271cb1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_9120ef33c320", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "9120ef33c320", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-65281-0-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789390434, "last_seen": 1789390434, "transport": "t", "ja3_hash": "c31515a9049f8c12a2611c64f5025b00", "ja3_variant_count": 1, "ja3_variants": [ "c31515a9049f8c12a2611c64f5025b00" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_94197eb55619", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "94197eb55619", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-11-51-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790929067, "last_seen": 1790929067, "transport": "t", "ja3_hash": "e412374c91db4c35f5c426616c7f9955", "ja3_variant_count": 1, "ja3_variants": [ "e412374c91db4c35f5c426616c7f9955" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_997359a1bd4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "997359a1bd4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-18-17613-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789702111, "last_seen": 1789702111, "transport": "t", "ja3_hash": "5442487a08e92db2d4d48d163a1c7941", "ja3_variant_count": 1, "ja3_variants": [ "5442487a08e92db2d4d48d163a1c7941" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_9a4d5754f06a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "9a4d5754f06a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-65037-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788990748, "last_seen": 1790553848, "transport": "t", "ja3_hash": "c7c011436d3b89f108e79e67ce99ff1e", "ja3_variant_count": 2, "ja3_variants": [ "c7c011436d3b89f108e79e67ce99ff1e", "0ac8780662ae4ba261c530ac53db4049" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_a5d7afc45084", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "a5d7afc45084", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788582209, "last_seen": 1791120952, "transport": "t", "ja3_hash": "9dcb3fa8929bd767022ec02f0ab2ce99", "ja3_variant_count": 1, "ja3_variants": [ "9dcb3fa8929bd767022ec02f0ab2ce99" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_a8fdd8627eb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "a8fdd8627eb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790203256, "last_seen": 1790203256, "transport": "t", "ja3_hash": "41c202c40cba1e77f23737f46af68410", "ja3_variant_count": 1, "ja3_variants": [ "41c202c40cba1e77f23737f46af68410" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_ac1d0aa0e9e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "ac1d0aa0e9e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789912782, "last_seen": 1789912782, "transport": "t", "ja3_hash": "b586484ffad3ce307942f999fb9c5671", "ja3_variant_count": 1, "ja3_variants": [ "b586484ffad3ce307942f999fb9c5671" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 9 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_b5b2d70ae0d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "b5b2d70ae0d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789460107, "last_seen": 1789460107, "transport": "t", "ja3_hash": "ff23304cf1fc51c6c0097f6c597adca4", "ja3_variant_count": 1, "ja3_variants": [ "ff23304cf1fc51c6c0097f6c597adca4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_ba7e4154582f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "ba7e4154582f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788768984, "last_seen": 1788768984, "transport": "t", "ja3_hash": "cdc0839291fb40c95a2569ade9d3a80e", "ja3_variant_count": 1, "ja3_variants": [ "cdc0839291fb40c95a2569ade9d3a80e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_bec4aabafb7c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "bec4aabafb7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790165326, "last_seen": 1790165326, "transport": "t", "ja3_hash": "77693555b5c5ce228c5bd0ec969de6ec", "ja3_variant_count": 1, "ja3_variants": [ "77693555b5c5ce228c5bd0ec969de6ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_c7e813a58745", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "c7e813a58745", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-27-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790836284, "last_seen": 1790836284, "transport": "t", "ja3_hash": "1cd2c6556f7fc482ae62699425233dc3", "ja3_variant_count": 1, "ja3_variants": [ "1cd2c6556f7fc482ae62699425233dc3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_d46fcfef73cd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "d46fcfef73cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-0-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790435858, "last_seen": 1790435858, "transport": "t", "ja3_hash": "ef8fc2d3d935682dbcae6779bc85716d", "ja3_variant_count": 1, "ja3_variants": [ "ef8fc2d3d935682dbcae6779bc85716d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_d74481ffed0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "d74481ffed0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790959675, "last_seen": 1790959675, "transport": "t", "ja3_hash": "498828ff7cbe921f83e194ebbf5bdd00", "ja3_variant_count": 1, "ja3_variants": [ "498828ff7cbe921f83e194ebbf5bdd00" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_ddb6b85e8b4d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "ddb6b85e8b4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791101362, "last_seen": 1791101362, "transport": "t", "ja3_hash": "de1f8aecb358702721df3cd45f75d22f", "ja3_variant_count": 1, "ja3_variants": [ "de1f8aecb358702721df3cd45f75d22f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_e9554f16cb8b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "e9554f16cb8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-13-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789632510, "last_seen": 1789632510, "transport": "t", "ja3_hash": "0fad0ca15ecdcbc053c540e8a2049298", "ja3_variant_count": 1, "ja3_variants": [ "0fad0ca15ecdcbc053c540e8a2049298" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_e975e2edfedf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "e975e2edfedf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-18-11-17613,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791110299, "last_seen": 1791110299, "transport": "t", "ja3_hash": "82fa10c8fb25692ed2dac86a5656bfeb", "ja3_variant_count": 1, "ja3_variants": [ "82fa10c8fb25692ed2dac86a5656bfeb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_e9a0d0082567", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "e9a0d0082567", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-51-0-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788739260, "last_seen": 1788739260, "transport": "t", "ja3_hash": "05dba648f6a24787a9ec8ece3a788795", "ja3_variant_count": 1, "ja3_variants": [ "05dba648f6a24787a9ec8ece3a788795" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_eb679901f2d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "eb679901f2d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-10-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788799074, "last_seen": 1788799074, "transport": "t", "ja3_hash": "45de6a4258047467ae112635211e49e0", "ja3_variant_count": 1, "ja3_variants": [ "45de6a4258047467ae112635211e49e0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h1_8daaf6152771_0eb513a80caa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h1", "b": "8daaf6152771", "c": "0eb513a80caa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-0-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790561836, "last_seen": 1790561836, "transport": "t", "ja3_hash": "c1f7c968fb1068dea0c90b551fb0d8a3", "ja3_variant_count": 1, "ja3_variants": [ "c1f7c968fb1068dea0c90b551fb0d8a3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h1_8daaf6152771_9b96c9dffd4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h1", "b": "8daaf6152771", "c": "9b96c9dffd4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-51-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790989583, "last_seen": 1790989583, "transport": "t", "ja3_hash": "08e831547e2ad79316a37a85eb4133b4", "ja3_variant_count": 1, "ja3_variants": [ "08e831547e2ad79316a37a85eb4133b4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h1_8daaf6152771_b188ee82f7b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h1", "b": "8daaf6152771", "c": "b188ee82f7b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790648322, "last_seen": 1790648322, "transport": "t", "ja3_hash": "8644bb9d642b44367c0e51866f14d794", "ja3_variant_count": 1, "ja3_variants": [ "8644bb9d642b44367c0e51866f14d794" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_1947a2a29e9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "1947a2a29e9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-0-16-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790241499, "last_seen": 1790708536, "transport": "t", "ja3_hash": "9ba65fd7402c334cfd72000569fb54ca", "ja3_variant_count": 2, "ja3_variants": [ "9ba65fd7402c334cfd72000569fb54ca", "a3ef1760ed8ccb1569321f6466e6ccdc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_1c1cb2907876", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "1c1cb2907876", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-16-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791263939, "last_seen": 1791263939, "transport": "t", "ja3_hash": "fcdd45a6548d842c4f9859c6b3ac4475", "ja3_variant_count": 1, "ja3_variants": [ "fcdd45a6548d842c4f9859c6b3ac4475" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_38867ffa8acc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "38867ffa8acc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-51-16-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790929148, "last_seen": 1790929148, "transport": "t", "ja3_hash": "673d3a8cfaba44755511e0ae0dc7b5cd", "ja3_variant_count": 1, "ja3_variants": [ "673d3a8cfaba44755511e0ae0dc7b5cd" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_3f09f704fcf3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "3f09f704fcf3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788508426, "last_seen": 1788508426, "transport": "t", "ja3_hash": "bef765ee5f616373a3f840c4164d6d54", "ja3_variant_count": 1, "ja3_variants": [ "bef765ee5f616373a3f840c4164d6d54" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_46d0802ea15d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "46d0802ea15d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-0-18-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790228660, "last_seen": 1790228660, "transport": "t", "ja3_hash": "f2a45a445ff17b6e3a3b922cca148ec6", "ja3_variant_count": 1, "ja3_variants": [ "f2a45a445ff17b6e3a3b922cca148ec6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_664313b0eef1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "664313b0eef1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-18-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791008205, "last_seen": 1791008205, "transport": "t", "ja3_hash": "6e468499d83bd64874b1c7ac7aceb543", "ja3_variant_count": 1, "ja3_variants": [ "6e468499d83bd64874b1c7ac7aceb543" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_68bbcabf7144", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "68bbcabf7144", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790035333, "last_seen": 1790180362, "transport": "t", "ja3_hash": "6252fc41d94cf8a78f2bbd0a7824cd79", "ja3_variant_count": 2, "ja3_variants": [ "6252fc41d94cf8a78f2bbd0a7824cd79", "ea5462a421ca0d2dd97d0876ea19ab79" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_88a07e081333", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "88a07e081333", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-0-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790879674, "last_seen": 1790879674, "transport": "t", "ja3_hash": "5c5817605a1d6db7ea59f77da790cb05", "ja3_variant_count": 1, "ja3_variants": [ "5c5817605a1d6db7ea59f77da790cb05" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_9b2569eb22d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "9b2569eb22d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-16-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790539891, "last_seen": 1790539891, "transport": "t", "ja3_hash": "aa126b6bab4b07f573b0cd8b1eae1d9d", "ja3_variant_count": 1, "ja3_variants": [ "aa126b6bab4b07f573b0cd8b1eae1d9d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_b188ee82f7b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "b188ee82f7b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-51-16-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790193888, "last_seen": 1790193888, "transport": "t", "ja3_hash": "06ce0dfc176dd51325c2987cfc46ee1f", "ja3_variant_count": 1, "ja3_variants": [ "06ce0dfc176dd51325c2987cfc46ee1f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_c00f61877593", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "c00f61877593", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-51-45-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791170665, "last_seen": 1791170665, "transport": "t", "ja3_hash": "06cb4b7eed9611ea904858da2d37db26", "ja3_variant_count": 1, "ja3_variants": [ "06cb4b7eed9611ea904858da2d37db26" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_c04ed08e4e34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "c04ed08e4e34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-45-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789479897, "last_seen": 1789479897, "transport": "t", "ja3_hash": "3175317ec9ffcac00ca85ccea360fd99", "ja3_variant_count": 1, "ja3_variants": [ "3175317ec9ffcac00ca85ccea360fd99" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_ccfaee51b21a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "ccfaee51b21a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-16-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723991, "last_seen": 1788723991, "transport": "t", "ja3_hash": "a450d26e628e7b4abb97b06b2b2af1b1", "ja3_variant_count": 1, "ja3_variants": [ "a450d26e628e7b4abb97b06b2b2af1b1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 25 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_d4e7110f08a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "d4e7110f08a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789591776, "last_seen": 1789591776, "transport": "t", "ja3_hash": "1764491cedc065ae351655249b01e441", "ja3_variant_count": 1, "ja3_variants": [ "1764491cedc065ae351655249b01e441" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_024fa6635255", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "024fa6635255", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-13-0-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791015200, "last_seen": 1791015200, "transport": "t", "ja3_hash": "62ada7b786266f675deecabaf5f92cc2", "ja3_variant_count": 1, "ja3_variants": [ "62ada7b786266f675deecabaf5f92cc2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_0d14bc4f6f25", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "0d14bc4f6f25", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-65037-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789811741, "last_seen": 1789811741, "transport": "t", "ja3_hash": "a5ee3b99d5fa719d03cd63246e711f90", "ja3_variant_count": 1, "ja3_variants": [ "a5ee3b99d5fa719d03cd63246e711f90" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 4 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_0d976db533bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "0d976db533bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-45-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790823217, "last_seen": 1790823217, "transport": "t", "ja3_hash": "2e92121f17bd7a6906589be0f2aa903a", "ja3_variant_count": 1, "ja3_variants": [ "2e92121f17bd7a6906589be0f2aa903a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_1004d47f6768", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "1004d47f6768", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-0-5-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790272596, "last_seen": 1790272596, "transport": "t", "ja3_hash": "eae0216412d7a449876f581b7dceba7b", "ja3_variant_count": 1, "ja3_variants": [ "eae0216412d7a449876f581b7dceba7b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_12611357a112", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "12611357a112", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-0-17613-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790252245, "last_seen": 1790252245, "transport": "t", "ja3_hash": "744e330e4f8cb5de2e893bae6b9a9433", "ja3_variant_count": 1, "ja3_variants": [ "744e330e4f8cb5de2e893bae6b9a9433" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_131158e7c874", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "131158e7c874", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-13-51764-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790615561, "last_seen": 1790615561, "transport": "t", "ja3_hash": "633b029b26b638617c5f775166c0a405", "ja3_variant_count": 1, "ja3_variants": [ "633b029b26b638617c5f775166c0a405" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_1d64783a6a85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "1d64783a6a85", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-0-17613-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790232126, "last_seen": 1790232126, "transport": "t", "ja3_hash": "0fb2b24119def5843d13471af85d11a1", "ja3_variant_count": 1, "ja3_variants": [ "0fb2b24119def5843d13471af85d11a1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_23be13b33bcb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "23be13b33bcb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-0-45-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789690376, "last_seen": 1789690376, "transport": "t", "ja3_hash": "6828276b535bc596de1b9a05dff46182", "ja3_variant_count": 1, "ja3_variants": [ "6828276b535bc596de1b9a05dff46182" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_28335c63a606", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "28335c63a606", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65281-35-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790789324, "last_seen": 1790789324, "transport": "t", "ja3_hash": "c64e469220d538f6cbcf5c44d4674ae2", "ja3_variant_count": 1, "ja3_variants": [ "c64e469220d538f6cbcf5c44d4674ae2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_2b60fbb3243e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "2b60fbb3243e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-11-51-13-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790380863, "last_seen": 1790380863, "transport": "t", "ja3_hash": "e9720e5e0111b687de4fce0225a6acd5", "ja3_variant_count": 1, "ja3_variants": [ "e9720e5e0111b687de4fce0225a6acd5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_2b9b8b1a42cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "2b9b8b1a42cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-0-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790227158, "last_seen": 1790227158, "transport": "t", "ja3_hash": "a193e540e88559300695255521edf14c", "ja3_variant_count": 1, "ja3_variants": [ "a193e540e88559300695255521edf14c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_3752a382b945", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "3752a382b945", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-0-35-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790575093, "last_seen": 1790575093, "transport": "t", "ja3_hash": "ec7dc082c6228f1a3792d415c9b9fe85", "ja3_variant_count": 1, "ja3_variants": [ "ec7dc082c6228f1a3792d415c9b9fe85" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_376d32bdcd8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "376d32bdcd8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-18-0-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788796282, "last_seen": 1788796282, "transport": "t", "ja3_hash": "6515ef9da20b9094d6a693cd99ed3ec7", "ja3_variant_count": 1, "ja3_variants": [ "6515ef9da20b9094d6a693cd99ed3ec7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_43945de3600f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "43945de3600f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-18-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789192490, "last_seen": 1789192490, "transport": "t", "ja3_hash": "29347974130f21201ef2b44706044be1", "ja3_variant_count": 1, "ja3_variants": [ "29347974130f21201ef2b44706044be1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 40 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_4417834f9441", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "4417834f9441", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-0-5-10-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790541540, "last_seen": 1790541540, "transport": "t", "ja3_hash": "2b15e196a08e63c6c82d52d534ef4d07", "ja3_variant_count": 1, "ja3_variants": [ "2b15e196a08e63c6c82d52d534ef4d07" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_46bbdc7f7577", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "46bbdc7f7577", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-0-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789675753, "last_seen": 1789675753, "transport": "t", "ja3_hash": "586f0532a1039afbe16995e7fac33d29", "ja3_variant_count": 1, "ja3_variants": [ "586f0532a1039afbe16995e7fac33d29" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_4836e47f79ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "4836e47f79ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-17513-35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788990255, "last_seen": 1788990255, "transport": "t", "ja3_hash": "adea50ceca72ff001ecb8ea0f3370ddf", "ja3_variant_count": 1, "ja3_variants": [ "adea50ceca72ff001ecb8ea0f3370ddf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 8.0.0; SM-J330G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36 EdgA/114.0.1823.74": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_50292b905dab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "50292b905dab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-65281-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790794694, "last_seen": 1790794694, "transport": "t", "ja3_hash": "741acb81acde121440b102df37041637", "ja3_variant_count": 1, "ja3_variants": [ "741acb81acde121440b102df37041637" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_53118166ac2a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "53118166ac2a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-0-35-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789998865, "last_seen": 1789998865, "transport": "t", "ja3_hash": "03bb01de3fe3533cd834595873e972ba", "ja3_variant_count": 1, "ja3_variants": [ "03bb01de3fe3533cd834595873e972ba" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_5d9af4d6fd74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "5d9af4d6fd74", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-0-18-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790977999, "last_seen": 1790977999, "transport": "t", "ja3_hash": "6fd948227b6db902c41429e0629ae586", "ja3_variant_count": 1, "ja3_variants": [ "6fd948227b6db902c41429e0629ae586" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_5dc507bef692", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "5dc507bef692", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-51-5-17613-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552756, "last_seen": 1788552756, "transport": "t", "ja3_hash": "ff2306865ea5d127325ba5b88a9940bb", "ja3_variant_count": 1, "ja3_variants": [ "ff2306865ea5d127325ba5b88a9940bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_633ce7eb0743", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "633ce7eb0743", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-51-0-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790365787, "last_seen": 1790670924, "transport": "t", "ja3_hash": "e11b2465f3486c8284e30df3a8d02f89", "ja3_variant_count": 2, "ja3_variants": [ "e11b2465f3486c8284e30df3a8d02f89", "697c748b2be9a55ae8879fb2c0b9dce6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_67aba61281a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "67aba61281a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-27-0-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791272581, "last_seen": 1791272581, "transport": "t", "ja3_hash": "7c6831f2114bf993ceaf1de4cf9961a2", "ja3_variant_count": 1, "ja3_variants": [ "7c6831f2114bf993ceaf1de4cf9961a2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_700a63e53eaa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "700a63e53eaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-23-13-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788838923, "last_seen": 1788838923, "transport": "t", "ja3_hash": "3d581796eb10f74970b9012f647c1fc2", "ja3_variant_count": 1, "ja3_variants": [ "3d581796eb10f74970b9012f647c1fc2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_705701b9825e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "705701b9825e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-45-0-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790555519, "last_seen": 1790555519, "transport": "t", "ja3_hash": "98a95e8c4851c862da434dad36957165", "ja3_variant_count": 1, "ja3_variants": [ "98a95e8c4851c862da434dad36957165" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_7195a055c943", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "7195a055c943", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-65037-23-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789697949, "last_seen": 1790236337, "transport": "t", "ja3_hash": "6e9dacd9c0a42d971920f76b5eaf06a5", "ja3_variant_count": 2, "ja3_variants": [ "6e9dacd9c0a42d971920f76b5eaf06a5", "9400e9eba7f8430ea49cbce31b395297" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_727cc6ff3ce1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "727cc6ff3ce1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-27-0-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789462092, "last_seen": 1789462092, "transport": "t", "ja3_hash": "88698f3e5c88bdd5ae294e253034f54d", "ja3_variant_count": 1, "ja3_variants": [ "88698f3e5c88bdd5ae294e253034f54d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_747eabef947b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "747eabef947b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-10-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790209082, "last_seen": 1790209082, "transport": "t", "ja3_hash": "6c6b5fb91ec3b3269521b759434f7611", "ja3_variant_count": 1, "ja3_variants": [ "6c6b5fb91ec3b3269521b759434f7611" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_759c230e9f8b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "759c230e9f8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-11-27-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790571806, "last_seen": 1790571806, "transport": "t", "ja3_hash": "a4af6291c94df935361b1c256c6c5c89", "ja3_variant_count": 1, "ja3_variants": [ "a4af6291c94df935361b1c256c6c5c89" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_76d87293ca9d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "76d87293ca9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-0-13-27-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790645870, "last_seen": 1790645870, "transport": "t", "ja3_hash": "0b37f182ee6b44ac8359ca8eea8d5590", "ja3_variant_count": 1, "ja3_variants": [ "0b37f182ee6b44ac8359ca8eea8d5590" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_77296b4d39a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "77296b4d39a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-0-65037-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790983938, "last_seen": 1790983938, "transport": "t", "ja3_hash": "0543d220f7edb2735001b087fcba9370", "ja3_variant_count": 1, "ja3_variants": [ "0543d220f7edb2735001b087fcba9370" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_8d47efcc3b6b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "8d47efcc3b6b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-51-45-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024335, "last_seen": 1789024335, "transport": "t", "ja3_hash": "0fe392f76712ed000578d97840249f7f", "ja3_variant_count": 1, "ja3_variants": [ "0fe392f76712ed000578d97840249f7f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_9195cb421bcb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "9195cb421bcb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-35-11-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789078362, "last_seen": 1789078362, "transport": "t", "ja3_hash": "630ad984c1236b7cbcd94b06353e204a", "ja3_variant_count": 1, "ja3_variants": [ "630ad984c1236b7cbcd94b06353e204a" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_91dd0ebbcbdd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "91dd0ebbcbdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-35-17613-0-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789870121, "last_seen": 1789870121, "transport": "t", "ja3_hash": "56acc9aa784dd12c9426c087c41b83b5", "ja3_variant_count": 1, "ja3_variants": [ "56acc9aa784dd12c9426c087c41b83b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_99b5757eeddc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "99b5757eeddc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-0-65037-11-17513,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791276534, "last_seen": 1791276534, "transport": "t", "ja3_hash": "89eab562615c653a865151d9bb9d9445", "ja3_variant_count": 1, "ja3_variants": [ "89eab562615c653a865151d9bb9d9445" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_9e6c64868ac1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "9e6c64868ac1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-18-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790835316, "last_seen": 1790835316, "transport": "t", "ja3_hash": "df5aeeb5d5784bdbaf61842d960c4922", "ja3_variant_count": 1, "ja3_variants": [ "df5aeeb5d5784bdbaf61842d960c4922" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_a900aa46d07b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "a900aa46d07b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-0-18-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789163318, "last_seen": 1789891739, "transport": "t", "ja3_hash": "25d9051ec4b0e46e198c2beb90f6a40b", "ja3_variant_count": 2, "ja3_variants": [ "25d9051ec4b0e46e198c2beb90f6a40b", "75f5fdfc6b3a1c2aff4d04166fdc3b0d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_a95800acf117", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "a95800acf117", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-17613-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789696450, "last_seen": 1789696450, "transport": "t", "ja3_hash": "0375f3ab06713432eabc8497470c2e7d", "ja3_variant_count": 1, "ja3_variants": [ "0375f3ab06713432eabc8497470c2e7d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_aba244936733", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "aba244936733", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-18-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209816, "last_seen": 1790209816, "transport": "t", "ja3_hash": "3df1d618d006952977a90c99fda9e4d1", "ja3_variant_count": 1, "ja3_variants": [ "3df1d618d006952977a90c99fda9e4d1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_aed181237187", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "aed181237187", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-11-0-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790363145, "last_seen": 1790363145, "transport": "t", "ja3_hash": "aa4a1bbbc2cebf928a0eb3d401c4f23c", "ja3_variant_count": 1, "ja3_variants": [ "aa4a1bbbc2cebf928a0eb3d401c4f23c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.36 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_bbfadccc907e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "bbfadccc907e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-27-18-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790545691, "last_seen": 1790545691, "transport": "t", "ja3_hash": "f9b2f30f847efc76dd95047be64763b4", "ja3_variant_count": 1, "ja3_variants": [ "f9b2f30f847efc76dd95047be64763b4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_c1e96b1d8943", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "c1e96b1d8943", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-35-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791201623, "last_seen": 1791201623, "transport": "t", "ja3_hash": "deb1368dad7fbb08729e491ce6d0d853", "ja3_variant_count": 1, "ja3_variants": [ "deb1368dad7fbb08729e491ce6d0d853" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_c2512aed3a54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "c2512aed3a54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-65281-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790532636, "last_seen": 1790532636, "transport": "t", "ja3_hash": "41f7875a7e194d4362e4b8263c8292a6", "ja3_variant_count": 1, "ja3_variants": [ "41f7875a7e194d4362e4b8263c8292a6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_c73d23d4a162", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "c73d23d4a162", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613-65281-10-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790033878, "last_seen": 1790450744, "transport": "t", "ja3_hash": "b120ef022e010827f1ad080bf059baf2", "ja3_variant_count": 1, "ja3_variants": [ "b120ef022e010827f1ad080bf059baf2" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.2475.23 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.2245.31 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_cfb6e442aef0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "cfb6e442aef0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-10-27-0-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790729351, "last_seen": 1790729351, "transport": "t", "ja3_hash": "9cf50f12742b525c75da46a577d5d6cf", "ja3_variant_count": 1, "ja3_variants": [ "9cf50f12742b525c75da46a577d5d6cf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_d12977060b85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "d12977060b85", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51764-0-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789749416, "last_seen": 1789749416, "transport": "t", "ja3_hash": "5d8660ee76362b948b0139ed588c8a8a", "ja3_variant_count": 1, "ja3_variants": [ "5d8660ee76362b948b0139ed588c8a8a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_d27b5f070ea7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "d27b5f070ea7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-17613-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790561954, "last_seen": 1790561954, "transport": "t", "ja3_hash": "efc15a2a9fe16c2165a7507bf56f7eab", "ja3_variant_count": 1, "ja3_variants": [ "efc15a2a9fe16c2165a7507bf56f7eab" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.1.0 Safari/537.36 Edg/128.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_d395fd9c24ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "d395fd9c24ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-18-65281-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790050287, "last_seen": 1790050287, "transport": "t", "ja3_hash": "3451b7536f77bd2d063eb8d3b1179d69", "ja3_variant_count": 1, "ja3_variants": [ "3451b7536f77bd2d063eb8d3b1179d69" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_d94e351cce84", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "d94e351cce84", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-65281-51-13-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790473292, "last_seen": 1790473292, "transport": "t", "ja3_hash": "3262d68bb96add97e4c19ee76fdd1213", "ja3_variant_count": 1, "ja3_variants": [ "3262d68bb96add97e4c19ee76fdd1213" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_dd2d5343d074", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "dd2d5343d074", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-11-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791206038, "last_seen": 1791206038, "transport": "t", "ja3_hash": "24972950ba442f1bdd2ff628d41c6a72", "ja3_variant_count": 1, "ja3_variants": [ "24972950ba442f1bdd2ff628d41c6a72" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 11 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_e4fb48b5b8d3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "e4fb48b5b8d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-10-17613-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790180401, "last_seen": 1790232991, "transport": "t", "ja3_hash": "35dbb3d2ac06fc6fd7063de8b5422aca", "ja3_variant_count": 2, "ja3_variants": [ "35dbb3d2ac06fc6fd7063de8b5422aca", "41723b29e72dcb33a78b47e6c6a995dd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_e7d3405fbe96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "e7d3405fbe96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-18-45-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791050722, "last_seen": 1791050722, "transport": "t", "ja3_hash": "0fde24e3b89e4d20a3aeb5baf37d5081", "ja3_variant_count": 1, "ja3_variants": [ "0fde24e3b89e4d20a3aeb5baf37d5081" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_eb18c8aeae74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "eb18c8aeae74", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-0-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788659379, "last_seen": 1788659379, "transport": "t", "ja3_hash": "3361ec416f737269143ab8e181f30a49", "ja3_variant_count": 1, "ja3_variants": [ "3361ec416f737269143ab8e181f30a49" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_ec508e4ddd68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "ec508e4ddd68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-0-17613-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788800066, "last_seen": 1788800066, "transport": "t", "ja3_hash": "2087d27dde3dcf324a101d426e48f03a", "ja3_variant_count": 1, "ja3_variants": [ "2087d27dde3dcf324a101d426e48f03a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_ed127436b1ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "ed127436b1ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-0-17513-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791270796, "last_seen": 1791270796, "transport": "t", "ja3_hash": "a0cf557a7346a428ac69a64df0606214", "ja3_variant_count": 1, "ja3_variants": [ "a0cf557a7346a428ac69a64df0606214" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_f542b340dfdf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "f542b340dfdf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-11-51-45-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790271272, "last_seen": 1790271272, "transport": "t", "ja3_hash": "26e080c44eafa37fe9dd2f15e6d2d382", "ja3_variant_count": 1, "ja3_variants": [ "26e080c44eafa37fe9dd2f15e6d2d382" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_f6c445a546ae", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "f6c445a546ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-35-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789696517, "last_seen": 1789696517, "transport": "t", "ja3_hash": "cf1d02ee053c2af414574151c5703fec", "ja3_variant_count": 1, "ja3_variants": [ "cf1d02ee053c2af414574151c5703fec" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_f92ab96bcf32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "f92ab96bcf32", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-17613-0-10-65281,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790728000, "last_seen": 1790728000, "transport": "t", "ja3_hash": "bdae9a10a11e9c0ce98b87ec4ea12d0d", "ja3_variant_count": 1, "ja3_variants": [ "bdae9a10a11e9c0ce98b87ec4ea12d0d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_fca3556a6597", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "fca3556a6597", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-17613-11-27-18,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790510999, "last_seen": 1790510999, "transport": "t", "ja3_hash": "d17230078de21d540bf80aa2fb54ae8f", "ja3_variant_count": 1, "ja3_variants": [ "d17230078de21d540bf80aa2fb54ae8f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_fd7701be1c8a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "fd7701be1c8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-23-45-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791135131, "last_seen": 1791135131, "transport": "t", "ja3_hash": "5d37f07837a2efb58134fe8292844055", "ja3_variant_count": 1, "ja3_variants": [ "5d37f07837a2efb58134fe8292844055" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h1_8daaf6152771_098fa9ca3a03", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h1", "b": "8daaf6152771", "c": "098fa9ca3a03", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-0-51-65281-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790547458, "last_seen": 1790547458, "transport": "t", "ja3_hash": "235453b2ae04debb49fad2dd56541a91", "ja3_variant_count": 1, "ja3_variants": [ "235453b2ae04debb49fad2dd56541a91" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h1_8daaf6152771_876aaf23bf8a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h1", "b": "8daaf6152771", "c": "876aaf23bf8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-16-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790994930, "last_seen": 1790994930, "transport": "t", "ja3_hash": "faa3be86de5f5b782967c9f380b5a549", "ja3_variant_count": 1, "ja3_variants": [ "faa3be86de5f5b782967c9f380b5a549" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_0ae37b1c3827", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "0ae37b1c3827", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-10-51-18-65281,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790876545, "last_seen": 1790876545, "transport": "t", "ja3_hash": "23bb35929b83e0a24ce0515e20a67143", "ja3_variant_count": 1, "ja3_variants": [ "23bb35929b83e0a24ce0515e20a67143" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_17ce3e445b76", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "17ce3e445b76", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-65281-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791279390, "last_seen": 1791279390, "transport": "t", "ja3_hash": "364edfa1ae5791bc935e133e3ba657cd", "ja3_variant_count": 1, "ja3_variants": [ "364edfa1ae5791bc935e133e3ba657cd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_3587192c7715", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "3587192c7715", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-18-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789679731, "last_seen": 1789679731, "transport": "t", "ja3_hash": "91e39face1ca929f3c5e9d2999d57092", "ja3_variant_count": 1, "ja3_variants": [ "91e39face1ca929f3c5e9d2999d57092" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_3e3412553152", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "3e3412553152", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-0-16-18-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789015029, "last_seen": 1790787900, "transport": "t", "ja3_hash": "2c7de40a4d9b44f24f70a77d5a8575f4", "ja3_variant_count": 2, "ja3_variants": [ "2c7de40a4d9b44f24f70a77d5a8575f4", "8f360f4033bf7bb5f3496a7dfdd940a8" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 5 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_5394ac5c7199", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "5394ac5c7199", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-0-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790262349, "last_seen": 1790262349, "transport": "t", "ja3_hash": "b5d28d0b2abc655cbe2d05f3f8aeb501", "ja3_variant_count": 1, "ja3_variants": [ "b5d28d0b2abc655cbe2d05f3f8aeb501" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_6bbb802afe20", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "6bbb802afe20", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-0-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790783781, "last_seen": 1790783781, "transport": "t", "ja3_hash": "800e752bf45cab4d26df8b359732e3ec", "ja3_variant_count": 1, "ja3_variants": [ "800e752bf45cab4d26df8b359732e3ec" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_7ccb724c0e86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "7ccb724c0e86", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-5-0-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077866, "last_seen": 1791077866, "transport": "t", "ja3_hash": "dc9b3a19a3a4c53e0385b2044bd2b209", "ja3_variant_count": 1, "ja3_variants": [ "dc9b3a19a3a4c53e0385b2044bd2b209" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_7d1e362cf368", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "7d1e362cf368", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-5-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789651679, "last_seen": 1789651679, "transport": "t", "ja3_hash": "3be45d555294519c98ef17166a5415ba", "ja3_variant_count": 1, "ja3_variants": [ "3be45d555294519c98ef17166a5415ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_8a5fa5498eb0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "8a5fa5498eb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-0-65037-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791106624, "last_seen": 1791106624, "transport": "t", "ja3_hash": "2418c09821e62d2a6f28aa06da3817e7", "ja3_variant_count": 1, "ja3_variants": [ "2418c09821e62d2a6f28aa06da3817e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_91b2a3b2a47a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "91b2a3b2a47a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-0-16-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790229638, "last_seen": 1790229638, "transport": "t", "ja3_hash": "32e5f9c1fea923bb46a0674ee373894f", "ja3_variant_count": 1, "ja3_variants": [ "32e5f9c1fea923bb46a0674ee373894f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_98d4d49d6198", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "98d4d49d6198", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-10-51-16-11,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790876418, "last_seen": 1791135130, "transport": "t", "ja3_hash": "04fe56c428dc155807cedf6c4703b118", "ja3_variant_count": 2, "ja3_variants": [ "04fe56c428dc155807cedf6c4703b118", "d5f220173519a15dc9d927b837a1d805" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_b8dbba41e166", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "b8dbba41e166", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-0-13-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790206797, "last_seen": 1790206797, "transport": "t", "ja3_hash": "530d9981deef9e5e76dfcdce54555c44", "ja3_variant_count": 1, "ja3_variants": [ "530d9981deef9e5e76dfcdce54555c44" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_c68933beeb92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "c68933beeb92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,16-45-0-17613-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789843144, "last_seen": 1789843144, "transport": "t", "ja3_hash": "f3404f5e8340b80c6e0d1960f439947b", "ja3_variant_count": 1, "ja3_variants": [ "f3404f5e8340b80c6e0d1960f439947b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_ca87df078f5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "ca87df078f5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-0-16-45-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209848, "last_seen": 1790209848, "transport": "t", "ja3_hash": "f0f882a028323d87e7c9e9cf7fa5631a", "ja3_variant_count": 1, "ja3_variants": [ "f0f882a028323d87e7c9e9cf7fa5631a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_f47d2c2324e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "f47d2c2324e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-5-13-0-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790192698, "last_seen": 1790192698, "transport": "t", "ja3_hash": "bf9f97b10a6d74b5f09a2e12aa62c103", "ja3_variant_count": 1, "ja3_variants": [ "bf9f97b10a6d74b5f09a2e12aa62c103" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_fadabebf0399", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "fadabebf0399", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-17613-18-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788770683, "last_seen": 1788770683, "transport": "t", "ja3_hash": "0834d1258bf1b510f21cf35d465b8f23", "ja3_variant_count": 1, "ja3_variants": [ "0834d1258bf1b510f21cf35d465b8f23" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_fb68348d6afa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "fb68348d6afa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-18-0-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790373630, "last_seen": 1790373630, "transport": "t", "ja3_hash": "e87922dc8fdb9bd97c8b412b1e0f6908", "ja3_variant_count": 1, "ja3_variants": [ "e87922dc8fdb9bd97c8b412b1e0f6908" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_03fd44a0a7ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "03fd44a0a7ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-13-23-65281-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791254651, "last_seen": 1791254651, "transport": "t", "ja3_hash": "2f62be6f3e9f50044e07a07b9c08b538", "ja3_variant_count": 1, "ja3_variants": [ "2f62be6f3e9f50044e07a07b9c08b538" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_093e25f1d069", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "093e25f1d069", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-45-65037-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788860434, "last_seen": 1788860434, "transport": "t", "ja3_hash": "2327a888f4cf3c7ba520c975c2a6b93c", "ja3_variant_count": 1, "ja3_variants": [ "2327a888f4cf3c7ba520c975c2a6b93c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_14d1d9209510", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "14d1d9209510", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-65281-35-51-0-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791169154, "last_seen": 1791169154, "transport": "t", "ja3_hash": "0dbfe967ccd79f42061715e3bab9130b", "ja3_variant_count": 1, "ja3_variants": [ "0dbfe967ccd79f42061715e3bab9130b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_1ad7dc2d65c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "1ad7dc2d65c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-35-65281-27-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791072343, "last_seen": 1791072343, "transport": "t", "ja3_hash": "c413d53771adb3524a5b4baf5ed2fc52", "ja3_variant_count": 1, "ja3_variants": [ "c413d53771adb3524a5b4baf5ed2fc52" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_1c87c2d1602a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "1c87c2d1602a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-35-0-51-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790428374, "last_seen": 1790428374, "transport": "t", "ja3_hash": "6c31291e40d26a19b73290fa982dded8", "ja3_variant_count": 1, "ja3_variants": [ "6c31291e40d26a19b73290fa982dded8" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_21a58fe1108f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "21a58fe1108f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-18-35-13-0-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790087035, "last_seen": 1790087035, "transport": "t", "ja3_hash": "fdade459741d1a3d349920bd4cf3c848", "ja3_variant_count": 1, "ja3_variants": [ "fdade459741d1a3d349920bd4cf3c848" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_2575d2625759", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "2575d2625759", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-35-11-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790959671, "last_seen": 1790959671, "transport": "t", "ja3_hash": "ad73581300b9b05209f41229088875bb", "ja3_variant_count": 1, "ja3_variants": [ "ad73581300b9b05209f41229088875bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_260fa694077d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "260fa694077d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-5-0-10-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788899817, "last_seen": 1788899817, "transport": "t", "ja3_hash": "2e199067cec85c54750b35536b6ab30b", "ja3_variant_count": 1, "ja3_variants": [ "2e199067cec85c54750b35536b6ab30b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_2e7a4dd14f7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "2e7a4dd14f7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-27-65037-0-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790526829, "last_seen": 1790526829, "transport": "t", "ja3_hash": "dad8ef520c9f6b3cd5ad13825f368543", "ja3_variant_count": 1, "ja3_variants": [ "dad8ef520c9f6b3cd5ad13825f368543" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_31421bbacb54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "31421bbacb54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-18-0-5-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790540586, "last_seen": 1790540586, "transport": "t", "ja3_hash": "810e29c0bacaf284cbff5d1b2447ecc5", "ja3_variant_count": 1, "ja3_variants": [ "810e29c0bacaf284cbff5d1b2447ecc5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_34271d4b9f54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "34271d4b9f54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-23-45-0-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790730246, "last_seen": 1790730246, "transport": "t", "ja3_hash": "52751b34b7cd35f2ea2983fd46b95ca9", "ja3_variant_count": 1, "ja3_variants": [ "52751b34b7cd35f2ea2983fd46b95ca9" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_36262a6667bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "36262a6667bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-10-17613-51-18-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790240402, "last_seen": 1790240402, "transport": "t", "ja3_hash": "d1bb674ab0304400ca39faf33d58423c", "ja3_variant_count": 1, "ja3_variants": [ "d1bb674ab0304400ca39faf33d58423c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_37d4aa0cacb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "37d4aa0cacb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-51-45-18-23-11,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202827, "last_seen": 1790202827, "transport": "t", "ja3_hash": "ad7c653990e855b680de83745859ee12", "ja3_variant_count": 1, "ja3_variants": [ "ad7c653990e855b680de83745859ee12" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_3c6d38aac917", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "3c6d38aac917", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-0-27-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791302753, "last_seen": 1791302753, "transport": "t", "ja3_hash": "63b9dec2b660ec5c65bfe4f86f7280e1", "ja3_variant_count": 1, "ja3_variants": [ "63b9dec2b660ec5c65bfe4f86f7280e1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 22 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_3ca074dce651", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "3ca074dce651", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-10-65281-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791230878, "last_seen": 1791230878, "transport": "t", "ja3_hash": "3d946477f5b0c8d80383d1eecc23359f", "ja3_variant_count": 1, "ja3_variants": [ "3d946477f5b0c8d80383d1eecc23359f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_3e9928a3d8b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "3e9928a3d8b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-0-10-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790036572, "last_seen": 1790036572, "transport": "t", "ja3_hash": "397d6e9f1e3e5162d25d02a442a4f9de", "ja3_variant_count": 1, "ja3_variants": [ "397d6e9f1e3e5162d25d02a442a4f9de" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_43a60159589f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "43a60159589f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-0-11-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790433305, "last_seen": 1790433305, "transport": "t", "ja3_hash": "a708353fb46a5992c3a9ca9390226d80", "ja3_variant_count": 1, "ja3_variants": [ "a708353fb46a5992c3a9ca9390226d80" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_43e9858415ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "43e9858415ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51764-10-27-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790713379, "last_seen": 1790713379, "transport": "t", "ja3_hash": "18615e3fbacd2cc65eab3ddf7b6bab77", "ja3_variant_count": 1, "ja3_variants": [ "18615e3fbacd2cc65eab3ddf7b6bab77" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_463b40f2ca00", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "463b40f2ca00", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-5-11-65281-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790538736, "last_seen": 1790538736, "transport": "t", "ja3_hash": "c5ce721af758851e0ae98500ecbe98d8", "ja3_variant_count": 1, "ja3_variants": [ "c5ce721af758851e0ae98500ecbe98d8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4680b51460e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4680b51460e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-0-35-17613-11-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788786719, "last_seen": 1788786719, "transport": "t", "ja3_hash": "21511692f7f94d0d46b64aac7a26c09c", "ja3_variant_count": 1, "ja3_variants": [ "21511692f7f94d0d46b64aac7a26c09c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4694f670452b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4694f670452b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-23-10-17613-0-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791094118, "last_seen": 1791094118, "transport": "t", "ja3_hash": "d4b94705eb4d088622fbb884aca0f3ac", "ja3_variant_count": 1, "ja3_variants": [ "d4b94705eb4d088622fbb884aca0f3ac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_49aace187330", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "49aace187330", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-0-65037-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789686914, "last_seen": 1789686914, "transport": "t", "ja3_hash": "5868a88e4bf594d9147f01b2fed62357", "ja3_variant_count": 1, "ja3_variants": [ "5868a88e4bf594d9147f01b2fed62357" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4b100164aca0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4b100164aca0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-0-65281-11-18-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790744202, "last_seen": 1790744202, "transport": "t", "ja3_hash": "7b0c1b8751908541f2034588845ba382", "ja3_variant_count": 1, "ja3_variants": [ "7b0c1b8751908541f2034588845ba382" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4d1d91cea757", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4d1d91cea757", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613-65281-10-27-35,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790370192, "last_seen": 1790802427, "transport": "t", "ja3_hash": "338f6e09a90c18f7108a5b5ba865b13b", "ja3_variant_count": 1, "ja3_variants": [ "338f6e09a90c18f7108a5b5ba865b13b" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3418.123 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.2697.15 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_502d61787738", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "502d61787738", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-23-35-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788961095, "last_seen": 1788961095, "transport": "t", "ja3_hash": "b77021b04cf5b250bd196b0089b3cf13", "ja3_variant_count": 1, "ja3_variants": [ "b77021b04cf5b250bd196b0089b3cf13" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_554d1ebbfc2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "554d1ebbfc2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-17613-35-27-10-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791269965, "last_seen": 1791269965, "transport": "t", "ja3_hash": "59aab205857ebe3959ff1203fef04ce4", "ja3_variant_count": 1, "ja3_variants": [ "59aab205857ebe3959ff1203fef04ce4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_564ef60b0578", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "564ef60b0578", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-0-45-5-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789028202, "last_seen": 1789028202, "transport": "t", "ja3_hash": "6ef12ae1bd6584f14ac4ab4e35ee1a26", "ja3_variant_count": 1, "ja3_variants": [ "6ef12ae1bd6584f14ac4ab4e35ee1a26" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_596a89a2c4a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "596a89a2c4a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-51764-45-27-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789711537, "last_seen": 1789711537, "transport": "t", "ja3_hash": "55278dadc49e6af7f0fab456df564626", "ja3_variant_count": 1, "ja3_variants": [ "55278dadc49e6af7f0fab456df564626" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_5d25a6bf1c15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "5d25a6bf1c15", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-10-0-23-11-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790539660, "last_seen": 1790539660, "transport": "t", "ja3_hash": "8dee48ff131c1dc9f731bfb86946a18f", "ja3_variant_count": 1, "ja3_variants": [ "8dee48ff131c1dc9f731bfb86946a18f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_61b783a2551e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "61b783a2551e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-17613-5-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788932414, "last_seen": 1788932414, "transport": "t", "ja3_hash": "96c1b0fea7d5913c1c064feab28e745e", "ja3_variant_count": 1, "ja3_variants": [ "96c1b0fea7d5913c1c064feab28e745e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_72582d5558dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "72582d5558dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-11-35-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790240537, "last_seen": 1790240537, "transport": "t", "ja3_hash": "f512c2e840bc5617c854a5d51129c1ff", "ja3_variant_count": 1, "ja3_variants": [ "f512c2e840bc5617c854a5d51129c1ff" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_756b94b069b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "756b94b069b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-10-45-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788784610, "last_seen": 1788784610, "transport": "t", "ja3_hash": "478da8c982d2170b9efac950908a311f", "ja3_variant_count": 1, "ja3_variants": [ "478da8c982d2170b9efac950908a311f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_806e1127c62c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "806e1127c62c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-0-5-27-17613-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789131929, "last_seen": 1789131929, "transport": "t", "ja3_hash": "330721dc587bfb6106452142e92db1a7", "ja3_variant_count": 1, "ja3_variants": [ "330721dc587bfb6106452142e92db1a7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_8b60e773ed0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "8b60e773ed0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-10-23-27-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110253, "last_seen": 1791110253, "transport": "t", "ja3_hash": "02088bb295d3eff458b647860338547d", "ja3_variant_count": 1, "ja3_variants": [ "02088bb295d3eff458b647860338547d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_95964e8544f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "95964e8544f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-23-0-27-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790258032, "last_seen": 1790258032, "transport": "t", "ja3_hash": "e4f3f86dcf293983371bfe703ef171e4", "ja3_variant_count": 1, "ja3_variants": [ "e4f3f86dcf293983371bfe703ef171e4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_9f5af1b6fc8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "9f5af1b6fc8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-13-10-0-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788882158, "last_seen": 1788882158, "transport": "t", "ja3_hash": "404a9c15c19debcefc712694aa6748ab", "ja3_variant_count": 1, "ja3_variants": [ "404a9c15c19debcefc712694aa6748ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_a87cb9b3e7e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "a87cb9b3e7e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-35-0-51-65281-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791150191, "last_seen": 1791150191, "transport": "t", "ja3_hash": "de986cba06d8f17ece81f735793738ab", "ja3_variant_count": 1, "ja3_variants": [ "de986cba06d8f17ece81f735793738ab" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_ab6af1c9e879", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "ab6af1c9e879", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-27-65037-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790470782, "last_seen": 1790470782, "transport": "t", "ja3_hash": "8abc9a5b9338c1d3cb00a92090ea687c", "ja3_variant_count": 1, "ja3_variants": [ "8abc9a5b9338c1d3cb00a92090ea687c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_af2808cf11fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "af2808cf11fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-17613-45-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788839895, "last_seen": 1790915132, "transport": "t", "ja3_hash": "915a4eb939676164e830bf366e8a8598", "ja3_variant_count": 2, "ja3_variants": [ "915a4eb939676164e830bf366e8a8598", "d0849de6bf6e5fa8a14b21a0ebad7fca" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 60, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_b15fef1fd057", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "b15fef1fd057", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-45-27-51764-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656400, "last_seen": 1789656400, "transport": "t", "ja3_hash": "0ea2510d38043440452039774ed7812a", "ja3_variant_count": 1, "ja3_variants": [ "0ea2510d38043440452039774ed7812a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_b3ae74ed7d49", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "b3ae74ed7d49", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-0-17613-51764-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790686998, "last_seen": 1790686998, "transport": "t", "ja3_hash": "295b1cdb539bc7ea3548e0d93f0da013", "ja3_variant_count": 1, "ja3_variants": [ "295b1cdb539bc7ea3548e0d93f0da013" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_b56ede2f9183", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "b56ede2f9183", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-65037-35-4832-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790063272, "last_seen": 1790063272, "transport": "t", "ja3_hash": "f62d8ef7e608aacf26a32325ae1582b2", "ja3_variant_count": 1, "ja3_variants": [ "f62d8ef7e608aacf26a32325ae1582b2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_b8cf28bda7f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "b8cf28bda7f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-23-13-5-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790208967, "last_seen": 1790208967, "transport": "t", "ja3_hash": "ba8e3b786ab6d56ba19f0f6712b3bb68", "ja3_variant_count": 1, "ja3_variants": [ "ba8e3b786ab6d56ba19f0f6712b3bb68" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_ba847aecabc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "ba847aecabc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-23-5-45-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077857, "last_seen": 1791077857, "transport": "t", "ja3_hash": "6cde91f6fecf69c29eac733a28d2b27b", "ja3_variant_count": 1, "ja3_variants": [ "6cde91f6fecf69c29eac733a28d2b27b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_bd6bcb70713c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "bd6bcb70713c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-18-10-27-17613-35,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788634784, "last_seen": 1788634784, "transport": "t", "ja3_hash": "d48421a0e38edc8f9f5a5974836f2b26", "ja3_variant_count": 1, "ja3_variants": [ "d48421a0e38edc8f9f5a5974836f2b26" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c116284cb0c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c116284cb0c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-23-17613-11-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791111905, "last_seen": 1791111905, "transport": "t", "ja3_hash": "92c9c8665be867311b479235e4fdc158", "ja3_variant_count": 1, "ja3_variants": [ "92c9c8665be867311b479235e4fdc158" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c330208a4152", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c330208a4152", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-10-27-65037-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457562, "last_seen": 1789457562, "transport": "t", "ja3_hash": "47a74b02e799641e8c468d31e97993b7", "ja3_variant_count": 1, "ja3_variants": [ "47a74b02e799641e8c468d31e97993b7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c5a699d23716", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c5a699d23716", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-45-0-11-13-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790433813, "last_seen": 1790433813, "transport": "t", "ja3_hash": "223d9612f4b902110ec666712668d3ad", "ja3_variant_count": 1, "ja3_variants": [ "223d9612f4b902110ec666712668d3ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c5f41a72b514", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c5f41a72b514", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-45-5-18-51-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790650651, "last_seen": 1790650651, "transport": "t", "ja3_hash": "9a9aea74df4b65f834ed4796e6329fe4", "ja3_variant_count": 1, "ja3_variants": [ "9a9aea74df4b65f834ed4796e6329fe4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c704c55a63fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c704c55a63fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-0-35-65281-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790166994, "last_seen": 1790166994, "transport": "t", "ja3_hash": "bc46b040b582b52139dbb25486f86d47", "ja3_variant_count": 1, "ja3_variants": [ "bc46b040b582b52139dbb25486f86d47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_cc884e4155a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "cc884e4155a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-10-23-45-35-65281,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790224728, "last_seen": 1790224728, "transport": "t", "ja3_hash": "2bd53dbaf025acfff878b0f9db4c2047", "ja3_variant_count": 1, "ja3_variants": [ "2bd53dbaf025acfff878b0f9db4c2047" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d1e038da55b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d1e038da55b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-45-0-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789747128, "last_seen": 1789747128, "transport": "t", "ja3_hash": "d4bde206f575d544e8233f30ae3e1be9", "ja3_variant_count": 1, "ja3_variants": [ "d4bde206f575d544e8233f30ae3e1be9" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/153.0.8010.24 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d2e9457c634f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d2e9457c634f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-0-11-5-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791032233, "last_seen": 1791032233, "transport": "t", "ja3_hash": "eae72df705a9569c3fa1b2fb8c521395", "ja3_variant_count": 1, "ja3_variants": [ "eae72df705a9569c3fa1b2fb8c521395" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d4a721918ff5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d4a721918ff5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51-17513-13-0-18-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790942442, "last_seen": 1790942442, "transport": "t", "ja3_hash": "d2ae0013263c942b38a46e43c08d6e6e", "ja3_variant_count": 1, "ja3_variants": [ "d2ae0013263c942b38a46e43c08d6e6e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e13542d9dc06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e13542d9dc06", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-51-27-17613-0-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789048596, "last_seen": 1789048596, "transport": "t", "ja3_hash": "f3c3c1aa40ebb010fc01b29a4388382a", "ja3_variant_count": 1, "ja3_variants": [ "f3c3c1aa40ebb010fc01b29a4388382a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 8 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e563932f5797", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e563932f5797", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-18-17613-27-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789694810, "last_seen": 1789694810, "transport": "t", "ja3_hash": "331b5c461429e36f4144b36d34475e9e", "ja3_variant_count": 1, "ja3_variants": [ "331b5c461429e36f4144b36d34475e9e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e8707c638f34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e8707c638f34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-0-11-51-18-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788745814, "last_seen": 1790212304, "transport": "t", "ja3_hash": "a18fe54babf180e6a25bd06ed3d010c5", "ja3_variant_count": 2, "ja3_variants": [ "a18fe54babf180e6a25bd06ed3d010c5", "c2e19fed91d63cd18083f5593ac1218f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e8eb4d10413c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e8eb4d10413c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-65281-51-11-45-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791175125, "last_seen": 1791175125, "transport": "t", "ja3_hash": "de47a18092f1a084bdf450804c02eb37", "ja3_variant_count": 1, "ja3_variants": [ "de47a18092f1a084bdf450804c02eb37" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_ea1c4b16555e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "ea1c4b16555e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-5-0-13-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790997347, "last_seen": 1790997347, "transport": "t", "ja3_hash": "7b7231421733423b3f58c80a20c2edc7", "ja3_variant_count": 1, "ja3_variants": [ "7b7231421733423b3f58c80a20c2edc7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_ec328da8d33a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "ec328da8d33a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-10-18-23-17613-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790243625, "last_seen": 1790243625, "transport": "t", "ja3_hash": "d33e91c23ab84ea525e74a84150b2ed6", "ja3_variant_count": 1, "ja3_variants": [ "d33e91c23ab84ea525e74a84150b2ed6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_f1094dff5af0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "f1094dff5af0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-13-0-27-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790654600, "last_seen": 1790654600, "transport": "t", "ja3_hash": "a29b94b20ddad1905501d5cca00e4b1e", "ja3_variant_count": 1, "ja3_variants": [ "a29b94b20ddad1905501d5cca00e4b1e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 6 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_f3cd1db5c541", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "f3cd1db5c541", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-18-0-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790615342, "last_seen": 1790615342, "transport": "t", "ja3_hash": "c6cc3c8560a00019c96187c2ff454884", "ja3_variant_count": 1, "ja3_variants": [ "c6cc3c8560a00019c96187c2ff454884" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_f6e3689e1b9b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "f6e3689e1b9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-13-65037-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790241419, "last_seen": 1790241419, "transport": "t", "ja3_hash": "ead943fab78016ab021aa66464b9df95", "ja3_variant_count": 1, "ja3_variants": [ "ead943fab78016ab021aa66464b9df95" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_f983c1361f15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "f983c1361f15", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-10-45-65037-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791091034, "last_seen": 1791091034, "transport": "t", "ja3_hash": "d171eaad5654497bb343792c5aa7ab1b", "ja3_variant_count": 1, "ja3_variants": [ "d171eaad5654497bb343792c5aa7ab1b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_fa036ecbfa13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "fa036ecbfa13", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-65037-35-0-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790241007, "last_seen": 1790241007, "transport": "t", "ja3_hash": "43615eca95c8b8ff5cc8d771aebf0953", "ja3_variant_count": 1, "ja3_variants": [ "43615eca95c8b8ff5cc8d771aebf0953" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h1_8daaf6152771_7e74fe43ae60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h1", "b": "8daaf6152771", "c": "7e74fe43ae60", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-0-10-13-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791200431, "last_seen": 1791200431, "transport": "t", "ja3_hash": "d47c934c4ddfa64546383a4add51e1c7", "ja3_variant_count": 1, "ja3_variants": [ "d47c934c4ddfa64546383a4add51e1c7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h1_8daaf6152771_f55e6fd5b343", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h1", "b": "8daaf6152771", "c": "f55e6fd5b343", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-5-45-51-0-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790526160, "last_seen": 1790526160, "transport": "t", "ja3_hash": "70b7af7832ce6191fa23b38c805e0903", "ja3_variant_count": 1, "ja3_variants": [ "70b7af7832ce6191fa23b38c805e0903" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_115d5d4d0596", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "115d5d4d0596", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-16-5-23-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789647905, "last_seen": 1789647905, "transport": "t", "ja3_hash": "839d98a6397e48fe7677d885008dbd2c", "ja3_variant_count": 1, "ja3_variants": [ "839d98a6397e48fe7677d885008dbd2c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 90 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_125b5db86202", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "125b5db86202", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-16-23-51-10-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790697104, "last_seen": 1790697104, "transport": "t", "ja3_hash": "9b4170cd01a69530932a0079a3ab5456", "ja3_variant_count": 1, "ja3_variants": [ "9b4170cd01a69530932a0079a3ab5456" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 61 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_1298b609779b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "1298b609779b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65037-0-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024339, "last_seen": 1789024339, "transport": "t", "ja3_hash": "ccdfe6823c99dcdfe5f7d32972d8c3e2", "ja3_variant_count": 1, "ja3_variants": [ "ccdfe6823c99dcdfe5f7d32972d8c3e2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_130693274701", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "130693274701", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-16-0-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776178, "last_seen": 1789776178, "transport": "t", "ja3_hash": "3c069d1f3dbb9a2f478e544fbd2f861f", "ja3_variant_count": 1, "ja3_variants": [ "3c069d1f3dbb9a2f478e544fbd2f861f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 33 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_1dca2383d6a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "1dca2383d6a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-13-0-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789746716, "last_seen": 1789746716, "transport": "t", "ja3_hash": "bca7b20391f889649a643139d98ad297", "ja3_variant_count": 1, "ja3_variants": [ "bca7b20391f889649a643139d98ad297" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_1ed02fa9d6a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "1ed02fa9d6a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-18-35-23-0-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790213607, "last_seen": 1790213607, "transport": "t", "ja3_hash": "b0a7dc9a1e9d86d13d3b4e4bebd61395", "ja3_variant_count": 1, "ja3_variants": [ "b0a7dc9a1e9d86d13d3b4e4bebd61395" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_2ecc24af6944", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "2ecc24af6944", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-0-65281-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790207876, "last_seen": 1790207876, "transport": "t", "ja3_hash": "6f9dbb831fef52e6f1490dc647e851e1", "ja3_variant_count": 1, "ja3_variants": [ "6f9dbb831fef52e6f1490dc647e851e1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_35cddba6e7d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "35cddba6e7d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-16-11-10-35-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790668680, "last_seen": 1790668680, "transport": "t", "ja3_hash": "bde636390146debcdab66be3abed1a04", "ja3_variant_count": 1, "ja3_variants": [ "bde636390146debcdab66be3abed1a04" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_38ad60c601f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "38ad60c601f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-65281-0-27-16-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791144639, "last_seen": 1791144639, "transport": "t", "ja3_hash": "9143f9c3c5303edb34fb72f3a2d04691", "ja3_variant_count": 1, "ja3_variants": [ "9143f9c3c5303edb34fb72f3a2d04691" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_3f958b09e6c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "3f958b09e6c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-0-5-65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790729443, "last_seen": 1790729443, "transport": "t", "ja3_hash": "6163d7db66971f73d8dd49a7f861d10e", "ja3_variant_count": 1, "ja3_variants": [ "6163d7db66971f73d8dd49a7f861d10e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_4c6668cd1174", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "4c6668cd1174", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-51764-23-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789737282, "last_seen": 1789737282, "transport": "t", "ja3_hash": "ccbd6c9decd8d561220bbeede877484a", "ja3_variant_count": 1, "ja3_variants": [ "ccbd6c9decd8d561220bbeede877484a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_5d062003f518", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "5d062003f518", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-17613-16-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790588091, "last_seen": 1790588091, "transport": "t", "ja3_hash": "c700be17255d64f996a3eea75663d7e3", "ja3_variant_count": 1, "ja3_variants": [ "c700be17255d64f996a3eea75663d7e3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 13 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_5deea1d9b0b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "5deea1d9b0b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-45-17613-0-23-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788979955, "last_seen": 1789516972, "transport": "t", "ja3_hash": "db7ff95d7beb81bbcc44eee9cf746bb6", "ja3_variant_count": 2, "ja3_variants": [ "db7ff95d7beb81bbcc44eee9cf746bb6", "a18796f9b0c25f8f7cb554593633841d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 15 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_5fda1207da30", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "5fda1207da30", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-0-45-16-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790738524, "last_seen": 1790738524, "transport": "t", "ja3_hash": "406831d42f8a7a9bf5e2c240cce093e4", "ja3_variant_count": 1, "ja3_variants": [ "406831d42f8a7a9bf5e2c240cce093e4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_736e2dd1c234", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "736e2dd1c234", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-17613-35-16-45-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788460002, "last_seen": 1788460002, "transport": "t", "ja3_hash": "1a896bc34249e4709a9edb361a9dd396", "ja3_variant_count": 1, "ja3_variants": [ "1a896bc34249e4709a9edb361a9dd396" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_747673b6b315", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "747673b6b315", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-5-18-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789902631, "last_seen": 1789902631, "transport": "t", "ja3_hash": "2a43cbbc8cfad4c3b677ed17f0da2b15", "ja3_variant_count": 1, "ja3_variants": [ "2a43cbbc8cfad4c3b677ed17f0da2b15" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_8ac39a44b638", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "8ac39a44b638", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-27-51-5-11-18,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790333604, "last_seen": 1790333605, "transport": "t", "ja3_hash": "89baa2393f09fd31759efb221770ceaf", "ja3_variant_count": 1, "ja3_variants": [ "89baa2393f09fd31759efb221770ceaf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_9e6f74212d64", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "9e6f74212d64", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-11-16-45-65281-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789684460, "last_seen": 1789684460, "transport": "t", "ja3_hash": "8b2f156a10ffba310a544f9a6158e839", "ja3_variant_count": 1, "ja3_variants": [ "8b2f156a10ffba310a544f9a6158e839" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_9ec465a7d568", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "9ec465a7d568", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-65281-23-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789092651, "last_seen": 1789092651, "transport": "t", "ja3_hash": "349f80e7954d7ece430d272f66781bf6", "ja3_variant_count": 1, "ja3_variants": [ "349f80e7954d7ece430d272f66781bf6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_a2681623a6b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "a2681623a6b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-0-35-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790368784, "last_seen": 1790368784, "transport": "t", "ja3_hash": "7b5b10cd4a3eeaf9b57c44a522a23361", "ja3_variant_count": 1, "ja3_variants": [ "7b5b10cd4a3eeaf9b57c44a522a23361" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_bb09cd15c32f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "bb09cd15c32f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-10-17613-27-0-23,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791029371, "last_seen": 1791029371, "transport": "t", "ja3_hash": "c6eeaffcb556e64d2f06630d70dd22e0", "ja3_variant_count": 1, "ja3_variants": [ "c6eeaffcb556e64d2f06630d70dd22e0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 56 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_be338bdd623b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "be338bdd623b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-0-5-35-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790241349, "last_seen": 1790241349, "transport": "t", "ja3_hash": "496b826b55bd5f5d731b1a7ea4cd07bf", "ja3_variant_count": 1, "ja3_variants": [ "496b826b55bd5f5d731b1a7ea4cd07bf" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_e3c017f41192", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "e3c017f41192", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-16-0-17613-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790258819, "last_seen": 1790258819, "transport": "t", "ja3_hash": "8a8bb52963791ff08f372ef673ef335e", "ja3_variant_count": 1, "ja3_variants": [ "8a8bb52963791ff08f372ef673ef335e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_e8afc78fbf38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "e8afc78fbf38", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-0-23-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789100223, "last_seen": 1789100223, "transport": "t", "ja3_hash": "1c5211b7119ff0b1aaf0603c41e7c30a", "ja3_variant_count": 1, "ja3_variants": [ "1c5211b7119ff0b1aaf0603c41e7c30a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_eb2f2971525c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "eb2f2971525c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-11-16-23-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791164903, "last_seen": 1791164903, "transport": "t", "ja3_hash": "ecc901350f5a70029568a60b02cdf4e3", "ja3_variant_count": 1, "ja3_variants": [ "ecc901350f5a70029568a60b02cdf4e3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_f16344df59c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "f16344df59c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-65281-51-18-27-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791080384, "last_seen": 1791080384, "transport": "t", "ja3_hash": "91dc315001d96614f9e90c68ccc1e395", "ja3_variant_count": 1, "ja3_variants": [ "91dc315001d96614f9e90c68ccc1e395" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_00309e18d362", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "00309e18d362", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-27-17613-10-65281-51-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724242, "last_seen": 1788724242, "transport": "t", "ja3_hash": "c790421a16bca5d34dc87285488d5dbf", "ja3_variant_count": 1, "ja3_variants": [ "c790421a16bca5d34dc87285488d5dbf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_00ab26af1d98", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "00ab26af1d98", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-23-35-65037-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790432556, "last_seen": 1790432556, "transport": "t", "ja3_hash": "00fe19aa465f6eb1f4a8b6cde3eb05a4", "ja3_variant_count": 1, "ja3_variants": [ "00fe19aa465f6eb1f4a8b6cde3eb05a4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_011a5f1af56b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "011a5f1af56b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-51-65281-35-10-0-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790996935, "last_seen": 1790996935, "transport": "t", "ja3_hash": "fdafceb7bc2a68373fe3ebfe72df359c", "ja3_variant_count": 1, "ja3_variants": [ "fdafceb7bc2a68373fe3ebfe72df359c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_07b25f7e5887", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "07b25f7e5887", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-65281-11-0-51-45-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790191585, "last_seen": 1791182854, "transport": "t", "ja3_hash": "e01ca692f4f1676a6c6db330eb62db47", "ja3_variant_count": 2, "ja3_variants": [ "e01ca692f4f1676a6c6db330eb62db47", "fd25be2ec13b2c4df6e5c99da14419d3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_0903fe4c75b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "0903fe4c75b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-65037-45-17613-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790035332, "last_seen": 1790035332, "transport": "t", "ja3_hash": "fbd3cd62e6a93bee528b597fc30ad159", "ja3_variant_count": 1, "ja3_variants": [ "fbd3cd62e6a93bee528b597fc30ad159" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_09e44cf12005", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "09e44cf12005", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-17613-35-65281-23-51-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790736639, "last_seen": 1790736639, "transport": "t", "ja3_hash": "7fd4027906bb21ff9d2e4021965a8037", "ja3_variant_count": 1, "ja3_variants": [ "7fd4027906bb21ff9d2e4021965a8037" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_0b21a40b059d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "0b21a40b059d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-11-35-65037-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789008559, "last_seen": 1789008559, "transport": "t", "ja3_hash": "31f658cfc2bf758d24e4c3cc774a2bb4", "ja3_variant_count": 1, "ja3_variants": [ "31f658cfc2bf758d24e4c3cc774a2bb4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_0d080a75ee99", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "0d080a75ee99", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-23-65281-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790792085, "last_seen": 1790792085, "transport": "t", "ja3_hash": "ee07b4126bdbdeb1d75f9dedc9991e16", "ja3_variant_count": 1, "ja3_variants": [ "ee07b4126bdbdeb1d75f9dedc9991e16" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_19141369d0fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "19141369d0fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-0-18-11-27-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788812124, "last_seen": 1788812124, "transport": "t", "ja3_hash": "b09b05f07f584913c86c69cbac090c07", "ja3_variant_count": 1, "ja3_variants": [ "b09b05f07f584913c86c69cbac090c07" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_214457f16040", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "214457f16040", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-5-45-0-23-18-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789735707, "last_seen": 1789735707, "transport": "t", "ja3_hash": "e4d68ecec0c91a182d94c8ca7982feea", "ja3_variant_count": 1, "ja3_variants": [ "e4d68ecec0c91a182d94c8ca7982feea" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_28bb07481da1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "28bb07481da1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-5-65281-65037-10-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790538833, "last_seen": 1790538833, "transport": "t", "ja3_hash": "fd012d46a4d30dfff470e1bafb4a56af", "ja3_variant_count": 1, "ja3_variants": [ "fd012d46a4d30dfff470e1bafb4a56af" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_293bdad97863", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "293bdad97863", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-17613-0-65281-11-18-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788556597, "last_seen": 1788556597, "transport": "t", "ja3_hash": "1a7163a380619e4952d510003bfd8ac6", "ja3_variant_count": 1, "ja3_variants": [ "1a7163a380619e4952d510003bfd8ac6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_2991832e5d52", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "2991832e5d52", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-45-35-5-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790542212, "last_seen": 1790542212, "transport": "t", "ja3_hash": "9444a20053660f99bcc2231198e64746", "ja3_variant_count": 1, "ja3_variants": [ "9444a20053660f99bcc2231198e64746" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_376ec5471d2e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "376ec5471d2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-65281-10-5-51764-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790090773, "last_seen": 1790090773, "transport": "t", "ja3_hash": "a3152a0e51e284a7007ce66e1c0f20d3", "ja3_variant_count": 1, "ja3_variants": [ "a3152a0e51e284a7007ce66e1c0f20d3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_3bd478d9f4be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "3bd478d9f4be", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-51764-0-11-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790083865, "last_seen": 1790083865, "transport": "t", "ja3_hash": "4fec6fea2c76ce15666e7d0604aaa4f8", "ja3_variant_count": 1, "ja3_variants": [ "4fec6fea2c76ce15666e7d0604aaa4f8" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_3efa16f017e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "3efa16f017e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-13-10-5-27-17513-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791106737, "last_seen": 1791106737, "transport": "t", "ja3_hash": "3fcff77028a9365deaa8f03a04715f2b", "ja3_variant_count": 1, "ja3_variants": [ "3fcff77028a9365deaa8f03a04715f2b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_40c420be7914", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "40c420be7914", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-0-65281-45-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790569102, "last_seen": 1790569102, "transport": "t", "ja3_hash": "802954276cc98dbb13e01b26a0ec4e62", "ja3_variant_count": 1, "ja3_variants": [ "802954276cc98dbb13e01b26a0ec4e62" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_4b8f4a2f1bf6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "4b8f4a2f1bf6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-65037-13-11-0-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788845613, "last_seen": 1788845613, "transport": "t", "ja3_hash": "48b140c3afd9a9c0f51c55a113f9ce52", "ja3_variant_count": 1, "ja3_variants": [ "48b140c3afd9a9c0f51c55a113f9ce52" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_4d62064720ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "4d62064720ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-5-65037-0-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788851064, "last_seen": 1788851064, "transport": "t", "ja3_hash": "3f0fb1268a21e2ce36aa3ee36debb7a1", "ja3_variant_count": 1, "ja3_variants": [ "3f0fb1268a21e2ce36aa3ee36debb7a1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 YaBrowser/26.6.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_54b56c58a487", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "54b56c58a487", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-0-18-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788781893, "last_seen": 1788781893, "transport": "t", "ja3_hash": "c9732ee0b3e5f456d304d228e975541a", "ja3_variant_count": 1, "ja3_variants": [ "c9732ee0b3e5f456d304d228e975541a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_56693c728c0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "56693c728c0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-10-13-0-5-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791304072, "last_seen": 1791304072, "transport": "t", "ja3_hash": "8fac1dc1e3533cc2801b7a29ad84564a", "ja3_variant_count": 1, "ja3_variants": [ "8fac1dc1e3533cc2801b7a29ad84564a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_5ad293fdd18d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "5ad293fdd18d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-0-65037-13-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789576910, "last_seen": 1789576910, "transport": "t", "ja3_hash": "502a32a5c4a65cecf7aa0fa1205a1dce", "ja3_variant_count": 1, "ja3_variants": [ "502a32a5c4a65cecf7aa0fa1205a1dce" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_5c9f8830e355", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "5c9f8830e355", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-23-0-27-18-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788801880, "last_seen": 1788801880, "transport": "t", "ja3_hash": "61d8f171b0cc84b153de24b6b66fbd5f", "ja3_variant_count": 1, "ja3_variants": [ "61d8f171b0cc84b153de24b6b66fbd5f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_6028de011c80", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "6028de011c80", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-65037-65281-35-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790226373, "last_seen": 1790226373, "transport": "t", "ja3_hash": "046f198f2696782b29a0988909da30b0", "ja3_variant_count": 1, "ja3_variants": [ "046f198f2696782b29a0988909da30b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_621e4f03c30a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "621e4f03c30a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-65037-5-17613-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791001756, "last_seen": 1791001756, "transport": "t", "ja3_hash": "3dab0a58d7751db47f19354b5e63a6fb", "ja3_variant_count": 1, "ja3_variants": [ "3dab0a58d7751db47f19354b5e63a6fb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_66c8785d58ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "66c8785d58ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-23-65281-13-0-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790727985, "last_seen": 1790727985, "transport": "t", "ja3_hash": "0995ab4f529909953f46a1627e720984", "ja3_variant_count": 1, "ja3_variants": [ "0995ab4f529909953f46a1627e720984" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_6a463749cdd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "6a463749cdd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-18-10-0-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790644953, "last_seen": 1790644953, "transport": "t", "ja3_hash": "53eb5b8aefcdf3422168eac9b4394af9", "ja3_variant_count": 1, "ja3_variants": [ "53eb5b8aefcdf3422168eac9b4394af9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_6d87a7ad7849", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "6d87a7ad7849", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-13-27-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790242045, "last_seen": 1790242045, "transport": "t", "ja3_hash": "a6df11f299397e6c6cadca80285a9481", "ja3_variant_count": 1, "ja3_variants": [ "a6df11f299397e6c6cadca80285a9481" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_722e10d9e6a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "722e10d9e6a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-11-13-0-51-17613-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790229181, "last_seen": 1790229181, "transport": "t", "ja3_hash": "ad7e082f0dacd6b40d2d4e60efedd826", "ja3_variant_count": 1, "ja3_variants": [ "ad7e082f0dacd6b40d2d4e60efedd826" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_7d6466bb9a86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "7d6466bb9a86", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-17613-65281-11-27-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789798021, "last_seen": 1789798021, "transport": "t", "ja3_hash": "65d722b1290f5b454544b65957ed024f", "ja3_variant_count": 1, "ja3_variants": [ "65d722b1290f5b454544b65957ed024f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_80505650bd57", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "80505650bd57", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-65281-27-5-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791225852, "last_seen": 1791225852, "transport": "t", "ja3_hash": "2171fa44560d4c37fc576bd1ffdc7b93", "ja3_variant_count": 1, "ja3_variants": [ "2171fa44560d4c37fc576bd1ffdc7b93" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_8107f0247460", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "8107f0247460", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-10-17613-5-18-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791007897, "last_seen": 1791007897, "transport": "t", "ja3_hash": "dff9ba42623e2b04b3f30d7244a356df", "ja3_variant_count": 1, "ja3_variants": [ "dff9ba42623e2b04b3f30d7244a356df" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_851c60ffc66d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "851c60ffc66d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-0-17613-65037-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788764749, "last_seen": 1788764749, "transport": "t", "ja3_hash": "5bcb1670fdbb8dbe4f950b90889486e5", "ja3_variant_count": 1, "ja3_variants": [ "5bcb1670fdbb8dbe4f950b90889486e5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_8851bd83a0d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "8851bd83a0d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-5-45-65281-35-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790643201, "last_seen": 1790643201, "transport": "t", "ja3_hash": "639278a9855340fb4697a91f31280760", "ja3_variant_count": 1, "ja3_variants": [ "639278a9855340fb4697a91f31280760" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_960c71b01bcd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "960c71b01bcd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-65037-5-13-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790718710, "last_seen": 1790718710, "transport": "t", "ja3_hash": "9a54de9a3b05cbbf4711ab18c00baadd", "ja3_variant_count": 1, "ja3_variants": [ "9a54de9a3b05cbbf4711ab18c00baadd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_9fd9771d76b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "9fd9771d76b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-11-0-65037-23-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790236733, "last_seen": 1790236733, "transport": "t", "ja3_hash": "bf5844e8f9be8ad1bc67e9019f50608b", "ja3_variant_count": 1, "ja3_variants": [ "bf5844e8f9be8ad1bc67e9019f50608b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a505fe1c753d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a505fe1c753d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-0-51-27-10-35-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788959686, "last_seen": 1788959686, "transport": "t", "ja3_hash": "9e636039482269c983cba5b1300b9cd0", "ja3_variant_count": 1, "ja3_variants": [ "9e636039482269c983cba5b1300b9cd0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a58a1a2ca2f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a58a1a2ca2f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65281-27-65037-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790642885, "last_seen": 1790642885, "transport": "t", "ja3_hash": "d2e9e7cd2750c7454993f36b9a618ead", "ja3_variant_count": 1, "ja3_variants": [ "d2e9e7cd2750c7454993f36b9a618ead" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a639675138d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a639675138d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-5-23-11-65037-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789889711, "last_seen": 1790534964, "transport": "t", "ja3_hash": "41b5426e9d6fa354e354fa4b06d1f721", "ja3_variant_count": 2, "ja3_variants": [ "41b5426e9d6fa354e354fa4b06d1f721", "b29f25c1b122d20a66a1e46794061178" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a859c0f58553", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a859c0f58553", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-23-45-65281-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789576534, "last_seen": 1789576534, "transport": "t", "ja3_hash": "a4ea0c8d8b350d5b780c0d7c22d31668", "ja3_variant_count": 1, "ja3_variants": [ "a4ea0c8d8b350d5b780c0d7c22d31668" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a9f1645d3720", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a9f1645d3720", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-23-65037-18-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791226581, "last_seen": 1791226581, "transport": "t", "ja3_hash": "8960e8276c75a0ef70be16c8ae4ae119", "ja3_variant_count": 1, "ja3_variants": [ "8960e8276c75a0ef70be16c8ae4ae119" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 88 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_abc7c8c14f19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "abc7c8c14f19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-45-65281-27-13-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790229706, "last_seen": 1790229706, "transport": "t", "ja3_hash": "6d47a184b5a58bcce5a803f598970fa1", "ja3_variant_count": 1, "ja3_variants": [ "6d47a184b5a58bcce5a803f598970fa1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_bae352daf290", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "bae352daf290", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-10-11-51764-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790454166, "last_seen": 1790454166, "transport": "t", "ja3_hash": "6b35dc31464441df16479c3f3e8734b4", "ja3_variant_count": 1, "ja3_variants": [ "6b35dc31464441df16479c3f3e8734b4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_ce0d27a7be42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "ce0d27a7be42", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-11-23-51-5-18-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790876459, "last_seen": 1790876459, "transport": "t", "ja3_hash": "e0868c47f8368a86fa424fccbd2cc68d", "ja3_variant_count": 1, "ja3_variants": [ "e0868c47f8368a86fa424fccbd2cc68d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_d58cb5d1b22c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "d58cb5d1b22c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-17613-11-0-5-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791229711, "last_seen": 1791229711, "transport": "t", "ja3_hash": "2eb2d3fdebc21acd792c39c250578c77", "ja3_variant_count": 1, "ja3_variants": [ "2eb2d3fdebc21acd792c39c250578c77" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_d81fe1a9ef8c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "d81fe1a9ef8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-27-18-5-45-17613-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110302, "last_seen": 1791110302, "transport": "t", "ja3_hash": "8a9adc6259f69f21615c6390c3fbb267", "ja3_variant_count": 1, "ja3_variants": [ "8a9adc6259f69f21615c6390c3fbb267" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_ebc3bacebd94", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "ebc3bacebd94", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-0-27-17613-18-13-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790238518, "last_seen": 1790238518, "transport": "t", "ja3_hash": "a18ab0c8999d8b9c05e53b316a00e958", "ja3_variant_count": 1, "ja3_variants": [ "a18ab0c8999d8b9c05e53b316a00e958" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_f2855c265717", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "f2855c265717", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-0-51-13-65281-18-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790258801, "last_seen": 1790258801, "transport": "t", "ja3_hash": "4b4d184988baff95c815da2e5fb15f21", "ja3_variant_count": 1, "ja3_variants": [ "4b4d184988baff95c815da2e5fb15f21" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_f6d88400e4eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "f6d88400e4eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-27-11-13-65037-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789348867, "last_seen": 1789348867, "transport": "t", "ja3_hash": "9d4288f536f814c03b34b0546f167686", "ja3_variant_count": 1, "ja3_variants": [ "9d4288f536f814c03b34b0546f167686" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h1_8daaf6152771_34253acf4c55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h1", "b": "8daaf6152771", "c": "34253acf4c55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-11-45-0-16-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791131946, "last_seen": 1791131946, "transport": "t", "ja3_hash": "013368012e220b8d3ed79fc4db6483c8", "ja3_variant_count": 1, "ja3_variants": [ "013368012e220b8d3ed79fc4db6483c8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h1_8daaf6152771_440d82757558", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h1", "b": "8daaf6152771", "c": "440d82757558", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-5-10-65281-45-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790656464, "last_seen": 1790656464, "transport": "t", "ja3_hash": "513095bc4c94e0c37c1807315fc9fe3c", "ja3_variant_count": 1, "ja3_variants": [ "513095bc4c94e0c37c1807315fc9fe3c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h1_8daaf6152771_53821df629ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h1", "b": "8daaf6152771", "c": "53821df629ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-27-16-45-35-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790547236, "last_seen": 1790547236, "transport": "t", "ja3_hash": "72abc53c322a307a8855939bbffbab1a", "ja3_variant_count": 1, "ja3_variants": [ "72abc53c322a307a8855939bbffbab1a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h1_8daaf6152771_aa71e07b4d87", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h1", "b": "8daaf6152771", "c": "aa71e07b4d87", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-0-16-65281-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790538644, "last_seen": 1790538644, "transport": "t", "ja3_hash": "ec1366223dfb6c24331d300f5a3dd95a", "ja3_variant_count": 1, "ja3_variants": [ "ec1366223dfb6c24331d300f5a3dd95a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_006e83cc336b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "006e83cc336b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-16-0-27-18-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791186123, "last_seen": 1791186123, "transport": "t", "ja3_hash": "fce675a34c7e52934a837c0f17c16abb", "ja3_variant_count": 1, "ja3_variants": [ "fce675a34c7e52934a837c0f17c16abb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_0d7c372af65b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "0d7c372af65b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-51-11-0-35-16-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790911146, "last_seen": 1790911146, "transport": "t", "ja3_hash": "e42dd2f670fd9dfc42fdb4767259cc04", "ja3_variant_count": 1, "ja3_variants": [ "e42dd2f670fd9dfc42fdb4767259cc04" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_139ce090b990", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "139ce090b990", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-18-11-35-51-0-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790304678, "last_seen": 1790304678, "transport": "t", "ja3_hash": "8267a9e3c61046b3a90f1adfa498dc4c", "ja3_variant_count": 1, "ja3_variants": [ "8267a9e3c61046b3a90f1adfa498dc4c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_163738e34f75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "163738e34f75", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17513-65037-16-65281-35-10-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791151486, "last_seen": 1791151486, "transport": "t", "ja3_hash": "e48c16d146d1a351b187008283900d20", "ja3_variant_count": 1, "ja3_variants": [ "e48c16d146d1a351b187008283900d20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_1bb06c0688f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "1bb06c0688f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-23-16-51-0-17613-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790423547, "last_seen": 1790423547, "transport": "t", "ja3_hash": "d07082a6eb42ad9d6915ed8b196a3f27", "ja3_variant_count": 1, "ja3_variants": [ "d07082a6eb42ad9d6915ed8b196a3f27" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_62ed8481507b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "62ed8481507b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-16-0-23-45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789751364, "last_seen": 1789751364, "transport": "t", "ja3_hash": "4a46d00015a27707f2863a4ffbe931ba", "ja3_variant_count": 1, "ja3_variants": [ "4a46d00015a27707f2863a4ffbe931ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_77a600148ece", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "77a600148ece", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-16-27-0-45-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789666816, "last_seen": 1789666816, "transport": "t", "ja3_hash": "47663536ae4cf775d38c96f3be888ca1", "ja3_variant_count": 1, "ja3_variants": [ "47663536ae4cf775d38c96f3be888ca1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_8fdc367e25c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "8fdc367e25c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-18-35-10-45-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788590366, "last_seen": 1788590366, "transport": "t", "ja3_hash": "2ccbbd4c97046baa968a6b58a52faf1b", "ja3_variant_count": 1, "ja3_variants": [ "2ccbbd4c97046baa968a6b58a52faf1b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_945668e0c70e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "945668e0c70e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-11-0-17613-51-5-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789269659, "last_seen": 1789269659, "transport": "t", "ja3_hash": "488451d90f0bb8dba09699906a22fb2f", "ja3_variant_count": 1, "ja3_variants": [ "488451d90f0bb8dba09699906a22fb2f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_a3ad0ff574ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "a3ad0ff574ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-11-27-0-51-65281-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789686182, "last_seen": 1789686182, "transport": "t", "ja3_hash": "0cd2c307ca967f3e26cfeb99d302e70b", "ja3_variant_count": 1, "ja3_variants": [ "0cd2c307ca967f3e26cfeb99d302e70b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_a77bd6e9a962", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "a77bd6e9a962", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-23-18-10-45-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723972, "last_seen": 1788723972, "transport": "t", "ja3_hash": "fc7cc7a836924338d6040c66d19ba75d", "ja3_variant_count": 1, "ja3_variants": [ "fc7cc7a836924338d6040c66d19ba75d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_aaa7a8cca642", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "aaa7a8cca642", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-65037-0-16-18-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790053085, "last_seen": 1790053085, "transport": "t", "ja3_hash": "e1855a7102528a9fe12303693deb6f80", "ja3_variant_count": 1, "ja3_variants": [ "e1855a7102528a9fe12303693deb6f80" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_b6fb66a9c40d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "b6fb66a9c40d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-0-16-18-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790201521, "last_seen": 1790201521, "transport": "t", "ja3_hash": "374bdb761a892e83b5ccb7eec9ea85f9", "ja3_variant_count": 1, "ja3_variants": [ "374bdb761a892e83b5ccb7eec9ea85f9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_bb28d51f298a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "bb28d51f298a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-23-10-0-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788798359, "last_seen": 1788798359, "transport": "t", "ja3_hash": "835a36bf7d600792ce1c75cfe3bbb879", "ja3_variant_count": 1, "ja3_variants": [ "835a36bf7d600792ce1c75cfe3bbb879" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_bebc93064de2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "bebc93064de2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-0-16-5-23-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789066175, "last_seen": 1789066175, "transport": "t", "ja3_hash": "c9aa4a8ed0d71a0b2030311dedef909b", "ja3_variant_count": 1, "ja3_variants": [ "c9aa4a8ed0d71a0b2030311dedef909b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_dca1c142f781", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "dca1c142f781", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-65281-18-16-45-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790876481, "last_seen": 1790876481, "transport": "t", "ja3_hash": "d50e4c2974a7be2969558e86ad46fc20", "ja3_variant_count": 1, "ja3_variants": [ "d50e4c2974a7be2969558e86ad46fc20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_f07f746e3284", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "f07f746e3284", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-18-65037-23-11-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790948895, "last_seen": 1790948895, "transport": "t", "ja3_hash": "0e2dc57568d0237041c7905cf2e96aa7", "ja3_variant_count": 1, "ja3_variants": [ "0e2dc57568d0237041c7905cf2e96aa7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_f71fcdef798d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "f71fcdef798d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-35-18-65037-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788899639, "last_seen": 1789006087, "transport": "t", "ja3_hash": "e54c488c45ee321e91f274049e02d4d8", "ja3_variant_count": 2, "ja3_variants": [ "e54c488c45ee321e91f274049e02d4d8", "0e9d9a708e2f904b7d289a310411c919" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 7, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_012cb0b73229", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "012cb0b73229", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-65037-18-17613-0-35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791157113, "last_seen": 1791157113, "transport": "t", "ja3_hash": "94a7c13c1b22a4c32c457edb11a1dade", "ja3_variant_count": 1, "ja3_variants": [ "94a7c13c1b22a4c32c457edb11a1dade" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_076c4c995ec5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "076c4c995ec5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-17613-0-65037-27-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790433489, "last_seen": 1790433489, "transport": "t", "ja3_hash": "e02059f8a4960f89d0f6f75a8db5ce32", "ja3_variant_count": 1, "ja3_variants": [ "e02059f8a4960f89d0f6f75a8db5ce32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_0fd65098570f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "0fd65098570f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-11-65281-65037-5-0-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789009456, "last_seen": 1789009456, "transport": "t", "ja3_hash": "781302c621023bc4a0309b7f1059e8a0", "ja3_variant_count": 1, "ja3_variants": [ "781302c621023bc4a0309b7f1059e8a0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_17adb3e7b930", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "17adb3e7b930", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-17613-10-5-18-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790823279, "last_seen": 1790823279, "transport": "t", "ja3_hash": "ac683da8badb9f36a3574f2364e015cd", "ja3_variant_count": 1, "ja3_variants": [ "ac683da8badb9f36a3574f2364e015cd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_2ccf1c72ae65", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "2ccf1c72ae65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-51-18-0-65281-10-65037-13,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791102868, "last_seen": 1791102868, "transport": "t", "ja3_hash": "8dbe9357c30604c28ac425d6a63e148b", "ja3_variant_count": 1, "ja3_variants": [ "8dbe9357c30604c28ac425d6a63e148b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_4c7e41770b67", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "4c7e41770b67", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-27-65037-0-17613-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790509012, "last_seen": 1790509012, "transport": "t", "ja3_hash": "64d6aa1b71c6806902d9557e662ba2b0", "ja3_variant_count": 1, "ja3_variants": [ "64d6aa1b71c6806902d9557e662ba2b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.6.2 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_4e00e9624d0c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "4e00e9624d0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-23-13-35-0-5-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789033653, "last_seen": 1789033653, "transport": "t", "ja3_hash": "4d76d3631872c8a801002d3464f4820c", "ja3_variant_count": 1, "ja3_variants": [ "4d76d3631872c8a801002d3464f4820c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_536c74859f3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "536c74859f3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-0-11-35-17613-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790751827, "last_seen": 1790751827, "transport": "t", "ja3_hash": "7daba22d5dbd34867f269a4e21400acb", "ja3_variant_count": 1, "ja3_variants": [ "7daba22d5dbd34867f269a4e21400acb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_5cdf62706432", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "5cdf62706432", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-27-5-13-0-11-10-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790656249, "last_seen": 1790656249, "transport": "t", "ja3_hash": "b7181657720c15673300ac380bd9fa85", "ja3_variant_count": 1, "ja3_variants": [ "b7181657720c15673300ac380bd9fa85" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_5f3ace801959", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "5f3ace801959", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-65037-65281-0-23-35-51-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106737, "last_seen": 1791106737, "transport": "t", "ja3_hash": "36fb8e7a9cd76bcb01470b5b4f2c296c", "ja3_variant_count": 1, "ja3_variants": [ "36fb8e7a9cd76bcb01470b5b4f2c296c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_60a4a9d0011b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "60a4a9d0011b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-10-11-18-65037-35-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790228716, "last_seen": 1790228716, "transport": "t", "ja3_hash": "67fda05c56cbbf5df4f8284fae78c85e", "ja3_variant_count": 1, "ja3_variants": [ "67fda05c56cbbf5df4f8284fae78c85e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_64c05488f0c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "64c05488f0c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-5-0-27-23-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789964827, "last_seen": 1789964827, "transport": "t", "ja3_hash": "6fb93722c0152573b436ff554aadb1fb", "ja3_variant_count": 1, "ja3_variants": [ "6fb93722c0152573b436ff554aadb1fb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_6a2156c240f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "6a2156c240f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-45-5-0-27-51-18-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789628493, "last_seen": 1789628493, "transport": "t", "ja3_hash": "225e48441b43892d339df3a7c18107ad", "ja3_variant_count": 1, "ja3_variants": [ "225e48441b43892d339df3a7c18107ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_6a4b43531bc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "6a4b43531bc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-0-27-51-10-5-65281-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790566125, "last_seen": 1790566125, "transport": "t", "ja3_hash": "634ef483ed284f61ca5a5c785b494267", "ja3_variant_count": 1, "ja3_variants": [ "634ef483ed284f61ca5a5c785b494267" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_72eaf91850df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "72eaf91850df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-27-10-23-65281-35-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790191107, "last_seen": 1790191107, "transport": "t", "ja3_hash": "6b8046113ade58eb802aa119b3c21a32", "ja3_variant_count": 1, "ja3_variants": [ "6b8046113ade58eb802aa119b3c21a32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_734db862881e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "734db862881e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-17613-65037-27-11-0-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790745591, "last_seen": 1790745591, "transport": "t", "ja3_hash": "94a033896e43926891436b7e957ed6cd", "ja3_variant_count": 1, "ja3_variants": [ "94a033896e43926891436b7e957ed6cd" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_753545e98d49", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "753545e98d49", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-65281-18-23-27-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788998441, "last_seen": 1788998441, "transport": "t", "ja3_hash": "8c40dd38b97894a21fc835f5d33c4358", "ja3_variant_count": 1, "ja3_variants": [ "8c40dd38b97894a21fc835f5d33c4358" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_7e7f4287d3b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "7e7f4287d3b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-11-23-27-35-45-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790227489, "last_seen": 1790227489, "transport": "t", "ja3_hash": "7c420d39ff9187f724aec416637ec8b0", "ja3_variant_count": 1, "ja3_variants": [ "7c420d39ff9187f724aec416637ec8b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_7f064daffae0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "7f064daffae0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-35-5-65037-0-17613-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790191990, "last_seen": 1790191990, "transport": "t", "ja3_hash": "5b36f213b0bf35159e45698154ea8490", "ja3_variant_count": 1, "ja3_variants": [ "5b36f213b0bf35159e45698154ea8490" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_89f955ecc8ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "89f955ecc8ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-51764-18-17613-65281-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789750048, "last_seen": 1789750048, "transport": "t", "ja3_hash": "ce104668376d56b6168a91527645993a", "ja3_variant_count": 1, "ja3_variants": [ "ce104668376d56b6168a91527645993a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_9a968430898c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "9a968430898c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-35-13-18-45-65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789283184, "last_seen": 1789283184, "transport": "t", "ja3_hash": "a13e2320624951bd8a218234600fba1f", "ja3_variant_count": 1, "ja3_variants": [ "a13e2320624951bd8a218234600fba1f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_9b220515a118", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "9b220515a118", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-5-11-10-0-45-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791125286, "last_seen": 1791125286, "transport": "t", "ja3_hash": "0ddf739f3d3bc31dc2b30f012d86231a", "ja3_variant_count": 1, "ja3_variants": [ "0ddf739f3d3bc31dc2b30f012d86231a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_9c056901e4ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "9c056901e4ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-45-35-0-13-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790243384, "last_seen": 1790243384, "transport": "t", "ja3_hash": "7e7ca46ddaeb895bce7ca972da896618", "ja3_variant_count": 1, "ja3_variants": [ "7e7ca46ddaeb895bce7ca972da896618" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_a1cf161cf7f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "a1cf161cf7f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-45-51-27-10-23-11-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790621417, "last_seen": 1790621417, "transport": "t", "ja3_hash": "cf59a3c892a21a60dc2fcc08a6501121", "ja3_variant_count": 1, "ja3_variants": [ "cf59a3c892a21a60dc2fcc08a6501121" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_ae54783c8a84", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "ae54783c8a84", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-23-0-35-10-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790031413, "last_seen": 1790031413, "transport": "t", "ja3_hash": "dc9abb0e588d07de32c2d81c16c37b5f", "ja3_variant_count": 1, "ja3_variants": [ "dc9abb0e588d07de32c2d81c16c37b5f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 46 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_b2bc4517cdc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "b2bc4517cdc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-18-10-35-65281-51764-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790188281, "last_seen": 1790188281, "transport": "t", "ja3_hash": "9eb40a1bbc6b62dabb72e92278fc07fd", "ja3_variant_count": 1, "ja3_variants": [ "9eb40a1bbc6b62dabb72e92278fc07fd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_b2d023f7765d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "b2d023f7765d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-65037-10-23-35-65281-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789839792, "last_seen": 1789839792, "transport": "t", "ja3_hash": "9b84ff51dbc14d8be6a65d1bbca9f997", "ja3_variant_count": 1, "ja3_variants": [ "9b84ff51dbc14d8be6a65d1bbca9f997" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_bd302e63541f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "bd302e63541f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-5-27-45-17613-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789517322, "last_seen": 1789517322, "transport": "t", "ja3_hash": "90808fddc331b133750165b389ac03a0", "ja3_variant_count": 1, "ja3_variants": [ "90808fddc331b133750165b389ac03a0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c06fde8eb55b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c06fde8eb55b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-11-5-51764-35-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789063165, "last_seen": 1789063165, "transport": "t", "ja3_hash": "c35edce37db3303323651dc1e1b69c33", "ja3_variant_count": 1, "ja3_variants": [ "c35edce37db3303323651dc1e1b69c33" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 23 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c0f419eee790", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c0f419eee790", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-65037-27-65281-10-0-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788798638, "last_seen": 1788798638, "transport": "t", "ja3_hash": "40da22d5e5262254acf08a44d7c4c5ba", "ja3_variant_count": 1, "ja3_variants": [ "40da22d5e5262254acf08a44d7c4c5ba" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c2e37bf9a8ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c2e37bf9a8ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-27-13-0-5-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789682015, "last_seen": 1789682015, "transport": "t", "ja3_hash": "f91cefaea172c75697b87becfe6ad729", "ja3_variant_count": 1, "ja3_variants": [ "f91cefaea172c75697b87becfe6ad729" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c38bff314e1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c38bff314e1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-0-11-45-10-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790240110, "last_seen": 1790240110, "transport": "t", "ja3_hash": "0d8234a1c780032f813d18059e67ac3f", "ja3_variant_count": 1, "ja3_variants": [ "0d8234a1c780032f813d18059e67ac3f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_d9f0d4192f75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "d9f0d4192f75", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-0-23-17613-5-65037-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790696176, "last_seen": 1790696176, "transport": "t", "ja3_hash": "b2a3c6e396a74e34badf1ff8ed19c55f", "ja3_variant_count": 1, "ja3_variants": [ "b2a3c6e396a74e34badf1ff8ed19c55f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_e4de5e82ef73", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "e4de5e82ef73", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-18-65281-5-51-17613-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789570703, "last_seen": 1789570703, "transport": "t", "ja3_hash": "ec3d3e385e901bacab8dfe3fa9d213f2", "ja3_variant_count": 1, "ja3_variants": [ "ec3d3e385e901bacab8dfe3fa9d213f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_eb208de54404", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "eb208de54404", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65037-5-11-45-27-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788887864, "last_seen": 1788887864, "transport": "t", "ja3_hash": "b41cda1ff03854d07af1cb23f5ae75f6", "ja3_variant_count": 1, "ja3_variants": [ "b41cda1ff03854d07af1cb23f5ae75f6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_ed2a48320f1e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "ed2a48320f1e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-0-18-51-11-65281-23-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790829015, "last_seen": 1790829015, "transport": "t", "ja3_hash": "837c928e6e6c5bd06f1637d96688c3df", "ja3_variant_count": 1, "ja3_variants": [ "837c928e6e6c5bd06f1637d96688c3df" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_ef9280127124", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "ef9280127124", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-45-17613-0-5-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789028520, "last_seen": 1789028520, "transport": "t", "ja3_hash": "c47d0afbf76f5bbab5db0842c08fdf18", "ja3_variant_count": 1, "ja3_variants": [ "c47d0afbf76f5bbab5db0842c08fdf18" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_f3b401cad7d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "f3b401cad7d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65037-5-13-10-23-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790080414, "last_seen": 1790080414, "transport": "t", "ja3_hash": "f7db7894fad32878c2a0d2739780268c", "ja3_variant_count": 1, "ja3_variants": [ "f7db7894fad32878c2a0d2739780268c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_f5faadd4032b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "f5faadd4032b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-35-11-27-45-23-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788739285, "last_seen": 1788739285, "transport": "t", "ja3_hash": "3f47eb1769ca2f4bc21c308d9f41414e", "ja3_variant_count": 1, "ja3_variants": [ "3f47eb1769ca2f4bc21c308d9f41414e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_fcb98c4e0d03", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "fcb98c4e0d03", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-65281-0-23-35-17613-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790702998, "last_seen": 1790702998, "transport": "t", "ja3_hash": "13d54acc86baecac6702ae8bc17eeca8", "ja3_variant_count": 1, "ja3_variants": [ "13d54acc86baecac6702ae8bc17eeca8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_fe09333a7d32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "fe09333a7d32", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-18-65281-51-35-45-0-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789776180, "last_seen": 1789776180, "transport": "t", "ja3_hash": "e485549c4bce7ee2c338052753967c49", "ja3_variant_count": 1, "ja3_variants": [ "e485549c4bce7ee2c338052753967c49" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509h1_8daaf6152771_08c3c5238ca8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h1", "b": "8daaf6152771", "c": "08c3c5238ca8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-16-18-23-13-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790656386, "last_seen": 1790656386, "transport": "t", "ja3_hash": "2b0b16623cc1b2b6159a0469a00e94a6", "ja3_variant_count": 1, "ja3_variants": [ "2b0b16623cc1b2b6159a0469a00e94a6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h1_8daaf6152771_25dcf7ba72a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h1", "b": "8daaf6152771", "c": "25dcf7ba72a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-45-10-11-16-65037-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790674059, "last_seen": 1790674059, "transport": "t", "ja3_hash": "a8649b78d17f449db18398ad7f46172b", "ja3_variant_count": 1, "ja3_variants": [ "a8649b78d17f449db18398ad7f46172b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h1_8daaf6152771_b5c435c068e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (b5c435c068e0) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d1509h1", "b": "8daaf6152771", "c": "b5c435c068e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-5-13-0-65281-16-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524703, "last_seen": 1790524703, "transport": "t", "ja3_hash": "06076b1c601aee365a7bdf0acd09af9d", "ja3_variant_count": 1, "ja3_variants": [ "06076b1c601aee365a7bdf0acd09af9d" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d1509h2_073e58a039a6_7081e2cbd3c7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d1509h2", "b": "073e58a039a6", "c": "7081e2cbd3c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-51-57-47-53-10,0-23-65281-10-11-35-16-5-13,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789546275, "last_seen": 1790851499, "transport": "t", "ja3_hash": "0ffee3ba8e615ad22535e7f771690a28", "ja3_variant_count": 1, "ja3_variants": [ "0ffee3ba8e615ad22535e7f771690a28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_028b3ae9db7a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "028b3ae9db7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-18-13-65281-45-0-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790232125, "last_seen": 1790232125, "transport": "t", "ja3_hash": "4d46363569c5a90aa94196b0053f30d9", "ja3_variant_count": 1, "ja3_variants": [ "4d46363569c5a90aa94196b0053f30d9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_06dbb2297f1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "06dbb2297f1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-65037-11-16-65281-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790216269, "last_seen": 1790216269, "transport": "t", "ja3_hash": "376acab6745f87aa9c75e59de465b18c", "ja3_variant_count": 1, "ja3_variants": [ "376acab6745f87aa9c75e59de465b18c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_0706ce7a8c05", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "0706ce7a8c05", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-5-0-45-65037-27-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790464287, "last_seen": 1790464287, "transport": "t", "ja3_hash": "271a22120e6fc1658e9d34e4380d351a", "ja3_variant_count": 1, "ja3_variants": [ "271a22120e6fc1658e9d34e4380d351a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 229 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_17d58b7b81b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "17d58b7b81b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-0-5-10-13-18-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789214258, "last_seen": 1789214258, "transport": "t", "ja3_hash": "b51c1ef2b9265c55a2402e30d38df08c", "ja3_variant_count": 1, "ja3_variants": [ "b51c1ef2b9265c55a2402e30d38df08c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_19c4b027752a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "19c4b027752a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 95, "first_seen": 1787540625, "last_seen": 1788768240, "transport": "t", "ja3_hash": "6d7fcd8d30bce4bae53bdcf30033f901", "ja3_variant_count": 1, "ja3_variants": [ "6d7fcd8d30bce4bae53bdcf30033f901" ], "user_agents": { "Mozilla/5.0 (Android 17; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 37, "Mozilla/5.0 (Android 13; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 874, "Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 12 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_267e13b70f90", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "267e13b70f90", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-45-35-0-10-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788759946, "last_seen": 1788759946, "transport": "t", "ja3_hash": "9e6e0583a304812dc7ec8c60a74af537", "ja3_variant_count": 1, "ja3_variants": [ "9e6e0583a304812dc7ec8c60a74af537" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_2aae971cb6f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "2aae971cb6f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-18-27-35-5-45-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790177560, "last_seen": 1790177560, "transport": "t", "ja3_hash": "58d138b6595477fdfb022c0965e5b2a1", "ja3_variant_count": 1, "ja3_variants": [ "58d138b6595477fdfb022c0965e5b2a1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_2ba35cf65288", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "2ba35cf65288", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-0-45-23-16-18-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790263776, "last_seen": 1790263776, "transport": "t", "ja3_hash": "6158a8e64cb6a28c3f613cf6dafa8b5f", "ja3_variant_count": 1, "ja3_variants": [ "6158a8e64cb6a28c3f613cf6dafa8b5f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_2cde20de78fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "2cde20de78fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-16-65037-0-13-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790712424, "last_seen": 1790712424, "transport": "t", "ja3_hash": "4da11827670a6fd4e36e7e82d1a83834", "ja3_variant_count": 1, "ja3_variants": [ "4da11827670a6fd4e36e7e82d1a83834" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_35f91b7320c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "35f91b7320c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-27-65281-11-35-65037-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790023818, "last_seen": 1790023818, "transport": "t", "ja3_hash": "533ac640840c3ea926f6578de9198820", "ja3_variant_count": 1, "ja3_variants": [ "533ac640840c3ea926f6578de9198820" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_686ce6f72082", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "686ce6f72082", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-16-0-27-13-23-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789174734, "last_seen": 1789174734, "transport": "t", "ja3_hash": "bf68021036d497927ee4cea6b1cff60b", "ja3_variant_count": 1, "ja3_variants": [ "bf68021036d497927ee4cea6b1cff60b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_691bf9aa189e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "691bf9aa189e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-23-27-17613-65037-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790591324, "last_seen": 1790591324, "transport": "t", "ja3_hash": "a829ab7fbc24075515098b37b082d918", "ja3_variant_count": 1, "ja3_variants": [ "a829ab7fbc24075515098b37b082d918" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_6a0fb5f56cc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "6a0fb5f56cc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-17613-51764-65037-5-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789729278, "last_seen": 1789729278, "transport": "t", "ja3_hash": "a6385fbfb1bc90baa59c05c4953c2ac3", "ja3_variant_count": 1, "ja3_variants": [ "a6385fbfb1bc90baa59c05c4953c2ac3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_6bdbc9c1c134", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "6bdbc9c1c134", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-65281-13-23-16-35-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790002287, "last_seen": 1790002287, "transport": "t", "ja3_hash": "58248f9d8f9797c2ed71df9d8592c34c", "ja3_variant_count": 1, "ja3_variants": [ "58248f9d8f9797c2ed71df9d8592c34c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 15 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_770a71c7b0bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "770a71c7b0bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-27-65037-65281-13-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791154060, "last_seen": 1791154060, "transport": "t", "ja3_hash": "77f9fae793c179ce4778ad6b72c18887", "ja3_variant_count": 1, "ja3_variants": [ "77f9fae793c179ce4778ad6b72c18887" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_799252e9e7a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "799252e9e7a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-16-13-0-45-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790247340, "last_seen": 1790247340, "transport": "t", "ja3_hash": "835757127f55ec995c960d337b6956f6", "ja3_variant_count": 1, "ja3_variants": [ "835757127f55ec995c960d337b6956f6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_79b61c583d29", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "79b61c583d29", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-35-27-23-45-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790163198, "last_seen": 1790163198, "transport": "t", "ja3_hash": "b4d4dbe9a88bc9b7fbb684379c75e137", "ja3_variant_count": 1, "ja3_variants": [ "b4d4dbe9a88bc9b7fbb684379c75e137" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_7a850863f715", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "7a850863f715", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-11-17613-16-10-5-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788761158, "last_seen": 1788761158, "transport": "t", "ja3_hash": "4f0d76e6a57342a4a536dc0185593dde", "ja3_variant_count": 1, "ja3_variants": [ "4f0d76e6a57342a4a536dc0185593dde" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_7fca69506369", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "7fca69506369", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-45-11-0-10-51764-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790862343, "last_seen": 1790862343, "transport": "t", "ja3_hash": "297875b36e1c687d9ad3d55bcb9c7732", "ja3_variant_count": 1, "ja3_variants": [ "297875b36e1c687d9ad3d55bcb9c7732" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_8c6b904f3484", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "8c6b904f3484", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-17613-23-0-35-45-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789601227, "last_seen": 1789601227, "transport": "t", "ja3_hash": "0b9324967dc6a46fee17adefd53dda10", "ja3_variant_count": 1, "ja3_variants": [ "0b9324967dc6a46fee17adefd53dda10" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_a1f3eea8f9b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "a1f3eea8f9b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-23-13-0-17613-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790146142, "last_seen": 1790146142, "transport": "t", "ja3_hash": "6207a5e2b213634f5470d811377a965f", "ja3_variant_count": 1, "ja3_variants": [ "6207a5e2b213634f5470d811377a965f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_a350aa7bad96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "a350aa7bad96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-0-23-16-27-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790232464, "last_seen": 1790232464, "transport": "t", "ja3_hash": "3a6c1a42e561fcb7194f1b3bb5cb1dff", "ja3_variant_count": 1, "ja3_variants": [ "3a6c1a42e561fcb7194f1b3bb5cb1dff" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_a41ea4043d9d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "a41ea4043d9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-10-5-0-13-65037-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791269743, "last_seen": 1791269743, "transport": "t", "ja3_hash": "8a9234fd74a7472d76436c7437ee8f9f", "ja3_variant_count": 1, "ja3_variants": [ "8a9234fd74a7472d76436c7437ee8f9f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_a88f965fb6ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "a88f965fb6ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-65037-16-13-10-65281-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790192976, "last_seen": 1790192976, "transport": "t", "ja3_hash": "a5f126b628127f97f7ac02d90565baf7", "ja3_variant_count": 1, "ja3_variants": [ "a5f126b628127f97f7ac02d90565baf7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_ac81127c1fe2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "ac81127c1fe2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65037-17613-0-11-16-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788620747, "last_seen": 1788620747, "transport": "t", "ja3_hash": "502c4890227aa9162dc55fbda8bad950", "ja3_variant_count": 1, "ja3_variants": [ "502c4890227aa9162dc55fbda8bad950" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_af4000ee41b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "af4000ee41b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-18-45-11-16-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788964847, "last_seen": 1788964847, "transport": "t", "ja3_hash": "5471b17efce41b83d483ee5ad5d224ed", "ja3_variant_count": 1, "ja3_variants": [ "5471b17efce41b83d483ee5ad5d224ed" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_b379a0bbbf75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "b379a0bbbf75", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-45-23-16-65281-18-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790198257, "last_seen": 1790198257, "transport": "t", "ja3_hash": "26972c796389cefaf433ba611e90e5ed", "ja3_variant_count": 1, "ja3_variants": [ "26972c796389cefaf433ba611e90e5ed" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_b5c435c068e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "b5c435c068e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-23-45-13-5-0-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789688740, "last_seen": 1789688740, "transport": "t", "ja3_hash": "0426bae1ce4a38bf334aa5f742438f35", "ja3_variant_count": 1, "ja3_variants": [ "0426bae1ce4a38bf334aa5f742438f35" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_c6b1596e1861", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "c6b1596e1861", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-16-65281-11-0-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790890901, "last_seen": 1790890901, "transport": "t", "ja3_hash": "4d17a61bab12fb386618a73c8c087edd", "ja3_variant_count": 1, "ja3_variants": [ "4d17a61bab12fb386618a73c8c087edd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_dce171efc0aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "dce171efc0aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-11-0-65037-16-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791280358, "last_seen": 1791280358, "transport": "t", "ja3_hash": "0f61f8aab1600cb82177ff6d639d02a6", "ja3_variant_count": 1, "ja3_variants": [ "0f61f8aab1600cb82177ff6d639d02a6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 7 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e1b700f7b166", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e1b700f7b166", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-18-11-27-17613-51-0-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790244216, "last_seen": 1790244216, "transport": "t", "ja3_hash": "4bcd7feda80e96957289ab6a2f92333f", "ja3_variant_count": 1, "ja3_variants": [ "4bcd7feda80e96957289ab6a2f92333f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e4256b3fbde5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e4256b3fbde5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-16-35-10-11-18-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790722564, "last_seen": 1790722564, "transport": "t", "ja3_hash": "0f62f4db8acf65bba17e6e31b44fd6e2", "ja3_variant_count": 1, "ja3_variants": [ "0f62f4db8acf65bba17e6e31b44fd6e2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e612fdce8799", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e612fdce8799", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-65037-16-35-5-65281-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790521862, "last_seen": 1790521862, "transport": "t", "ja3_hash": "7c40a455c5ab9a19d457f564ca4a8001", "ja3_variant_count": 1, "ja3_variants": [ "7c40a455c5ab9a19d457f564ca4a8001" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e941755b183a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e941755b183a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-65281-27-0-16-51-18-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730600, "last_seen": 1789730600, "transport": "t", "ja3_hash": "870f7e0cceac5851e494ca7e08effcac", "ja3_variant_count": 1, "ja3_variants": [ "870f7e0cceac5851e494ca7e08effcac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e98aeb888944", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e98aeb888944", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-17613-10-65037-45-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789006189, "last_seen": 1789006189, "transport": "t", "ja3_hash": "c8e6d8af0fb240a02ea5395c3de92ebd", "ja3_variant_count": 1, "ja3_variants": [ "c8e6d8af0fb240a02ea5395c3de92ebd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f03bc0c113ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f03bc0c113ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-16-17613-0-13-5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789021793, "last_seen": 1789021793, "transport": "t", "ja3_hash": "ed8829eddf9ce9e9f256220e800a9374", "ja3_variant_count": 1, "ja3_variants": [ "ed8829eddf9ce9e9f256220e800a9374" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f3a98b490cb5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f3a98b490cb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-18-5-10-65281-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789782422, "last_seen": 1789782422, "transport": "t", "ja3_hash": "150ccf2667f442dba4703a9e122c3f63", "ja3_variant_count": 1, "ja3_variants": [ "150ccf2667f442dba4703a9e122c3f63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f8ad27f241e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f8ad27f241e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-45-23-0-65281-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790379173, "last_seen": 1790379173, "transport": "t", "ja3_hash": "e63d6ed313c6835bc1d75e4c49d0af5d", "ja3_variant_count": 1, "ja3_variants": [ "e63d6ed313c6835bc1d75e4c49d0af5d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_fef43cc4674a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "fef43cc4674a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-34-18-51,4588-29-23-24-25-514,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1791149127, "last_seen": 1791149128, "transport": "t", "ja3_hash": "106528a2c0339b5abdf384589fec7b28", "ja3_variant_count": 1, "ja3_variants": [ "106528a2c0339b5abdf384589fec7b28" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0": 11 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_0461c316b52e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "0461c316b52e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-17613-65281-13-27-45-0-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790775692, "last_seen": 1790775692, "transport": "t", "ja3_hash": "6f5e52d4c5a9919d7b4e529425f19792", "ja3_variant_count": 1, "ja3_variants": [ "6f5e52d4c5a9919d7b4e529425f19792" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_1babfa30d4b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "1babfa30d4b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-5-13-35-17613-45-0-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790191932, "last_seen": 1790191932, "transport": "t", "ja3_hash": "8d22df7649c61bde1087b376dcf64834", "ja3_variant_count": 1, "ja3_variants": [ "8d22df7649c61bde1087b376dcf64834" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_1caa206ee25a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "1caa206ee25a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-23-27-17613-18-35-10-45-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789442125, "last_seen": 1789442125, "transport": "t", "ja3_hash": "548eaccfe70bf325139c66473765ef19", "ja3_variant_count": 1, "ja3_variants": [ "548eaccfe70bf325139c66473765ef19" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_1e13e803bf3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "1e13e803bf3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-13-18-65281-0-11-35-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790162099, "last_seen": 1790247054, "transport": "t", "ja3_hash": "71fb33d10db3c075130ae87c1d76c2c9", "ja3_variant_count": 2, "ja3_variants": [ "71fb33d10db3c075130ae87c1d76c2c9", "4c89c1c2dc43fe1d0aba3fb94232fe98" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_32ec49e0152b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "32ec49e0152b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65281-27-23-45-10-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789829912, "last_seen": 1789829912, "transport": "t", "ja3_hash": "d27f61046c32e10a4b3a309042773ef8", "ja3_variant_count": 1, "ja3_variants": [ "d27f61046c32e10a4b3a309042773ef8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_3853f111b26c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "3853f111b26c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65037-65281-45-18-35-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790770771, "last_seen": 1790770771, "transport": "t", "ja3_hash": "623de4f17721d3745adcdcd785770e26", "ja3_variant_count": 1, "ja3_variants": [ "623de4f17721d3745adcdcd785770e26" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_50df405ffc38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "50df405ffc38", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-10-45-17613-18-51764-0-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789568905, "last_seen": 1789568905, "transport": "t", "ja3_hash": "89d41c9eb46510fbfcc31b43edc03aea", "ja3_variant_count": 1, "ja3_variants": [ "89d41c9eb46510fbfcc31b43edc03aea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_50ec25b9ab97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "50ec25b9ab97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-27-5-65037-0-65281-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835210, "last_seen": 1788835210, "transport": "t", "ja3_hash": "0873ab450e550d7e25e3984cc8a7d496", "ja3_variant_count": 1, "ja3_variants": [ "0873ab450e550d7e25e3984cc8a7d496" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_5aa78f95313a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "5aa78f95313a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-65281-23-27-17613-0-45-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790658026, "last_seen": 1790658026, "transport": "t", "ja3_hash": "bbc156b0973cb6758e5a771298a65d0d", "ja3_variant_count": 1, "ja3_variants": [ "bbc156b0973cb6758e5a771298a65d0d" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.5 Mobile/15A372 Safari/604.1": 6 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_6a4773a3e5d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "6a4773a3e5d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-27-5-10-0-45-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788999852, "last_seen": 1788999852, "transport": "t", "ja3_hash": "d6e32c76728accabd2077abb68a3aa09", "ja3_variant_count": 1, "ja3_variants": [ "d6e32c76728accabd2077abb68a3aa09" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_6c3d70de8c89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "6c3d70de8c89", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-18-13-11-65281-45-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790833973, "last_seen": 1790833973, "transport": "t", "ja3_hash": "933933c4044737bde5a66c8bc9178aad", "ja3_variant_count": 1, "ja3_variants": [ "933933c4044737bde5a66c8bc9178aad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_71adf8533273", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "71adf8533273", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-65281-17613-13-23-65037-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791174609, "last_seen": 1791174609, "transport": "t", "ja3_hash": "3565288e3fe6ba449693181de043ea1c", "ja3_variant_count": 1, "ja3_variants": [ "3565288e3fe6ba449693181de043ea1c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_737af06f94cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "737af06f94cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-27-11-65037-18-10-13-65281-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789966774, "last_seen": 1789966774, "transport": "t", "ja3_hash": "261485000f25201e79cc3306722a6429", "ja3_variant_count": 1, "ja3_variants": [ "261485000f25201e79cc3306722a6429" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_914e2698c591", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "914e2698c591", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-45-23-13-17613-65037-0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790148075, "last_seen": 1790148075, "transport": "t", "ja3_hash": "33467ab0656f148a4a37324ebaaf30f7", "ja3_variant_count": 1, "ja3_variants": [ "33467ab0656f148a4a37324ebaaf30f7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_93417795e1d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "93417795e1d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-23-0-11-65281-10-18-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790789323, "last_seen": 1790789323, "transport": "t", "ja3_hash": "aaa8c57f5878fb12a0296165ea9a5f48", "ja3_variant_count": 1, "ja3_variants": [ "aaa8c57f5878fb12a0296165ea9a5f48" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_a195a0d0cfe8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "a195a0d0cfe8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65037-13-0-17613-35-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790076988, "last_seen": 1790076988, "transport": "t", "ja3_hash": "3bc2ba9a78d88c6576a1cce3e8ae5c80", "ja3_variant_count": 1, "ja3_variants": [ "3bc2ba9a78d88c6576a1cce3e8ae5c80" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_a47e054fef0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "a47e054fef0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-17613-27-35-51764-11-23-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788948716, "last_seen": 1788948716, "transport": "t", "ja3_hash": "c2d4fcad7b13d4622c536dc3605345e9", "ja3_variant_count": 1, "ja3_variants": [ "c2d4fcad7b13d4622c536dc3605345e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_aa03fc3fc3c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "aa03fc3fc3c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-18-65037-45-65281-5-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790995543, "last_seen": 1790995543, "transport": "t", "ja3_hash": "b4e94e342d70c56e160f402996a07710", "ja3_variant_count": 1, "ja3_variants": [ "b4e94e342d70c56e160f402996a07710" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_acc63b9b52bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "acc63b9b52bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-11-27-13-5-0-45-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791152279, "last_seen": 1791152279, "transport": "t", "ja3_hash": "3ec049d3df59f5d9bb1ea14b12224194", "ja3_variant_count": 1, "ja3_variants": [ "3ec049d3df59f5d9bb1ea14b12224194" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_c7bb39056392", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "c7bb39056392", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-35-11-45-5-65281-27-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788767386, "last_seen": 1788767386, "transport": "t", "ja3_hash": "9edfca88725a1b70e047a0513e0ddab8", "ja3_variant_count": 1, "ja3_variants": [ "9edfca88725a1b70e047a0513e0ddab8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_cea9b4acbcf2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "cea9b4acbcf2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-13-35-23-0-27-18-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790212087, "last_seen": 1790212087, "transport": "t", "ja3_hash": "f5bb0a7319b78bdc6b3e22cdc5d89920", "ja3_variant_count": 1, "ja3_variants": [ "f5bb0a7319b78bdc6b3e22cdc5d89920" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_d29fab0cc7c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "d29fab0cc7c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-23-65281-18-0-27-17513-65037-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791284246, "last_seen": 1791284246, "transport": "t", "ja3_hash": "410329ed7da557d918a2b5b83bcddd4d", "ja3_variant_count": 1, "ja3_variants": [ "410329ed7da557d918a2b5b83bcddd4d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_d2de718e32cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "d2de718e32cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-13-65281-0-65037-11-18-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790186247, "last_seen": 1790186247, "transport": "t", "ja3_hash": "a11be728dc66f6388011ad8331e37cd8", "ja3_variant_count": 1, "ja3_variants": [ "a11be728dc66f6388011ad8331e37cd8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_db4190d02fcf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "db4190d02fcf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-10-65037-65281-17613-13-35-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790997869, "last_seen": 1790997869, "transport": "t", "ja3_hash": "fddcc3d9363bd4230179777e4d772fb0", "ja3_variant_count": 1, "ja3_variants": [ "fddcc3d9363bd4230179777e4d772fb0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_e9de89ee8a89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "e9de89ee8a89", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-5-65281-13-17613-35-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723897, "last_seen": 1788723897, "transport": "t", "ja3_hash": "fd75745c911779cbb9ba17d8bcf6700c", "ja3_variant_count": 1, "ja3_variants": [ "fd75745c911779cbb9ba17d8bcf6700c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_fd15b84c3250", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "fd15b84c3250", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-45-65037-0-27-17613-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789949057, "last_seen": 1790436009, "transport": "t", "ja3_hash": "c5f0dc50e5ae3bc83368d15b4f34d35c", "ja3_variant_count": 2, "ja3_variants": [ "c5f0dc50e5ae3bc83368d15b4f34d35c", "83f5e6d3c02acc2831ef192e7e6ab0d8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12d151000_8daaf6152771_fd58ce490f58", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "fd58ce490f58", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-10-45-65281-17613-35-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790948093, "last_seen": 1790948093, "transport": "t", "ja3_hash": "5cc8d107012489433b9e3835fa7eeb2f", "ja3_variant_count": 1, "ja3_variants": [ "5cc8d107012489433b9e3835fa7eeb2f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_fecad6b9bc17", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "fecad6b9bc17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-0-13-18-23-10-65037-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791193517, "last_seen": 1791193517, "transport": "t", "ja3_hash": "8555bc4f0ee69a5aaf58d1744142ed4b", "ja3_variant_count": 1, "ja3_variants": [ "8555bc4f0ee69a5aaf58d1744142ed4b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1510h1_8daaf6152771_1bdb9f85c253", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h1", "b": "8daaf6152771", "c": "1bdb9f85c253", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-11-10-16-23-0-27-45-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790657110, "last_seen": 1790657110, "transport": "t", "ja3_hash": "abc52fbba54eade750098e73e4c36166", "ja3_variant_count": 1, "ja3_variants": [ "abc52fbba54eade750098e73e4c36166" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h1_8daaf6152771_844ac5fd46f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h1", "b": "8daaf6152771", "c": "844ac5fd46f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-16-11-23-10-45-27-18-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790570145, "last_seen": 1790570145, "transport": "t", "ja3_hash": "f936cb3f3f2adc85d3bcec4e12596db8", "ja3_variant_count": 1, "ja3_variants": [ "f936cb3f3f2adc85d3bcec4e12596db8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h1_8daaf6152771_c253c1f5231f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h1", "b": "8daaf6152771", "c": "c253c1f5231f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-23-65281-18-35-45-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524863, "last_seen": 1790524863, "transport": "t", "ja3_hash": "24a8d15340c38e0fea1cacf3b2048737", "ja3_variant_count": 1, "ja3_variants": [ "24a8d15340c38e0fea1cacf3b2048737" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h1_8daaf6152771_e99b8dce5de5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h1", "b": "8daaf6152771", "c": "e99b8dce5de5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-16-13-5-27-65037-0-10-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790992404, "last_seen": 1790992404, "transport": "t", "ja3_hash": "9b68ad2e0118c2441c6d98ca40f1ed5d", "ja3_variant_count": 1, "ja3_variants": [ "9b68ad2e0118c2441c6d98ca40f1ed5d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_02a9c5e19149", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "02a9c5e19149", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-13-17613-18-10-65037-0-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790366326, "last_seen": 1791221453, "transport": "t", "ja3_hash": "baa6436223243e58619ffcde91f66e2e", "ja3_variant_count": 2, "ja3_variants": [ "baa6436223243e58619ffcde91f66e2e", "f5525218af1da8a4f844bd522cb5409a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_031582c82bea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "031582c82bea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-45-35-11-13-16-17613-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791198072, "last_seen": 1791198072, "transport": "t", "ja3_hash": "e0a87a3c6403a8b7d7aaeaa3bfee6ac0", "ja3_variant_count": 1, "ja3_variants": [ "e0a87a3c6403a8b7d7aaeaa3bfee6ac0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_064c7ff5e0dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "064c7ff5e0dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-0-16-65037-27-17613-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789443931, "last_seen": 1789443931, "transport": "t", "ja3_hash": "7ff6673fe3fb9ee31b1103715437a62a", "ja3_variant_count": 1, "ja3_variants": [ "7ff6673fe3fb9ee31b1103715437a62a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 150 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_06570b0347c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "06570b0347c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-27-18-16-45-23-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791249082, "last_seen": 1791249082, "transport": "t", "ja3_hash": "f1e88f67e9636f45b2feeb55dd8fa95a", "ja3_variant_count": 1, "ja3_variants": [ "f1e88f67e9636f45b2feeb55dd8fa95a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_06e76ed2b220", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "06e76ed2b220", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-5-0-65281-11-10-13-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790029247, "last_seen": 1790029247, "transport": "t", "ja3_hash": "fa36ab703c1e7c2b8d3355b2bdc6b51b", "ja3_variant_count": 1, "ja3_variants": [ "fa36ab703c1e7c2b8d3355b2bdc6b51b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_0821d44e3287", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "0821d44e3287", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-11-65037-16-17613-10-35-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788668737, "last_seen": 1788668737, "transport": "t", "ja3_hash": "79b3bda7013444ac89ef4ed46c02f27b", "ja3_variant_count": 1, "ja3_variants": [ "79b3bda7013444ac89ef4ed46c02f27b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_0b2abafb1035", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "0b2abafb1035", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-18-65281-27-0-10-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790211131, "last_seen": 1790211131, "transport": "t", "ja3_hash": "a050758d20e748e66890d5010d7fc92e", "ja3_variant_count": 1, "ja3_variants": [ "a050758d20e748e66890d5010d7fc92e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_1eaf60c563e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "1eaf60c563e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-45-10-0-18-23-27-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789432689, "last_seen": 1789432689, "transport": "t", "ja3_hash": "3594a2b3e583321bfa7ca2bbd9c54625", "ja3_variant_count": 1, "ja3_variants": [ "3594a2b3e583321bfa7ca2bbd9c54625" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_24d6e2264cdf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "24d6e2264cdf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-16-27-18-17613-0-23-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790191992, "last_seen": 1790191992, "transport": "t", "ja3_hash": "9750109ff41c1991ec65fd62eb4942e6", "ja3_variant_count": 1, "ja3_variants": [ "9750109ff41c1991ec65fd62eb4942e6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_28547a9047bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "28547a9047bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-11-35-51764-45-0-5-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790788071, "last_seen": 1790788071, "transport": "t", "ja3_hash": "3f9989a0ca7a1c246bebe361071503bb", "ja3_variant_count": 1, "ja3_variants": [ "3f9989a0ca7a1c246bebe361071503bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_28c7080823c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "28c7080823c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-17613-16-23-65037-35-18-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789750608, "last_seen": 1789750608, "transport": "t", "ja3_hash": "f7e6b92ae9d7965ee14af40e5b572d5d", "ja3_variant_count": 1, "ja3_variants": [ "f7e6b92ae9d7965ee14af40e5b572d5d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_29cc5cd76a4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "29cc5cd76a4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65281-0-10-27-16-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789028567, "last_seen": 1789028567, "transport": "t", "ja3_hash": "b55fae2ba58bbefb22741483ddd926ad", "ja3_variant_count": 1, "ja3_variants": [ "b55fae2ba58bbefb22741483ddd926ad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_308c9f3e9479", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "308c9f3e9479", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-51764-10-27-35-16-5-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790517581, "last_seen": 1790517581, "transport": "t", "ja3_hash": "cef43f00081c3a32d9371b0505c82bea", "ja3_variant_count": 1, "ja3_variants": [ "cef43f00081c3a32d9371b0505c82bea" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_31641c40bd40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "31641c40bd40", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-13-10-23-65281-17613-18-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788784805, "last_seen": 1788797453, "transport": "t", "ja3_hash": "fe50377a9a20b931d9889034734edad2", "ja3_variant_count": 2, "ja3_variants": [ "fe50377a9a20b931d9889034734edad2", "47883dc56d38baab9b23c18ad69db801" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_4a065df55c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "4a065df55c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 620, "first_seen": 1787516560, "last_seen": 1791310676, "transport": "t", "ja3_hash": "0b0b8d5f87b0a48ba36914bcef2ea47e", "ja3_variant_count": 4, "ja3_variants": [ "0b0b8d5f87b0a48ba36914bcef2ea47e", "3f18d0aaf5dfc64f9be3aa1d568a9189", "4f1e1af5ffb803ceceae1d62ae8fa94e", "fbd433fde8893fc8c32fe9c7bf9b1204" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 94, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 43, "Mozilla/5.0 (Android 16; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 3, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 127, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 180, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 892, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 15 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_4dbab9fbff62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "4dbab9fbff62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-11-5-13-0-16-23-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790910307, "last_seen": 1790910307, "transport": "t", "ja3_hash": "b04ac46491e9cc34411c15c4bb5f73c4", "ja3_variant_count": 1, "ja3_variants": [ "b04ac46491e9cc34411c15c4bb5f73c4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_4e728f0ca327", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "4e728f0ca327", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-10-65281-35-16-0-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790320391, "last_seen": 1790320391, "transport": "t", "ja3_hash": "a3cebab136e5d8516d28c8ffc1c386d5", "ja3_variant_count": 1, "ja3_variants": [ "a3cebab136e5d8516d28c8ffc1c386d5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_5108843bd1cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "5108843bd1cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-35-17613-11-13-18-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788760447, "last_seen": 1788760447, "transport": "t", "ja3_hash": "b90f10a94af7bd4c342d7f013d8ad697", "ja3_variant_count": 1, "ja3_variants": [ "b90f10a94af7bd4c342d7f013d8ad697" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_64a2ba4fb516", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "64a2ba4fb516", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-5-45-65037-23-17613-0-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789140922, "last_seen": 1789140922, "transport": "t", "ja3_hash": "189870719493748f21a44367d6a0bcd2", "ja3_variant_count": 1, "ja3_variants": [ "189870719493748f21a44367d6a0bcd2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 9 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_73cf8644c0f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "73cf8644c0f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-5-11-0-17613-35-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791032359, "last_seen": 1791032359, "transport": "t", "ja3_hash": "4d08041e9c95fd11e1c49bb73d70a699", "ja3_variant_count": 1, "ja3_variants": [ "4d08041e9c95fd11e1c49bb73d70a699" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 OPR/102.0.0.0": 11 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_7456b419a5f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "7456b419a5f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-16-11-65037-5-18-0-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788571299, "last_seen": 1788571299, "transport": "t", "ja3_hash": "64637610e5a4cc9c2fa5c87882762363", "ja3_variant_count": 1, "ja3_variants": [ "64637610e5a4cc9c2fa5c87882762363" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_797a061ca5c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "797a061ca5c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-65281-11-17613-10-13-0-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788570646, "last_seen": 1788570646, "transport": "t", "ja3_hash": "a576fe7e2204d473da4d50dbfda048fd", "ja3_variant_count": 1, "ja3_variants": [ "a576fe7e2204d473da4d50dbfda048fd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_7f5b27f10ff0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "7f5b27f10ff0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-18-5-35-13-23-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789201595, "last_seen": 1789201595, "transport": "t", "ja3_hash": "a5d7c70872855627ca52feb1bc77e1c2", "ja3_variant_count": 1, "ja3_variants": [ "a5d7c70872855627ca52feb1bc77e1c2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_8011625d9f9c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "8011625d9f9c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-0-16-23-13-27-5-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788443555, "last_seen": 1788443555, "transport": "t", "ja3_hash": "6caf367979e46e625439739de9820fd3", "ja3_variant_count": 1, "ja3_variants": [ "6caf367979e46e625439739de9820fd3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_81eafc1fb399", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "81eafc1fb399", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-65037-0-10-65281-23-27-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790777983, "last_seen": 1790777983, "transport": "t", "ja3_hash": "6ab50b2abb4a71d5ff3a0df1a3cbfd11", "ja3_variant_count": 1, "ja3_variants": [ "6ab50b2abb4a71d5ff3a0df1a3cbfd11" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_9137260a110b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "9137260a110b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-23-65281-13-17613-0-45-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791241367, "last_seen": 1791241367, "transport": "t", "ja3_hash": "f1f82dba0196c21ab5274bde049b2581", "ja3_variant_count": 1, "ja3_variants": [ "f1f82dba0196c21ab5274bde049b2581" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_926e44f04d6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "926e44f04d6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-51764-5-23-65037-18-65281-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791155962, "last_seen": 1791155962, "transport": "t", "ja3_hash": "51091ff5142573857962308f42c30c26", "ja3_variant_count": 1, "ja3_variants": [ "51091ff5142573857962308f42c30c26" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 90 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_9482cf1d5e45", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "9482cf1d5e45", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-23-17513-27-0-45-18-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790500991, "last_seen": 1790500991, "transport": "t", "ja3_hash": "fe28dac17c3629da15bea282d1cf59cd", "ja3_variant_count": 1, "ja3_variants": [ "fe28dac17c3629da15bea282d1cf59cd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_98199706beb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "98199706beb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-0-16-27-11-45-23-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790243922, "last_seen": 1790243922, "transport": "t", "ja3_hash": "9f2da3b2c6ed7399dab40e30578e26b3", "ja3_variant_count": 1, "ja3_variants": [ "9f2da3b2c6ed7399dab40e30578e26b3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_9bd5dce74306", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "9bd5dce74306", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-16-10-65037-0-17613-27-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791279443, "last_seen": 1791279443, "transport": "t", "ja3_hash": "1ded339a88934decbf7856116b29ec03", "ja3_variant_count": 1, "ja3_variants": [ "1ded339a88934decbf7856116b29ec03" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_a00146185b07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "a00146185b07", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-23-5-10-17613-13-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790465464, "last_seen": 1790465464, "transport": "t", "ja3_hash": "7c67317c1cef2baa324b4ac7a19deb4b", "ja3_variant_count": 1, "ja3_variants": [ "7c67317c1cef2baa324b4ac7a19deb4b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_aa6324e8e9b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "aa6324e8e9b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-35-10-65281-16-0-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789028251, "last_seen": 1789028251, "transport": "t", "ja3_hash": "c9a03d8ef4dff3eedc561e033709633c", "ja3_variant_count": 1, "ja3_variants": [ "c9a03d8ef4dff3eedc561e033709633c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_abcdc00e6c32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "abcdc00e6c32", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789720077, "last_seen": 1789720077, "transport": "t", "ja3_hash": "924015c57f5a543584dd5f48decc7598", "ja3_variant_count": 1, "ja3_variants": [ "924015c57f5a543584dd5f48decc7598" ], "user_agents": { "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 9 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_b06e6b7a689c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "b06e6b7a689c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-16-13-35-0-18-27-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110330, "last_seen": 1791110330, "transport": "t", "ja3_hash": "9c502c6520582ce83a65e4d68ff87835", "ja3_variant_count": 1, "ja3_variants": [ "9c502c6520582ce83a65e4d68ff87835" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_b1732d34d86d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "b1732d34d86d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-27-5-65281-65037-16-10-11-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106250, "last_seen": 1791106250, "transport": "t", "ja3_hash": "e9ee0e4c305495cb626daa753d00508f", "ja3_variant_count": 1, "ja3_variants": [ "e9ee0e4c305495cb626daa753d00508f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_c14b00694c98", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "c14b00694c98", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-65037-11-35-27-13-23-16-17513,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791274378, "last_seen": 1791274378, "transport": "t", "ja3_hash": "279739b44e8a55e260ae37eb230fc4e6", "ja3_variant_count": 1, "ja3_variants": [ "279739b44e8a55e260ae37eb230fc4e6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_c15ac183f809", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "c15ac183f809", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-11-0-13-45-10-65037-5-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791287243, "last_seen": 1791287243, "transport": "t", "ja3_hash": "8f7dab030498f922b09996ce90e70a20", "ja3_variant_count": 1, "ja3_variants": [ "8f7dab030498f922b09996ce90e70a20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_c56e0bf049c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "c56e0bf049c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-34-18-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790637106, "last_seen": 1790637106, "transport": "t", "ja3_hash": "4ce706c1f228f4cbb4f89675e37784b0", "ja3_variant_count": 1, "ja3_variants": [ "4ce706c1f228f4cbb4f89675e37784b0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 31 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_cbdbe390883f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "cbdbe390883f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-65037-27-17613-13-16-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790946185, "last_seen": 1790946185, "transport": "t", "ja3_hash": "631fad633c84491197ac01642c9af948", "ja3_variant_count": 1, "ja3_variants": [ "631fad633c84491197ac01642c9af948" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d36383becc34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d36383becc34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-0-16-23-11-10-35-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790261148, "last_seen": 1790261148, "transport": "t", "ja3_hash": "32b25e84b3f7b3961f3446be190aa558", "ja3_variant_count": 1, "ja3_variants": [ "32b25e84b3f7b3961f3446be190aa558" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d72149cb519b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d72149cb519b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-17613-5-35-27-11-16-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789929605, "last_seen": 1789929605, "transport": "t", "ja3_hash": "5cec7bb013d8e85242ab18c89892d15c", "ja3_variant_count": 1, "ja3_variants": [ "5cec7bb013d8e85242ab18c89892d15c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d9616833dbf5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d9616833dbf5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-0-16-23-65281-45-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790224287, "last_seen": 1790224287, "transport": "t", "ja3_hash": "afee49e801cb4d5cb508b880fc137d18", "ja3_variant_count": 1, "ja3_variants": [ "afee49e801cb4d5cb508b880fc137d18" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_dcca4f652939", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "dcca4f652939", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-65281-10-65037-35-11-23-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790147161, "last_seen": 1790147161, "transport": "t", "ja3_hash": "92d8bbd522909b7cec18be84741f2d82", "ja3_variant_count": 1, "ja3_variants": [ "92d8bbd522909b7cec18be84741f2d82" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_e2d59eefdd1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "e2d59eefdd1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17513-65281-16-51-5-0-27-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790941816, "last_seen": 1790941816, "transport": "t", "ja3_hash": "5e96e7c6e07c3c9a21279e6b1096e8fb", "ja3_variant_count": 1, "ja3_variants": [ "5e96e7c6e07c3c9a21279e6b1096e8fb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_e9131eb77c7c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "e9131eb77c7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-35-45-16-5-0-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788992982, "last_seen": 1788992982, "transport": "t", "ja3_hash": "fc905ac276fe9651a1641759751da17b", "ja3_variant_count": 1, "ja3_variants": [ "fc905ac276fe9651a1641759751da17b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_e9d93497cdbd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "e9d93497cdbd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-65037-23-10-16-0-5-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790247322, "last_seen": 1790247322, "transport": "t", "ja3_hash": "b924849430d5170d102c0c2c68981635", "ja3_variant_count": 1, "ja3_variants": [ "b924849430d5170d102c0c2c68981635" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_f2df6f11da9f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "f2df6f11da9f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-0-35-5-65037-16-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788932608, "last_seen": 1788932608, "transport": "t", "ja3_hash": "ecf5e1c262b98397f34779de5c938d2f", "ja3_variant_count": 1, "ja3_variants": [ "ecf5e1c262b98397f34779de5c938d2f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_f8735ac6b2e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "f8735ac6b2e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17513-35-65037-0-13-16-65281-23-10,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790941801, "last_seen": 1790941801, "transport": "t", "ja3_hash": "83e72d494db612a521378ddf6c39dcf6", "ja3_variant_count": 1, "ja3_variants": [ "83e72d494db612a521378ddf6c39dcf6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_05cb4f9724cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "05cb4f9724cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-11-65037-45-10-35-13-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790180776, "last_seen": 1790180776, "transport": "t", "ja3_hash": "b1de423eefbb5748421b1c1e2acdd294", "ja3_variant_count": 1, "ja3_variants": [ "b1de423eefbb5748421b1c1e2acdd294" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 91 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_191ddca17219", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "191ddca17219", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-65037-18-35-13-45-27-5-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790859981, "last_seen": 1790859981, "transport": "t", "ja3_hash": "8094978bf7acaeec98f47397c0785880", "ja3_variant_count": 1, "ja3_variants": [ "8094978bf7acaeec98f47397c0785880" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_19f0f7f2bc50", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "19f0f7f2bc50", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-45-13-11-23-5-0-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790959674, "last_seen": 1790959674, "transport": "t", "ja3_hash": "5fe58862ba8bd9d33b15e654486010e7", "ja3_variant_count": 1, "ja3_variants": [ "5fe58862ba8bd9d33b15e654486010e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_31ffca6a33c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "31ffca6a33c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-5-65281-13-27-0-35-18-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788450668, "last_seen": 1788450668, "transport": "t", "ja3_hash": "e5487b61ccea90af8d2fd1971ff0d313", "ja3_variant_count": 1, "ja3_variants": [ "e5487b61ccea90af8d2fd1971ff0d313" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_39f6bd923d92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "39f6bd923d92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-65037-17613-51764-65281-23-0-18-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811252, "last_seen": 1788811252, "transport": "t", "ja3_hash": "cca1bbc7933075b90802e1246ffa19d4", "ja3_variant_count": 1, "ja3_variants": [ "cca1bbc7933075b90802e1246ffa19d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_3a7e982837f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "3a7e982837f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-35-45-13-18-17613-65281-65037-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790213011, "last_seen": 1790213011, "transport": "t", "ja3_hash": "b71072422959ae9cd0e77e0532769c50", "ja3_variant_count": 1, "ja3_variants": [ "b71072422959ae9cd0e77e0532769c50" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_3a9380447b6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "3a9380447b6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-13-17613-35-11-0-23-5-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790236441, "last_seen": 1790236441, "transport": "t", "ja3_hash": "262412c5f9a26b5d137b8a76e6935838", "ja3_variant_count": 1, "ja3_variants": [ "262412c5f9a26b5d137b8a76e6935838" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_405e8854d5f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "405e8854d5f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-45-13-65037-18-35-27-5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789636887, "last_seen": 1789636887, "transport": "t", "ja3_hash": "f14d3d4ae5b2ecada0f5a9faaf7fa290", "ja3_variant_count": 1, "ja3_variants": [ "f14d3d4ae5b2ecada0f5a9faaf7fa290" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_41f8fa758964", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "41f8fa758964", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-17613-65281-35-5-11-65037-27-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789293526, "last_seen": 1789293526, "transport": "t", "ja3_hash": "c1772016b5be5b870d52d860038daf92", "ja3_variant_count": 1, "ja3_variants": [ "c1772016b5be5b870d52d860038daf92" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_854f908dc172", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "854f908dc172", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-11-18-5-65281-65037-13-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790074349, "last_seen": 1790074349, "transport": "t", "ja3_hash": "73431375037e3a21e0baf7fa6291a22d", "ja3_variant_count": 1, "ja3_variants": [ "73431375037e3a21e0baf7fa6291a22d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 26 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_86bde990c4f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "86bde990c4f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-13-65037-0-18-51-23-5-65281-16,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791286046, "last_seen": 1791286046, "transport": "t", "ja3_hash": "a03fea8ce6eb82d6d58b4b943ecf74fa", "ja3_variant_count": 1, "ja3_variants": [ "a03fea8ce6eb82d6d58b4b943ecf74fa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_8e8443ba0bde", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "8e8443ba0bde", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-27-17613-18-45-35-65037-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789899237, "last_seen": 1791179601, "transport": "t", "ja3_hash": "b0f58cf66b6dc98720c52fdbe1514ffa", "ja3_variant_count": 2, "ja3_variants": [ "b0f58cf66b6dc98720c52fdbe1514ffa", "33606a2b1f0563ab8fd5dfaa5f87e266" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_979c64dbe299", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "979c64dbe299", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-17613-65281-45-0-13-18-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788943220, "last_seen": 1790738630, "transport": "t", "ja3_hash": "af1abd70f7af743602fcd7d2bb0f1534", "ja3_variant_count": 2, "ja3_variants": [ "af1abd70f7af743602fcd7d2bb0f1534", "d08428f25a8b38cf599764fde9a7dbd7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_9cf718af64c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "9cf718af64c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-27-11-45-17613-65281-65037-35-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788796558, "last_seen": 1788796558, "transport": "t", "ja3_hash": "2e1077a0db64355c3b7dc8383fd4eadb", "ja3_variant_count": 1, "ja3_variants": [ "2e1077a0db64355c3b7dc8383fd4eadb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_a4f97efabfc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "a4f97efabfc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-10-0-65281-27-13-18-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209121, "last_seen": 1790209121, "transport": "t", "ja3_hash": "622d04d2b577c61f0d9d72e945aa9aaf", "ja3_variant_count": 1, "ja3_variants": [ "622d04d2b577c61f0d9d72e945aa9aaf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_a57a75788fbf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "a57a75788fbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-51-65281-45-17613-0-5-35-18-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789142095, "last_seen": 1789142095, "transport": "t", "ja3_hash": "4d873fc8eafae312c2776863edc0a2e6", "ja3_variant_count": 1, "ja3_variants": [ "4d873fc8eafae312c2776863edc0a2e6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_b59befcd7c9a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "b59befcd7c9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-10-18-11-27-0-17513-45-5-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790086815, "last_seen": 1790086815, "transport": "t", "ja3_hash": "6a7b2697c2e12148e6e750db39dbacc8", "ja3_variant_count": 1, "ja3_variants": [ "6a7b2697c2e12148e6e750db39dbacc8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_b9078ebafdd8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "b9078ebafdd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-13-18-51764-17613-65281-45-0-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669085, "last_seen": 1789669085, "transport": "t", "ja3_hash": "b15f7a2b0089827434da1e8264fac33b", "ja3_variant_count": 1, "ja3_variants": [ "b15f7a2b0089827434da1e8264fac33b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_cd08c7bd251b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "cd08c7bd251b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-65037-11-5-18-0-27-35-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790740708, "last_seen": 1790740708, "transport": "t", "ja3_hash": "266af8928414c19206605c87ec73ec1a", "ja3_variant_count": 1, "ja3_variants": [ "266af8928414c19206605c87ec73ec1a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_d24b5a63cb8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "d24b5a63cb8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-0-13-23-65037-10-65281-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789446840, "last_seen": 1789446840, "transport": "t", "ja3_hash": "9bf466d5d3e30ba3ca09292e3bd555b3", "ja3_variant_count": 1, "ja3_variants": [ "9bf466d5d3e30ba3ca09292e3bd555b3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_d98d409acdf9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "d98d409acdf9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-23-13-27-18-0-65037-65281-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790235721, "last_seen": 1790235721, "transport": "t", "ja3_hash": "25c0be37e77a3622c01c84130d4b888f", "ja3_variant_count": 1, "ja3_variants": [ "25c0be37e77a3622c01c84130d4b888f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_d99a7f6da5e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "d99a7f6da5e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-65037-11-10-23-35-0-27-45-13-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791116699, "last_seen": 1791116699, "transport": "t", "ja3_hash": "e2976f052ccf54aac299c15c6b67163c", "ja3_variant_count": 1, "ja3_variants": [ "e2976f052ccf54aac299c15c6b67163c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_e86c81d884a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "e86c81d884a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-23-17613-0-10-18-65281-13-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788979951, "last_seen": 1788979951, "transport": "t", "ja3_hash": "55260d9dc4c2db4f64d61c92580cee47", "ja3_variant_count": 1, "ja3_variants": [ "55260d9dc4c2db4f64d61c92580cee47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h1_8daaf6152771_11d734e3a7ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h1", "b": "8daaf6152771", "c": "11d734e3a7ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-18-11-13-10-0-5-65037-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790533350, "last_seen": 1790533350, "transport": "t", "ja3_hash": "0bfbfbddec121318dd6c498d7bb76073", "ja3_variant_count": 1, "ja3_variants": [ "0bfbfbddec121318dd6c498d7bb76073" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h1_8daaf6152771_c4d416d83c1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h1", "b": "8daaf6152771", "c": "c4d416d83c1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-5-18-23-45-11-0-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790651135, "last_seen": 1790651135, "transport": "t", "ja3_hash": "df8cc7c0c4a35306820026c93b31bde4", "ja3_variant_count": 1, "ja3_variants": [ "df8cc7c0c4a35306820026c93b31bde4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h1_8daaf6152771_d5efd86df555", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h1", "b": "8daaf6152771", "c": "d5efd86df555", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-23-65281-10-16-11-27-13-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790528569, "last_seen": 1790528569, "transport": "t", "ja3_hash": "598c52dfac1ac278a693ebd338846e7a", "ja3_variant_count": 1, "ja3_variants": [ "598c52dfac1ac278a693ebd338846e7a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h1_8daaf6152771_df9ede0fdb17", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h1", "b": "8daaf6152771", "c": "df9ede0fdb17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-27-5-10-18-16-45-23-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790674073, "last_seen": 1790674073, "transport": "t", "ja3_hash": "398247047d5e211db6a2af527f04d88d", "ja3_variant_count": 1, "ja3_variants": [ "398247047d5e211db6a2af527f04d88d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h1_8daaf6152771_e43a71d47dc4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h1", "b": "8daaf6152771", "c": "e43a71d47dc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-18-65281-23-0-16-65037-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790993704, "last_seen": 1790993704, "transport": "t", "ja3_hash": "32b72c6bfdb2ac55b06bbbf402047202", "ja3_variant_count": 1, "ja3_variants": [ "32b72c6bfdb2ac55b06bbbf402047202" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_09c57bba7bb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "09c57bba7bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 394, "first_seen": 1787485227, "last_seen": 1791303616, "transport": "t", "ja3_hash": "ca159e57d8ffb379a7d4548205fef76f", "ja3_variant_count": 4, "ja3_variants": [ "ca159e57d8ffb379a7d4548205fef76f", "e02c0f4e2781534ad53eed6393e007b2", "518c1854ccc5e24f40f10ce5417d83f4", "743918cb24139f810db9122dff27eb99" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 112, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 317, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 27, "Mozilla/5.0 (Android 14; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 127, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 163, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 9, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 152 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_0e9ead26a729", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "0e9ead26a729", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-16-0-51764-35-11-10-13-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791050026, "last_seen": 1791050026, "transport": "t", "ja3_hash": "c7e756094e094af7a872b984c7957ffc", "ja3_variant_count": 1, "ja3_variants": [ "c7e756094e094af7a872b984c7957ffc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_12ac04d72c83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "12ac04d72c83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-16-45-65037-13-11-35-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788657954, "last_seen": 1788657954, "transport": "t", "ja3_hash": "3aa2a868558f9199d75b6c92e0b8c50c", "ja3_variant_count": 1, "ja3_variants": [ "3aa2a868558f9199d75b6c92e0b8c50c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 15 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_13deffa46569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "13deffa46569", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-18-13-27-35-0-45-51764-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790615348, "last_seen": 1790615348, "transport": "t", "ja3_hash": "378a11b1af03d5aa34c2c45ccff7ed34", "ja3_variant_count": 1, "ja3_variants": [ "378a11b1af03d5aa34c2c45ccff7ed34" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_16129b27e950", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "16129b27e950", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-13-17613-10-27-65037-16-45-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789688316, "last_seen": 1789688316, "transport": "t", "ja3_hash": "4343e82c071f76e10b9484e6bfd4cb03", "ja3_variant_count": 1, "ja3_variants": [ "4343e82c071f76e10b9484e6bfd4cb03" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_162677efcc06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "162677efcc06", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-0-5-27-10-18-17613-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790582352, "last_seen": 1790582352, "transport": "t", "ja3_hash": "0732966b925c2d624b2ea172af78ef37", "ja3_variant_count": 1, "ja3_variants": [ "0732966b925c2d624b2ea172af78ef37" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_235ac8537342", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "235ac8537342", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-35-23-27-5-16-65037-45-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791155526, "last_seen": 1791155526, "transport": "t", "ja3_hash": "102ecfcf1708674ccb25725d603af6ac", "ja3_variant_count": 1, "ja3_variants": [ "102ecfcf1708674ccb25725d603af6ac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 40 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_265bfdc87561", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "265bfdc87561", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-23-11-35-17613-5-65281-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790118100, "last_seen": 1790261148, "transport": "t", "ja3_hash": "f0783dde12b454458c9b186aeb9d27ce", "ja3_variant_count": 2, "ja3_variants": [ "f0783dde12b454458c9b186aeb9d27ce", "e711096b4080dbc562249af4b6815efa" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12d1511h2_8daaf6152771_324c097558a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "324c097558a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-16-18-65037-45-27-13-11-0-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791296377, "last_seen": 1791296377, "transport": "t", "ja3_hash": "62b74c58f1082cd193d449f3c9d23f44", "ja3_variant_count": 1, "ja3_variants": [ "62b74c58f1082cd193d449f3c9d23f44" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_3569fb37f72a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "3569fb37f72a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-10-35-45-65037-11-0-5-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788451783, "last_seen": 1788451783, "transport": "t", "ja3_hash": "9f4796e185998c3cf85e9fbcb5af101d", "ja3_variant_count": 1, "ja3_variants": [ "9f4796e185998c3cf85e9fbcb5af101d" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_35c15a818768", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "35c15a818768", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-0-27-18-45-23-35-65281-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788680452, "last_seen": 1788680452, "transport": "t", "ja3_hash": "87987487f96a5edd615aea5b225af664", "ja3_variant_count": 1, "ja3_variants": [ "87987487f96a5edd615aea5b225af664" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_35fc7e1c74ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "35fc7e1c74ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-0-35-23-45-18-65281-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790453151, "last_seen": 1790453151, "transport": "t", "ja3_hash": "e388bf2dd104a674bd3dde58b46cece9", "ja3_variant_count": 1, "ja3_variants": [ "e388bf2dd104a674bd3dde58b46cece9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_470722fd683a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "470722fd683a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-35-13-45-0-65281-27-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790186669, "last_seen": 1790186669, "transport": "t", "ja3_hash": "ee5e42d5a12ac76e6d59b2e5e91b1c4d", "ja3_variant_count": 1, "ja3_variants": [ "ee5e42d5a12ac76e6d59b2e5e91b1c4d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_511e060441ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "511e060441ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-5-27-11-45-0-65281-65037-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106737, "last_seen": 1791106737, "transport": "t", "ja3_hash": "d62e1b849dbbea4ff9234be5daa573c4", "ja3_variant_count": 1, "ja3_variants": [ "d62e1b849dbbea4ff9234be5daa573c4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_54b09dcce25c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "54b09dcce25c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-5-0-17613-23-16-27-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790075623, "last_seen": 1790075623, "transport": "t", "ja3_hash": "422ff08e22869a5a148603ce0eb00eed", "ja3_variant_count": 1, "ja3_variants": [ "422ff08e22869a5a148603ce0eb00eed" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 14 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_558b9a9a2ecc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "558b9a9a2ecc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-16-45-0-51764-27-65037-35-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110001, "last_seen": 1791110001, "transport": "t", "ja3_hash": "88bf5896c60ecd9d15091646e11df608", "ja3_variant_count": 1, "ja3_variants": [ "88bf5896c60ecd9d15091646e11df608" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_5c005630fa0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "5c005630fa0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17513-0-11-65281-16-65037-45-27-10-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791102870, "last_seen": 1791102870, "transport": "t", "ja3_hash": "a9600904f1bc7053a72f137671f28d4e", "ja3_variant_count": 1, "ja3_variants": [ "a9600904f1bc7053a72f137671f28d4e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_68a830f9f41b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "68a830f9f41b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-65037-27-16-10-18-11-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689537, "last_seen": 1789689537, "transport": "t", "ja3_hash": "ddcbcfaa589daa7b9b78b6afe0edee87", "ja3_variant_count": 1, "ja3_variants": [ "ddcbcfaa589daa7b9b78b6afe0edee87" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8233bdbe604a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8233bdbe604a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-65037-65281-27-0-23-45-35-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789681488, "last_seen": 1789681488, "transport": "t", "ja3_hash": "496f3ebd14e0e73edd17ba8ec39258d1", "ja3_variant_count": 1, "ja3_variants": [ "496f3ebd14e0e73edd17ba8ec39258d1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_86a73e648689", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "86a73e648689", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-13-0-27-18-65281-11-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788798455, "last_seen": 1788798455, "transport": "t", "ja3_hash": "1d4f9bcc3aa36a82227faf332d1d6279", "ja3_variant_count": 1, "ja3_variants": [ "1d4f9bcc3aa36a82227faf332d1d6279" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8a4f5bed057f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8a4f5bed057f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-5-16-65037-13-45-10-35-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788572618, "last_seen": 1788572618, "transport": "t", "ja3_hash": "7b782fcebd3eb8ca1f63ced973ff1b39", "ja3_variant_count": 1, "ja3_variants": [ "7b782fcebd3eb8ca1f63ced973ff1b39" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8dc198b1a74d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8dc198b1a74d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-45-16-65281-5-10-0-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790239106, "last_seen": 1790239106, "transport": "t", "ja3_hash": "5439bf30be1ef803442fc4e88705361c", "ja3_variant_count": 1, "ja3_variants": [ "5439bf30be1ef803442fc4e88705361c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8efff3639520", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8efff3639520", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-13-65037-45-27-0-5-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790228935, "last_seen": 1790228935, "transport": "t", "ja3_hash": "c016d88d8df09744e90c4f5d6f93d57e", "ja3_variant_count": 1, "ja3_variants": [ "c016d88d8df09744e90c4f5d6f93d57e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_93837386752e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "93837386752e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-17513-5-11-65281-0-10-16-51-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791258939, "last_seen": 1791258939, "transport": "t", "ja3_hash": "824060ab9cacffa7f381b6852221f051", "ja3_variant_count": 1, "ja3_variants": [ "824060ab9cacffa7f381b6852221f051" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_939b2ea05aa9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "939b2ea05aa9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-45-65281-10-65037-18-16-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790216798, "last_seen": 1790216798, "transport": "t", "ja3_hash": "18b560374cd8dbb667068d0e480f6e0e", "ja3_variant_count": 1, "ja3_variants": [ "18b560374cd8dbb667068d0e480f6e0e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_a7132ca8cc4d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "a7132ca8cc4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-65037-16-0-45-18-17513-35-13-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791289487, "last_seen": 1791289487, "transport": "t", "ja3_hash": "484d28b8261730cd34c1b544cb46b8d4", "ja3_variant_count": 1, "ja3_variants": [ "484d28b8261730cd34c1b544cb46b8d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_a8ec87a1d80b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "a8ec87a1d80b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-0-45-13-51764-35-5-27-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790795898, "last_seen": 1790795898, "transport": "t", "ja3_hash": "a60abf7c1c30a2f12faad952ea4be420", "ja3_variant_count": 1, "ja3_variants": [ "a60abf7c1c30a2f12faad952ea4be420" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 5 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_aba74868c18f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "aba74868c18f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-5-23-10-11-65037-16-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791166833, "last_seen": 1791166833, "transport": "t", "ja3_hash": "2d00d2353f37c48a4e69905411654aff", "ja3_variant_count": 1, "ja3_variants": [ "2d00d2353f37c48a4e69905411654aff" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_ac302f8c9f72", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "ac302f8c9f72", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-45-0-5-16-65037-13-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790480456, "last_seen": 1790608586, "transport": "t", "ja3_hash": "282bb8e9f9aa83668c62b3ab4d37212c", "ja3_variant_count": 2, "ja3_variants": [ "282bb8e9f9aa83668c62b3ab4d37212c", "9de5203da61bb9f072429158350acf41" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_b6f234c0c961", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "b6f234c0c961", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-16-10-13-45-65037-35-18-65281-27,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791290763, "last_seen": 1791290763, "transport": "t", "ja3_hash": "a57d187985cb48f65b51f1c0a8a69c95", "ja3_variant_count": 1, "ja3_variants": [ "a57d187985cb48f65b51f1c0a8a69c95" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_be8a13a88d86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "be8a13a88d86", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65037-27-23-18-35-13-16-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110208, "last_seen": 1791110208, "transport": "t", "ja3_hash": "846067c9d61adcafc464fd94c9d65a94", "ja3_variant_count": 1, "ja3_variants": [ "846067c9d61adcafc464fd94c9d65a94" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_c4142f071ad7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "c4142f071ad7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-0-23-35-18-17613-27-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789988382, "last_seen": 1789988382, "transport": "t", "ja3_hash": "6cccba5f8026340a80c969ca0c859d71", "ja3_variant_count": 1, "ja3_variants": [ "6cccba5f8026340a80c969ca0c859d71" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_c6297bb175f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "c6297bb175f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-16-65037-13-35-18-11-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209257, "last_seen": 1790209257, "transport": "t", "ja3_hash": "09c65fb62b02736735eddee3716f7ad0", "ja3_variant_count": 1, "ja3_variants": [ "09c65fb62b02736735eddee3716f7ad0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_c6990e83e2e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "c6990e83e2e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-35-23-16-0-65281-18-13-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791134320, "last_seen": 1791134320, "transport": "t", "ja3_hash": "ba57c2d32cebcb4236455ff551c3f4c2", "ja3_variant_count": 1, "ja3_variants": [ "ba57c2d32cebcb4236455ff551c3f4c2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_d2d31525478d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "d2d31525478d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-5-17613-13-35-16-45-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790055596, "last_seen": 1790055596, "transport": "t", "ja3_hash": "d50a8eb7bc4e7d70957b1ac8c11c7cc3", "ja3_variant_count": 1, "ja3_variants": [ "d50a8eb7bc4e7d70957b1ac8c11c7cc3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 9 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_d3db1c9b03b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "d3db1c9b03b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-10-5-13-65281-35-11-27-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788647901, "last_seen": 1788647901, "transport": "t", "ja3_hash": "38a1e71d2d07246b7a0b5ff9d6a2ff45", "ja3_variant_count": 1, "ja3_variants": [ "38a1e71d2d07246b7a0b5ff9d6a2ff45" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_d851df99f70b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "d851df99f70b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-35-10-45-16-13-0-17613-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789006501, "last_seen": 1789006501, "transport": "t", "ja3_hash": "dde6dbdfca0cf07bfeb3a65db4815aa8", "ja3_variant_count": 1, "ja3_variants": [ "dde6dbdfca0cf07bfeb3a65db4815aa8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_e121f1e68165", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "e121f1e68165", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-16-23-45-17613-27-0-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791216646, "last_seen": 1791216646, "transport": "t", "ja3_hash": "35f78a3441d31397ec496a7736b750a8", "ja3_variant_count": 1, "ja3_variants": [ "35f78a3441d31397ec496a7736b750a8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_e8e54ed94573", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "e8e54ed94573", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-27-11-10-23-16-45-18-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790736638, "last_seen": 1790736638, "transport": "t", "ja3_hash": "8c626c4268b1816a452ffeda48fc73af", "ja3_variant_count": 1, "ja3_variants": [ "8c626c4268b1816a452ffeda48fc73af" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_f0228183adfd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "f0228183adfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65281-17613-11-65037-0-27-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788709917, "last_seen": 1788709917, "transport": "t", "ja3_hash": "4fd786c3f494c4427f2391740f48a54c", "ja3_variant_count": 1, "ja3_variants": [ "4fd786c3f494c4427f2391740f48a54c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_f9695dddbd85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "f9695dddbd85", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-13-35-23-17613-0-27-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790258693, "last_seen": 1790258693, "transport": "t", "ja3_hash": "b77342d0489c05e8ee571dd8f0ad3416", "ja3_variant_count": 1, "ja3_variants": [ "b77342d0489c05e8ee571dd8f0ad3416" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_fb10956eb48b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "fb10956eb48b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17513-23-45-11-16-65037-5-0-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790863493, "last_seen": 1790863493, "transport": "t", "ja3_hash": "8ae3ca019287873b6ab70343eefbcebf", "ja3_variant_count": 1, "ja3_variants": [ "8ae3ca019287873b6ab70343eefbcebf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_0488cee77a13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "0488cee77a13", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-11-10-65037-5-27-17513-13-0-23-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791142434, "last_seen": 1791142434, "transport": "t", "ja3_hash": "e073bd36b42a3c5fefde58233603b37a", "ja3_variant_count": 1, "ja3_variants": [ "e073bd36b42a3c5fefde58233603b37a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_108fff90ab23", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "108fff90ab23", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-35-0-11-10-13-5-45-65281-23-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789635285, "last_seen": 1789635285, "transport": "t", "ja3_hash": "77fca4004f1df0395154da1896e4b44b", "ja3_variant_count": 1, "ja3_variants": [ "77fca4004f1df0395154da1896e4b44b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_13aa4f51f71d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "13aa4f51f71d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-10-17613-5-35-11-27-45-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790216309, "last_seen": 1790216309, "transport": "t", "ja3_hash": "25762dde8cff6dcb80a307c4b25a58ed", "ja3_variant_count": 1, "ja3_variants": [ "25762dde8cff6dcb80a307c4b25a58ed" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_1ffeb9beebad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "1ffeb9beebad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-23-35-27-45-5-10-18-17613-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788691343, "last_seen": 1788691343, "transport": "t", "ja3_hash": "147dc184688304c23c6f1373a2bd1b6b", "ja3_variant_count": 1, "ja3_variants": [ "147dc184688304c23c6f1373a2bd1b6b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_2164bb0c937c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "2164bb0c937c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-11-35-13-0-10-65281-45-27-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790234297, "last_seen": 1790234297, "transport": "t", "ja3_hash": "c892da905e16236f60abd3adff4021e2", "ja3_variant_count": 1, "ja3_variants": [ "c892da905e16236f60abd3adff4021e2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_29db12fd3636", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "29db12fd3636", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-65281-5-45-11-17613-10-18-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788851358, "last_seen": 1788851358, "transport": "t", "ja3_hash": "7fb8c1c3b539a8ef4762a455868fabc5", "ja3_variant_count": 1, "ja3_variants": [ "7fb8c1c3b539a8ef4762a455868fabc5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_351276e8394c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "351276e8394c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-18-11-23-45-65037-13-0-65281-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790192980, "last_seen": 1790192980, "transport": "t", "ja3_hash": "8e31c19c3a3815251043b7bc7b0cbe58", "ja3_variant_count": 1, "ja3_variants": [ "8e31c19c3a3815251043b7bc7b0cbe58" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_5dc1fa1c868b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "5dc1fa1c868b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-10-45-65037-23-18-0-13-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788722806, "last_seen": 1788722806, "transport": "t", "ja3_hash": "653cdda61ca2ff6dae40ee06e9c8c60b", "ja3_variant_count": 1, "ja3_variants": [ "653cdda61ca2ff6dae40ee06e9c8c60b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_8c706ac26d77", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "8c706ac26d77", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-0-35-5-27-45-11-51-65281-18-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791137534, "last_seen": 1791137534, "transport": "t", "ja3_hash": "90e1916c76b572527178ea7dbf4f15b8", "ja3_variant_count": 1, "ja3_variants": [ "90e1916c76b572527178ea7dbf4f15b8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_91e0f9dc7df0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "91e0f9dc7df0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-13-65037-23-45-11-5-10-0-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790182749, "last_seen": 1790241675, "transport": "t", "ja3_hash": "36b597e90d779b6068655adbe171cf1a", "ja3_variant_count": 2, "ja3_variants": [ "36b597e90d779b6068655adbe171cf1a", "546048a7d21d078351b331fa924d617a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_dace3972a0fd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "dace3972a0fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-17613-5-65281-65037-0-10-45-27-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790217857, "last_seen": 1790217857, "transport": "t", "ja3_hash": "67d86469a25458c0597b35e0693a7947", "ja3_variant_count": 1, "ja3_variants": [ "67d86469a25458c0597b35e0693a7947" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_dea9b2028811", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "dea9b2028811", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-23-45-0-65281-17613-10-13-5-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788787211, "last_seen": 1788787211, "transport": "t", "ja3_hash": "ab472e71e6578fc3d9d113b0c6418211", "ja3_variant_count": 1, "ja3_variants": [ "ab472e71e6578fc3d9d113b0c6418211" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h1_8daaf6152771_345ea8e0bb04", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h1", "b": "8daaf6152771", "c": "345ea8e0bb04", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-65037-18-45-10-16-5-65281-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790666965, "last_seen": 1790666965, "transport": "t", "ja3_hash": "c487ca72421782daf2d9e26a39d6245a", "ja3_variant_count": 1, "ja3_variants": [ "c487ca72421782daf2d9e26a39d6245a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h1_8daaf6152771_810248c73c4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h1", "b": "8daaf6152771", "c": "810248c73c4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-27-0-18-11-16-65037-10-13-5-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790548563, "last_seen": 1790548563, "transport": "t", "ja3_hash": "4a63f0a1511c7c1a1db770a18e195396", "ja3_variant_count": 1, "ja3_variants": [ "4a63f0a1511c7c1a1db770a18e195396" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_064b7b824fb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "064b7b824fb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-0-27-10-13-35-16-45-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790230039, "last_seen": 1790230039, "transport": "t", "ja3_hash": "97f935d091a27a98474e9a4a803d41b1", "ja3_variant_count": 1, "ja3_variants": [ "97f935d091a27a98474e9a4a803d41b1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_0f45a0a4b30d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "0f45a0a4b30d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-51764-17613-65281-18-10-13-0-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791301505, "last_seen": 1791301505, "transport": "t", "ja3_hash": "08f24f979585fd4d00981eeed559697a", "ja3_variant_count": 1, "ja3_variants": [ "08f24f979585fd4d00981eeed559697a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1956fb743284", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1956fb743284", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-0-16-11-35-18-27-13-65281-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788528948, "last_seen": 1788528948, "transport": "t", "ja3_hash": "00a58d89d0da798bce63e9eb966812ec", "ja3_variant_count": 1, "ja3_variants": [ "00a58d89d0da798bce63e9eb966812ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_199d98487440", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "199d98487440", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-17513-45-18-16-0-27-51-65281-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791151096, "last_seen": 1791151096, "transport": "t", "ja3_hash": "0c39d96a672fb558bd354cda24a1e64a", "ja3_variant_count": 1, "ja3_variants": [ "0c39d96a672fb558bd354cda24a1e64a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1bd83aa9b395", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1bd83aa9b395", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-11-17613-0-35-45-5-16-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790651505, "last_seen": 1790651505, "transport": "t", "ja3_hash": "e3aab7ae9122bbc6b4292fbbb2df8eec", "ja3_variant_count": 1, "ja3_variants": [ "e3aab7ae9122bbc6b4292fbbb2df8eec" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1e1bbaeae747", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1e1bbaeae747", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-45-27-11-18-23-65281-13-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791259897, "last_seen": 1791259897, "transport": "t", "ja3_hash": "9bfd0e7e5506aa104e4a69ed37cfab7d", "ja3_variant_count": 1, "ja3_variants": [ "9bfd0e7e5506aa104e4a69ed37cfab7d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_201ebf1a9a21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "201ebf1a9a21", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-16-23-18-35-0-5-45-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788821030, "last_seen": 1788821030, "transport": "t", "ja3_hash": "967386ff0944b010a4ccd3fd0d4546fc", "ja3_variant_count": 1, "ja3_variants": [ "967386ff0944b010a4ccd3fd0d4546fc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_29a63ca31164", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "29a63ca31164", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-17613-27-35-45-11-65037-65281-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790250143, "last_seen": 1790250143, "transport": "t", "ja3_hash": "472c18910b1591ebe200fb037814e96c", "ja3_variant_count": 1, "ja3_variants": [ "472c18910b1591ebe200fb037814e96c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_306b586bbdfa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "306b586bbdfa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-23-10-65281-11-65037-17613-18-16-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790602193, "last_seen": 1790602193, "transport": "t", "ja3_hash": "5900dbce700037cf957fb714e9082106", "ja3_variant_count": 1, "ja3_variants": [ "5900dbce700037cf957fb714e9082106" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_314eff97a049", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "314eff97a049", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-17513-35-16-5-13-45-51-23-0-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791142071, "last_seen": 1791142071, "transport": "t", "ja3_hash": "e690771cdb4f2d21db4ff551e31c86fb", "ja3_variant_count": 1, "ja3_variants": [ "e690771cdb4f2d21db4ff551e31c86fb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_373adbb9a055", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "373adbb9a055", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-16-35-18-13-17613-27-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788945450, "last_seen": 1790990970, "transport": "t", "ja3_hash": "fd5780ba68132b41a6077cb18eeb3e63", "ja3_variant_count": 2, "ja3_variants": [ "fd5780ba68132b41a6077cb18eeb3e63", "5972ea846f163d8f3c5550a70764e175" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_44560a4cbd15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "44560a4cbd15", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-35-11-51-23-18-17513-27-16-0-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791298592, "last_seen": 1791298592, "transport": "t", "ja3_hash": "6ef841a839d9e7a81c54f3ac8a080126", "ja3_variant_count": 1, "ja3_variants": [ "6ef841a839d9e7a81c54f3ac8a080126" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_4c5845513145", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "4c5845513145", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-51764-16-13-23-10-45-65281-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790701423, "last_seen": 1790701423, "transport": "t", "ja3_hash": "9311648bf7040225f3cbc5ce602a8f1b", "ja3_variant_count": 1, "ja3_variants": [ "9311648bf7040225f3cbc5ce602a8f1b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 10 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_5037d0870074", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "5037d0870074", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-10-5-13-23-65281-0-11-27-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790172617, "last_seen": 1790172617, "transport": "t", "ja3_hash": "421ae6052f54649536c70faec143694e", "ja3_variant_count": 1, "ja3_variants": [ "421ae6052f54649536c70faec143694e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_576810898ff7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "576810898ff7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-45-13-65037-27-23-0-11-16-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791206284, "last_seen": 1791206284, "transport": "t", "ja3_hash": "56afa0fce8366216aeec0633fdb7ab87", "ja3_variant_count": 1, "ja3_variants": [ "56afa0fce8366216aeec0633fdb7ab87" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_5c319bfad070", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "5c319bfad070", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-11-65281-16-18-5-65037-35-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788785721, "last_seen": 1788785721, "transport": "t", "ja3_hash": "00050365549057091676b3a34622b3a2", "ja3_variant_count": 1, "ja3_variants": [ "00050365549057091676b3a34622b3a2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_5d80ca7148fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "5d80ca7148fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-11-10-16-18-17513-0-45-65037-51-27,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791259483, "last_seen": 1791259483, "transport": "t", "ja3_hash": "2cf946f6f1f4c79a8291cc9c93737b0e", "ja3_variant_count": 1, "ja3_variants": [ "2cf946f6f1f4c79a8291cc9c93737b0e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_64e915b29f7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "64e915b29f7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-65281-0-10-23-45-18-35-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791210356, "last_seen": 1791210356, "transport": "t", "ja3_hash": "677ee40a97604914282e9e3625523f5a", "ja3_variant_count": 1, "ja3_variants": [ "677ee40a97604914282e9e3625523f5a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_673912b0c6bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "673912b0c6bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-18-10-45-16-0-65037-27-17613-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790113300, "last_seen": 1790113300, "transport": "t", "ja3_hash": "7daaed28970ae70d216bb9e5234a4066", "ja3_variant_count": 1, "ja3_variants": [ "7daaed28970ae70d216bb9e5234a4066" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_6a5250d7bf78", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "6a5250d7bf78", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-65281-16-0-35-10-5-51-45-18-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791116980, "last_seen": 1791116980, "transport": "t", "ja3_hash": "de19e8a2a650bd604d48a1b015e77ecd", "ja3_variant_count": 1, "ja3_variants": [ "de19e8a2a650bd604d48a1b015e77ecd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_6b0b5ce87dcd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "6b0b5ce87dcd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-5-35-18-65281-23-10-16-0-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790241029, "last_seen": 1790241029, "transport": "t", "ja3_hash": "58c81548a279426355f83eedf8cf4771", "ja3_variant_count": 1, "ja3_variants": [ "58c81548a279426355f83eedf8cf4771" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_6d23c5bb3494", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "6d23c5bb3494", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-11-65281-35-17613-0-45-10-27-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788778477, "last_seen": 1788778477, "transport": "t", "ja3_hash": "71e89371657329227d45de94c5d7675e", "ja3_variant_count": 1, "ja3_variants": [ "71e89371657329227d45de94c5d7675e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_6f59f3d932ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "6f59f3d932ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-18-45-11-5-65037-10-51-0-35-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791103781, "last_seen": 1791103781, "transport": "t", "ja3_hash": "e4dad40df345da8a439b412e958d198e", "ja3_variant_count": 1, "ja3_variants": [ "e4dad40df345da8a439b412e958d198e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_70cb4a7ae286", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "70cb4a7ae286", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-45-13-27-0-10-35-11-5-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789686252, "last_seen": 1790157021, "transport": "t", "ja3_hash": "2c41b64a3cd9ce2deeff22d60b1ff0fb", "ja3_variant_count": 2, "ja3_variants": [ "2c41b64a3cd9ce2deeff22d60b1ff0fb", "2e8a83ac0c495b9c464d46f72afe1c53" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_71d4f9a4f5be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "71d4f9a4f5be", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-35-16-11-45-10-23-17613-65281-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790491737, "last_seen": 1790491737, "transport": "t", "ja3_hash": "00d07c1f17aa7522c7bd808f81e50ccd", "ja3_variant_count": 1, "ja3_variants": [ "00d07c1f17aa7522c7bd808f81e50ccd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_7563a8e651f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "7563a8e651f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-11-17513-0-27-16-51-65281-13-5-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791125844, "last_seen": 1791125844, "transport": "t", "ja3_hash": "27809a276b8017895749d0d16d57621f", "ja3_variant_count": 1, "ja3_variants": [ "27809a276b8017895749d0d16d57621f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_805314a60098", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "805314a60098", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-35-65281-11-0-16-51-18-5-65037-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791273107, "last_seen": 1791273107, "transport": "t", "ja3_hash": "a88f6a52ffe60e44d64a42b0ef81c400", "ja3_variant_count": 1, "ja3_variants": [ "a88f6a52ffe60e44d64a42b0ef81c400" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_8c6aea0734b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "8c6aea0734b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-65037-18-16-5-23-10-27-65281-51-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790945511, "last_seen": 1791277259, "transport": "t", "ja3_hash": "06d7897a5c38d77b8a0389aa499bfe1d", "ja3_variant_count": 2, "ja3_variants": [ "06d7897a5c38d77b8a0389aa499bfe1d", "d78955f2e980667c89ae939b67bfaabf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_9947b5cfe46d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "9947b5cfe46d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-65037-10-65281-0-17613-23-18-16-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789727227, "last_seen": 1789727227, "transport": "t", "ja3_hash": "0b00c6731d9c8d68f7b60d72dfec0ed8", "ja3_variant_count": 1, "ja3_variants": [ "0b00c6731d9c8d68f7b60d72dfec0ed8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_9a44247ce8c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "9a44247ce8c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51764-18-11-10-0-17613-23-65037-13-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789123233, "last_seen": 1789123233, "transport": "t", "ja3_hash": "16b3f8ae04bde51c73c1ac0d58e14e84", "ja3_variant_count": 1, "ja3_variants": [ "16b3f8ae04bde51c73c1ac0d58e14e84" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 26 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_9ddb9e5ff7c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "9ddb9e5ff7c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-0-27-35-10-23-5-16-65281-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789022288, "last_seen": 1789022288, "transport": "t", "ja3_hash": "b8d334d22d00f63bf8e6fd1aaae86585", "ja3_variant_count": 1, "ja3_variants": [ "b8d334d22d00f63bf8e6fd1aaae86585" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_a7e597d9490b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "a7e597d9490b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-0-11-27-65281-17613-10-5-16-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790712658, "last_seen": 1790712658, "transport": "t", "ja3_hash": "4eede9933b2afec3cfa9c625783ab31c", "ja3_variant_count": 1, "ja3_variants": [ "4eede9933b2afec3cfa9c625783ab31c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_ac1552ed0f06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "ac1552ed0f06", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-18-27-16-65281-65037-5-13-35-23-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791118029, "last_seen": 1791118029, "transport": "t", "ja3_hash": "53a3a9733bbfc8bd94acef2ae702a8fc", "ja3_variant_count": 1, "ja3_variants": [ "53a3a9733bbfc8bd94acef2ae702a8fc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_b5b57aaebced", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "b5b57aaebced", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-16-0-10-27-5-65281-23-18-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791030514, "last_seen": 1791030514, "transport": "t", "ja3_hash": "10cf40ba12c43b7320e89169f6ebeccf", "ja3_variant_count": 1, "ja3_variants": [ "10cf40ba12c43b7320e89169f6ebeccf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_b5f13c9b78b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "b5f13c9b78b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-5-16-18-11-13-45-65281-35-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789765105, "last_seen": 1789765105, "transport": "t", "ja3_hash": "93b278b345de14850883617cd691de3c", "ja3_variant_count": 1, "ja3_variants": [ "93b278b345de14850883617cd691de3c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_b76259042ae3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "b76259042ae3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-10-65281-35-45-5-11-27-65037-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790236526, "last_seen": 1791209796, "transport": "t", "ja3_hash": "9e9d1e429c3f7647077b03f9e6ea10c9", "ja3_variant_count": 2, "ja3_variants": [ "9e9d1e429c3f7647077b03f9e6ea10c9", "b13796f7ab59a01f6170c0653b8cbed1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_bde9645ef57e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "bde9645ef57e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-45-13-5-65037-23-18-35-17613-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789006036, "last_seen": 1789006036, "transport": "t", "ja3_hash": "ed2da7a4c27d4e4e82239039a5689752", "ja3_variant_count": 1, "ja3_variants": [ "ed2da7a4c27d4e4e82239039a5689752" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_c0c4d94b3b7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "c0c4d94b3b7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-5-23-65037-65281-10-45-16-27-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789689003, "last_seen": 1789689003, "transport": "t", "ja3_hash": "aca227ceb4ae9b412fe676051b6b9fe5", "ja3_variant_count": 1, "ja3_variants": [ "aca227ceb4ae9b412fe676051b6b9fe5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_c3d46a0c8334", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "c3d46a0c8334", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-17513-45-51-11-23-10-16-65281-0-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791105434, "last_seen": 1791105434, "transport": "t", "ja3_hash": "21cc27fb2e53814a1e06a87dfaa33ec6", "ja3_variant_count": 1, "ja3_variants": [ "21cc27fb2e53814a1e06a87dfaa33ec6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_c426f9468579", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "c426f9468579", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-5-35-65281-0-16-65037-45-11-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689985, "last_seen": 1789689985, "transport": "t", "ja3_hash": "532d60b10cc23b6650435e793e835592", "ja3_variant_count": 1, "ja3_variants": [ "532d60b10cc23b6650435e793e835592" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_c72f1eb75fb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "c72f1eb75fb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-16-10-23-65281-35-45-18-27-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789077197, "last_seen": 1789077197, "transport": "t", "ja3_hash": "d6b074ad347c2977dad3444b631ebc40", "ja3_variant_count": 1, "ja3_variants": [ "d6b074ad347c2977dad3444b631ebc40" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_c9df258bb0de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "c9df258bb0de", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-45-17613-13-35-11-23-0-65281-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790237463, "last_seen": 1790237463, "transport": "t", "ja3_hash": "612e13debe32e267d779ba73c1d44448", "ja3_variant_count": 1, "ja3_variants": [ "612e13debe32e267d779ba73c1d44448" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_d29b71a1bf2b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "d29b71a1bf2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-5-16-10-35-65037-65281-17613-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790268555, "last_seen": 1790268555, "transport": "t", "ja3_hash": "78a6793c28bdb32e2d7190c703b06507", "ja3_variant_count": 1, "ja3_variants": [ "78a6793c28bdb32e2d7190c703b06507" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_ea4c689e9819", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "ea4c689e9819", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-0-16-5-27-17613-11-35-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789168939, "last_seen": 1789168939, "transport": "t", "ja3_hash": "a12ab76f8918e33d1b3d683f2649a5bd", "ja3_variant_count": 1, "ja3_variants": [ "a12ab76f8918e33d1b3d683f2649a5bd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_f667d52c5961", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "f667d52c5961", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-65281-35-18-13-10-5-23-16-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790584384, "last_seen": 1790584384, "transport": "t", "ja3_hash": "4df434f5b327356142427bd2e8eb3bbf", "ja3_variant_count": 1, "ja3_variants": [ "4df434f5b327356142427bd2e8eb3bbf" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_fa04b2924c1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "fa04b2924c1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-27-5-17613-18-16-11-45-23-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790345265, "last_seen": 1790345265, "transport": "t", "ja3_hash": "5b31a67cc0d5f0938116478ccf223376", "ja3_variant_count": 1, "ja3_variants": [ "5b31a67cc0d5f0938116478ccf223376" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_227d5b3dec54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "227d5b3dec54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-5-45-10-27-0-11-65281-65037-35-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790029247, "last_seen": 1790029247, "transport": "t", "ja3_hash": "b606978faa1d2bf0a9ff24c52bb31367", "ja3_variant_count": 1, "ja3_variants": [ "b606978faa1d2bf0a9ff24c52bb31367" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_8a0d6ed7f771", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "8a0d6ed7f771", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-5-10-17613-65281-65037-23-18-27-0-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789974715, "last_seen": 1789974715, "transport": "t", "ja3_hash": "b5d57396ae56a0cf35e5ae78d477e50a", "ja3_variant_count": 1, "ja3_variants": [ "b5d57396ae56a0cf35e5ae78d477e50a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_8f36eae60f75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "8f36eae60f75", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-27-18-13-23-11-35-45-0-65281-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788802221, "last_seen": 1788802221, "transport": "t", "ja3_hash": "b7632eb8ebe2f870af3762b9cac91daa", "ja3_variant_count": 1, "ja3_variants": [ "b7632eb8ebe2f870af3762b9cac91daa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_9d313b82be93", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "9d313b82be93", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-10-13-18-11-27-17613-45-65037-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790730221, "last_seen": 1790730221, "transport": "t", "ja3_hash": "69894aee09f015a20cbc2fc081963c85", "ja3_variant_count": 1, "ja3_variants": [ "69894aee09f015a20cbc2fc081963c85" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_a9ee5d76bf67", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "a9ee5d76bf67", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-5-18-65037-27-13-23-65281-0-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789444005, "last_seen": 1789444005, "transport": "t", "ja3_hash": "aa948429f43a7c0c2bf41f8ced6ff98e", "ja3_variant_count": 1, "ja3_variants": [ "aa948429f43a7c0c2bf41f8ced6ff98e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_c26fda0fe285", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "c26fda0fe285", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-0-35-65037-17513-65281-5-27-11-10-51-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791141988, "last_seen": 1791141988, "transport": "t", "ja3_hash": "45989e8551171e67ea7a5c060b435ca4", "ja3_variant_count": 1, "ja3_variants": [ "45989e8551171e67ea7a5c060b435ca4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_d28aec9cdf66", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "d28aec9cdf66", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-11-18-17613-35-13-51764-65037-45-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789802667, "last_seen": 1789802667, "transport": "t", "ja3_hash": "049f1c5ac8dbe690821fb9146d778923", "ja3_variant_count": 1, "ja3_variants": [ "049f1c5ac8dbe690821fb9146d778923" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1513h1_8daaf6152771_be1a01622f4f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h1", "b": "8daaf6152771", "c": "be1a01622f4f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-45-18-27-16-23-65037-10-0-13-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790562068, "last_seen": 1790562068, "transport": "t", "ja3_hash": "bb4203a495f0e54059b3007475113308", "ja3_variant_count": 1, "ja3_variants": [ "bb4203a495f0e54059b3007475113308" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h1_8daaf6152771_da4309ae6ab6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h1", "b": "8daaf6152771", "c": "da4309ae6ab6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-5-65037-13-0-27-35-65281-16-23-18-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524499, "last_seen": 1790524499, "transport": "t", "ja3_hash": "8afdf299e85f9f4620405c59276dacd3", "ja3_variant_count": 1, "ja3_variants": [ "8afdf299e85f9f4620405c59276dacd3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_06a10152f8a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "06a10152f8a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-11-16-0-13-35-10-65281-45-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508425, "last_seen": 1788508425, "transport": "t", "ja3_hash": "e597622c390254be5e20b26f7fc0082b", "ja3_variant_count": 1, "ja3_variants": [ "e597622c390254be5e20b26f7fc0082b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_0fa377d9724a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "0fa377d9724a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-13-10-11-45-35-18-0-16-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788825891, "last_seen": 1788825891, "transport": "t", "ja3_hash": "2f3cf6432ec089939095139665e2ae1a", "ja3_variant_count": 1, "ja3_variants": [ "2f3cf6432ec089939095139665e2ae1a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_1a170867dc92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "1a170867dc92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-16-27-0-65281-65037-18-11-17613-23-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791110334, "last_seen": 1791110334, "transport": "t", "ja3_hash": "8846088003c190133992ebea4a5616cb", "ja3_variant_count": 1, "ja3_variants": [ "8846088003c190133992ebea4a5616cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_1ba7fb460e74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "1ba7fb460e74", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-16-27-13-5-23-35-0-18-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790205782, "last_seen": 1790205782, "transport": "t", "ja3_hash": "14eb23436c3ecb4d0f4d9b8c8d182617", "ja3_variant_count": 1, "ja3_variants": [ "14eb23436c3ecb4d0f4d9b8c8d182617" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_1fe8aebb8e66", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "1fe8aebb8e66", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-18-65037-11-23-10-27-0-45-35-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791311327, "last_seen": 1791311327, "transport": "t", "ja3_hash": "29a3e1dfc94ca814fd928a34baafd1f9", "ja3_variant_count": 1, "ja3_variants": [ "29a3e1dfc94ca814fd928a34baafd1f9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 9 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_2cac1018dc46", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "2cac1018dc46", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-45-0-23-18-17613-27-51764-35-5-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790532667, "last_seen": 1790532667, "transport": "t", "ja3_hash": "541abbd2feffeeb84bfb3e3447ed464a", "ja3_variant_count": 1, "ja3_variants": [ "541abbd2feffeeb84bfb3e3447ed464a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_301a7f33a1d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "301a7f33a1d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-0-11-13-17613-5-65281-65037-16-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789680465, "last_seen": 1789680465, "transport": "t", "ja3_hash": "2f18b9256a40489bbf9f6e7545886f0b", "ja3_variant_count": 1, "ja3_variants": [ "2f18b9256a40489bbf9f6e7545886f0b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_357eb5f276df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "357eb5f276df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-13-23-16-45-0-10-5-27-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790987548, "last_seen": 1790987548, "transport": "t", "ja3_hash": "6d2ad9f14cf779f5684dfc999cac3877", "ja3_variant_count": 1, "ja3_variants": [ "6d2ad9f14cf779f5684dfc999cac3877" ], "user_agents": { "Mozilla/5.0 (iPad; CPU OS 27_0_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/154.0.8037.55 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_68a2ff480094", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "68a2ff480094", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-65281-11-13-18-35-27-10-17613-0-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791201908, "last_seen": 1791201908, "transport": "t", "ja3_hash": "107ea3f1e869fb6b22fabb1f2adfa7c1", "ja3_variant_count": 1, "ja3_variants": [ "107ea3f1e869fb6b22fabb1f2adfa7c1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0": 25 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_6f2f4ae5f7e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "6f2f4ae5f7e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17513-27-65037-0-65281-35-16-10-18-13-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791162927, "last_seen": 1791162927, "transport": "t", "ja3_hash": "eac220d1eaf8ebe0967c194829b26fa2", "ja3_variant_count": 1, "ja3_variants": [ "eac220d1eaf8ebe0967c194829b26fa2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_78cfc88d2e3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "78cfc88d2e3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-0-17613-35-11-13-10-23-65037-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790660493, "last_seen": 1790660493, "transport": "t", "ja3_hash": "fa428d3c851d0baf6bbcb31381c69755", "ja3_variant_count": 1, "ja3_variants": [ "fa428d3c851d0baf6bbcb31381c69755" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_7cf5762362ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "7cf5762362ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-5-27-0-11-35-17613-65037-51764-16-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789647906, "last_seen": 1789647906, "transport": "t", "ja3_hash": "341f8b81054eda40c88abb632ac0f8f7", "ja3_variant_count": 1, "ja3_variants": [ "341f8b81054eda40c88abb632ac0f8f7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_abad038a6991", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "abad038a6991", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-27-10-65037-0-45-35-5-18-13-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790781288, "last_seen": 1790781288, "transport": "t", "ja3_hash": "6bab6cec32eafd81be6afeb37cb9f672", "ja3_variant_count": 1, "ja3_variants": [ "6bab6cec32eafd81be6afeb37cb9f672" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 28 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_b0592e302592", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "b0592e302592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-45-11-10-23-65281-27-5-65037-18-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788854157, "last_seen": 1791037178, "transport": "t", "ja3_hash": "4035fa4414370d6d9c9b84f17455eace", "ja3_variant_count": 2, "ja3_variants": [ "4035fa4414370d6d9c9b84f17455eace", "8d8754490638565586a954ada1aab2ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_b17ce82ed38e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "b17ce82ed38e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-0-51-18-10-23-65281-5-17513-35-45-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791142967, "last_seen": 1791142967, "transport": "t", "ja3_hash": "a60d211d9e8a2ba994b710215a9ba36a", "ja3_variant_count": 1, "ja3_variants": [ "a60d211d9e8a2ba994b710215a9ba36a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_bac2a1c1e56b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "bac2a1c1e56b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-27-35-5-10-13-11-23-16-51-0-45-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791262062, "last_seen": 1791262062, "transport": "t", "ja3_hash": "79c4e3d6c763da50a8b31c2ed29e201d", "ja3_variant_count": 1, "ja3_variants": [ "79c4e3d6c763da50a8b31c2ed29e201d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_bd3a3848fdb0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "bd3a3848fdb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-27-0-35-65037-16-5-51764-13-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789958110, "last_seen": 1789958110, "transport": "t", "ja3_hash": "c7e5da03ebc49512ca5d1974de1977ea", "ja3_variant_count": 1, "ja3_variants": [ "c7e5da03ebc49512ca5d1974de1977ea" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": true } }, { "hash": "t12d1513h2_8daaf6152771_beb5a499b1cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "beb5a499b1cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-10-27-0-16-11-65037-18-45-17613-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790730245, "last_seen": 1790730245, "transport": "t", "ja3_hash": "9ee226d063407dcb4195186c446d8661", "ja3_variant_count": 1, "ja3_variants": [ "9ee226d063407dcb4195186c446d8661" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_c7866f0cd557", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "c7866f0cd557", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-17613-11-10-18-13-5-23-0-16-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791162009, "last_seen": 1791162009, "transport": "t", "ja3_hash": "c901368569267b24a2e726d65f32423c", "ja3_variant_count": 1, "ja3_variants": [ "c901368569267b24a2e726d65f32423c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_cb696c2813db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "cb696c2813db", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-5-65037-18-11-13-45-65281-16-17613-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790219982, "last_seen": 1790219982, "transport": "t", "ja3_hash": "7569d0c240172cfc3f1385ea5e5bb542", "ja3_variant_count": 1, "ja3_variants": [ "7569d0c240172cfc3f1385ea5e5bb542" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_da4309ae6ab6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "da4309ae6ab6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-35-5-18-0-65037-65281-10-13-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788773484, "last_seen": 1789949418, "transport": "t", "ja3_hash": "8fc260bc70dff9a1e7476796ee03cee4", "ja3_variant_count": 2, "ja3_variants": [ "8fc260bc70dff9a1e7476796ee03cee4", "641b8dd8dc152347abd4040e0661a73a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_df0aeff010bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "df0aeff010bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-11-5-17613-18-35-13-27-16-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789218770, "last_seen": 1789218770, "transport": "t", "ja3_hash": "f9d5a338a09634467d5f064c49e6ad1d", "ja3_variant_count": 1, "ja3_variants": [ "f9d5a338a09634467d5f064c49e6ad1d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_e6e3530d9d20", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "e6e3530d9d20", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-0-16-10-65037-45-18-65281-11-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790615561, "last_seen": 1790615561, "transport": "t", "ja3_hash": "c5d4f8cc9e8f6493932e511608db1318", "ja3_variant_count": 1, "ja3_variants": [ "c5d4f8cc9e8f6493932e511608db1318" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_ee3867656e16", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "ee3867656e16", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-10-16-65037-51764-35-27-0-13-45-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791081382, "last_seen": 1791081382, "transport": "t", "ja3_hash": "2f29c06fb00cc7a68b845a6f3bac6985", "ja3_variant_count": 1, "ja3_variants": [ "2f29c06fb00cc7a68b845a6f3bac6985" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_f4c82965245c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "f4c82965245c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-35-17613-13-51764-18-65037-10-5-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791156460, "last_seen": 1791156460, "transport": "t", "ja3_hash": "4690ae41da89a78705e67d3be2a26fae", "ja3_variant_count": 1, "ja3_variants": [ "4690ae41da89a78705e67d3be2a26fae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_034c68a33c97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "034c68a33c97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-17613-11-5-45-10-65281-0-13-65037-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811255, "last_seen": 1788811255, "transport": "t", "ja3_hash": "7d2b6840fd26ea732aea4be5d6635321", "ja3_variant_count": 1, "ja3_variants": [ "7d2b6840fd26ea732aea4be5d6635321" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_9606b17be633", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "9606b17be633", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-23-5-35-27-13-10-18-0-17613-65281-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789045706, "last_seen": 1789045706, "transport": "t", "ja3_hash": "d6857f91825f3569975e9220d240e47e", "ja3_variant_count": 1, "ja3_variants": [ "d6857f91825f3569975e9220d240e47e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_c19393748373", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "c19393748373", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-10-45-51764-13-65037-0-17613-18-27-35-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790192106, "last_seen": 1790192106, "transport": "t", "ja3_hash": "c9bf85c62031c3e26465e0b0ea60add4", "ja3_variant_count": 1, "ja3_variants": [ "c9bf85c62031c3e26465e0b0ea60add4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_dc1b711a09d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "dc1b711a09d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-65281-65037-11-35-10-17613-27-23-13-51764-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790490099, "last_seen": 1790490099, "transport": "t", "ja3_hash": "7f61ea92854d6f46b716a062bcfec723", "ja3_variant_count": 1, "ja3_variants": [ "7f61ea92854d6f46b716a062bcfec723" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1514h1_8daaf6152771_c24a4c1957f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h1", "b": "8daaf6152771", "c": "c24a4c1957f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-11-65281-10-45-27-65037-13-16-35-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790654714, "last_seen": 1790654714, "transport": "t", "ja3_hash": "dd0b832e76ad5ba3ecdb0106991790ae", "ja3_variant_count": 1, "ja3_variants": [ "dd0b832e76ad5ba3ecdb0106991790ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_16b13b55c8d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "16b13b55c8d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-65281-45-11-65037-13-5-16-10-23-17513-18-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790953648, "last_seen": 1791290994, "transport": "t", "ja3_hash": "775650e5576568a6dee06a5dcb86150f", "ja3_variant_count": 3, "ja3_variants": [ "775650e5576568a6dee06a5dcb86150f", "47d3fbc218549d8c40e80f2a978b6f4b", "ef90b0142572a5309bc8d914ce2e68d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_348c9540015a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "348c9540015a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-51-16-23-35-0-5-13-17513-65037-27-10-43,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791269459, "last_seen": 1791269459, "transport": "t", "ja3_hash": "a61ae5c6374ce66709e1dc4ee539be60", "ja3_variant_count": 1, "ja3_variants": [ "a61ae5c6374ce66709e1dc4ee539be60" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_4e1db6c7caac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "4e1db6c7caac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-11-65281-18-10-17613-27-0-65037-35-45-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788775239, "last_seen": 1788775239, "transport": "t", "ja3_hash": "68910b09904f7659ab8c15317f324fe1", "ja3_variant_count": 1, "ja3_variants": [ "68910b09904f7659ab8c15317f324fe1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_553957de8a42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "553957de8a42", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-17613-0-16-35-10-65037-45-27-23-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790729008, "last_seen": 1790729008, "transport": "t", "ja3_hash": "d7e3449f117a7ab5d7fa3869499f1e5e", "ja3_variant_count": 1, "ja3_variants": [ "d7e3449f117a7ab5d7fa3869499f1e5e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_5e5f3aa3132e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "5e5f3aa3132e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-16-17613-11-5-10-27-35-65281-45-0-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790608206, "last_seen": 1791247242, "transport": "t", "ja3_hash": "55b0a0cb4fdacc2d31ffb47d1b91fc60", "ja3_variant_count": 2, "ja3_variants": [ "55b0a0cb4fdacc2d31ffb47d1b91fc60", "d6eb3fea5654b77c2faab80b39bf5448" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_6555cf59e565", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "6555cf59e565", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-0-11-5-17613-16-10-23-65037-45-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790823165, "last_seen": 1790823165, "transport": "t", "ja3_hash": "7d4255de0ca686f2a53a9efa2a21dfc3", "ja3_variant_count": 1, "ja3_variants": [ "7d4255de0ca686f2a53a9efa2a21dfc3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_957f558830fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "957f558830fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-16-27-11-65281-5-35-51-65037-10-45-17513-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106303, "last_seen": 1791106303, "transport": "t", "ja3_hash": "7cb6dba80707573400d61417bfdf0b89", "ja3_variant_count": 1, "ja3_variants": [ "7cb6dba80707573400d61417bfdf0b89" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_a1b5bb7c1aaa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "a1b5bb7c1aaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-17513-23-35-5-27-65037-45-18-10-13-65281-16,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1791102943, "last_seen": 1791106781, "transport": "t", "ja3_hash": "e5d7c45c2a2998087de464aa71013c28", "ja3_variant_count": 2, "ja3_variants": [ "e5d7c45c2a2998087de464aa71013c28", "b8db4787e63f5bac64f21bd4d77d6cfa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_a8e657147967", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "a8e657147967", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-16-10-5-45-65281-17613-11-35-27-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790628719, "last_seen": 1790628719, "transport": "t", "ja3_hash": "84616abc7ea421c0279976df7ee99c9a", "ja3_variant_count": 1, "ja3_variants": [ "84616abc7ea421c0279976df7ee99c9a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 9 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_c24a4c1957f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "c24a4c1957f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-65037-16-35-65281-11-45-13-18-23-5-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790220416, "last_seen": 1790220416, "transport": "t", "ja3_hash": "eb04b4eedc772063b9d5718549c63e39", "ja3_variant_count": 1, "ja3_variants": [ "eb04b4eedc772063b9d5718549c63e39" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_cc487cb2d726", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "cc487cb2d726", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-17613-13-10-5-0-65037-18-45-27-16-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788774543, "last_seen": 1791134319, "transport": "t", "ja3_hash": "9386876b8596d99c227c815ef0d72f00", "ja3_variant_count": 3, "ja3_variants": [ "9386876b8596d99c227c815ef0d72f00", "3483d6f88b48e9d1fe8aea289827e3c8", "0b453354aa8240c073b36c908c7bef9d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_d777c98f05ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "d777c98f05ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-11-10-45-17613-23-65281-13-27-65037-18-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791159562, "last_seen": 1791159562, "transport": "t", "ja3_hash": "63da1cd092d18159888b64a0e567de48", "ja3_variant_count": 1, "ja3_variants": [ "63da1cd092d18159888b64a0e567de48" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 84 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_da78366a3064", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "da78366a3064", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-5-17613-11-65281-10-0-65037-35-45-16-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788730260, "last_seen": 1788730260, "transport": "t", "ja3_hash": "d2bde246f62db6c9d5cef7ab9b1c2a66", "ja3_variant_count": 1, "ja3_variants": [ "d2bde246f62db6c9d5cef7ab9b1c2a66" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_e49a96211ad6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "e49a96211ad6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-0-17613-10-65281-18-16-45-35-13-27-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791299742, "last_seen": 1791299742, "transport": "t", "ja3_hash": "66e343777b409943f739df1f02cbd678", "ja3_variant_count": 1, "ja3_variants": [ "66e343777b409943f739df1f02cbd678" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 71 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_e6542651794b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "e6542651794b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-10-65281-23-65037-0-5-45-18-17513-13-16-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791275140, "last_seen": 1791275140, "transport": "t", "ja3_hash": "4fb3b51adfd3cf46db94a8fff3cb7ce9", "ja3_variant_count": 1, "ja3_variants": [ "4fb3b51adfd3cf46db94a8fff3cb7ce9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_fd1280aed873", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "fd1280aed873", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-5-16-18-65281-10-23-65037-17613-13-45-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788943298, "last_seen": 1790811091, "transport": "t", "ja3_hash": "1fb350127c623e631d268d0443e710bd", "ja3_variant_count": 2, "ja3_variants": [ "1fb350127c623e631d268d0443e710bd", "000833e71c8113d5cf1570a4a4b10c75" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_fd144912618e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "fd144912618e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-0-65037-17613-5-16-45-51764-35-10-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790948083, "last_seen": 1790948083, "transport": "t", "ja3_hash": "88dc85d3d66ef7e9d2d9a9322ef7a220", "ja3_variant_count": 1, "ja3_variants": [ "88dc85d3d66ef7e9d2d9a9322ef7a220" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d151500_8daaf6152771_772913465964", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151500", "b": "8daaf6152771", "c": "772913465964", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17513-35-5-13-18-0-51-11-65037-45-23-65281-27-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791142252, "last_seen": 1791142252, "transport": "t", "ja3_hash": "0216ffe79049f816c76ebf1b5e740e9e", "ja3_variant_count": 1, "ja3_variants": [ "0216ffe79049f816c76ebf1b5e740e9e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_32f48254f361", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "32f48254f361", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-0-16-17513-18-45-65037-5-35-11-65281-27-51-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791103014, "last_seen": 1791289930, "transport": "t", "ja3_hash": "fca69dd918af6d909a3374a1157155a4", "ja3_variant_count": 2, "ja3_variants": [ "fca69dd918af6d909a3374a1157155a4", "6b9bdafc9242e0e1869746e059efda46" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_772913465964", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "772913465964", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-65281-17513-10-13-45-0-27-51-18-23-11-16-5,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790751374, "last_seen": 1791260995, "transport": "t", "ja3_hash": "fedb72cb5863d6d819dfc5dca2c4a6a1", "ja3_variant_count": 3, "ja3_variants": [ "fedb72cb5863d6d819dfc5dca2c4a6a1", "0dee690834bbdb737de464e6fe8bcdc3", "b2a4b4f0932e3ac94079973979a78ca8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_bcf02e9d7faf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "bcf02e9d7faf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-27-13-45-51764-0-18-65037-5-10-16-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790985421, "last_seen": 1790985421, "transport": "t", "ja3_hash": "959d454109d858b69db879a9586675b1", "ja3_variant_count": 1, "ja3_variants": [ "959d454109d858b69db879a9586675b1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_e6df5a95f7d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "e6df5a95f7d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-11-45-17613-16-13-65281-0-18-35-5-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1788788689, "last_seen": 1791170680, "transport": "t", "ja3_hash": "9660e281566a10a6b2b97a6af1cade84", "ja3_variant_count": 7, "ja3_variants": [ "9660e281566a10a6b2b97a6af1cade84", "d51179ca9a9332b200bc769fcae30e71", "2218a9b69f417c38a7c3f4e9cfdf8eab", "bbe290414a86cf08fc46639432cb48b8", "8a3fe21a98d4827eb2eb842cb10612c6", "3959109c7077b5684371c94890824652", "1560f5486e7df91801c6fd7078fbf047" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1516h2_8daaf6152771_16ffca02f361", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1516h2", "b": "8daaf6152771", "c": "16ffca02f361", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-13-0-65281-51764-45-10-18-65037-35-16-5-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789728400, "last_seen": 1791017583, "transport": "t", "ja3_hash": "de91525e0c93fc47d6c6fd2980b8514a", "ja3_variant_count": 2, "ja3_variants": [ "de91525e0c93fc47d6c6fd2980b8514a", "ce978816b32ce67ac5c60ec41c3d9943" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d1516h2_8daaf6152771_a7a4f9d7bf87", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1516h2", "b": "8daaf6152771", "c": "a7a4f9d7bf87", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-65281-13-45-16-65037-18-5-51764-10-0-23-27-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790966493, "last_seen": 1791115467, "transport": "t", "ja3_hash": "b78c727d37b7606fad8f81a04d08ef92", "ja3_variant_count": 2, "ja3_variants": [ "b78c727d37b7606fad8f81a04d08ef92", "34302a362c0c0c9b433e0a5c88eaa473" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1610h2_46e7e9700bed_4a065df55c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1610h2", "b": "46e7e9700bed", "c": "4a065df55c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-10,0-23-65281-10-11-16-5-34-18-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790097725, "last_seen": 1790097725, "transport": "t", "ja3_hash": "4c471c84400422258fd928fae23d6a6f", "ja3_variant_count": 1, "ja3_variants": [ "4c471c84400422258fd928fae23d6a6f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1610h2_86a278354501_4a065df55c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1610h2", "b": "86a278354501", "c": "4a065df55c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 36, "first_seen": 1788450094, "last_seen": 1790714937, "transport": "t", "ja3_hash": "fbaa1a1e4e845f7211a0ac098415e94a", "ja3_variant_count": 1, "ja3_variants": [ "fbaa1a1e4e845f7211a0ac098415e94a" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 8312, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1611h2_46e7e9700bed_09c57bba7bb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1611h2", "b": "46e7e9700bed", "c": "09c57bba7bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1790102140, "last_seen": 1790576433, "transport": "t", "ja3_hash": "da6223360fe60bf6674e8061831244b8", "ja3_variant_count": 2, "ja3_variants": [ "da6223360fe60bf6674e8061831244b8", "1a6202bd9e4941aa077bce78a7ae00a8" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 304 }, "ua_disagreement": false } }, { "hash": "t12d1611h2_86a278354501_09c57bba7bb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1611h2", "b": "86a278354501", "c": "09c57bba7bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 91, "first_seen": 1787463993, "last_seen": 1791088158, "transport": "t", "ja3_hash": "0f722adfce1739b8c8c0b680b6543606", "ja3_variant_count": 1, "ja3_variants": [ "0f722adfce1739b8c8c0b680b6543606" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 22, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 100, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0": 12 }, "ua_disagreement": false } }, { "hash": "t12d170300_5b57614c22b0_27e267d15e11", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d170300", "b": "5b57614c22b0", "c": "27e267d15e11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789774507, "last_seen": 1789774507, "transport": "t", "ja3_hash": "f3391b25c34873037010ee8958aa77df", "ja3_variant_count": 1, "ja3_variants": [ "f3391b25c34873037010ee8958aa77df" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3964.90 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1709h2_5b57614c22b0_19c4b027752a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1709h2", "b": "5b57614c22b0", "c": "19c4b027752a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 55, "first_seen": 1787569173, "last_seen": 1790535914, "transport": "t", "ja3_hash": "6018cbd8d1b575a5c5cd2caf85dba92e", "ja3_variant_count": 1, "ja3_variants": [ "6018cbd8d1b575a5c5cd2caf85dba92e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3521.44 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3841.60 Safari/537.36": 2, "Mozilla/5.0 (Android 10; Mobile; rv:140.0) Gecko/140.0 Firefox/140.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1710h2_5b57614c22b0_4a065df55c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1710h2", "b": "5b57614c22b0", "c": "4a065df55c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 105, "first_seen": 1787547170, "last_seen": 1791207820, "transport": "t", "ja3_hash": "fd9f831a986172bfdd6979a2b8839ba6", "ja3_variant_count": 1, "ja3_variants": [ "fd9f831a986172bfdd6979a2b8839ba6" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3565.44 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3481.96 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 76 }, "ua_disagreement": false } }, { "hash": "t12d1710h2_5b57614c22b0_abcdc00e6c32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (abcdc00e6c32) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d1710h2", "b": "5b57614c22b0", "c": "abcdc00e6c32", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789366596, "last_seen": 1789366598, "transport": "t", "ja3_hash": "9829fc24416b4e637cb294ff5c7e7c1c", "ja3_variant_count": 1, "ja3_variants": [ "9829fc24416b4e637cb294ff5c7e7c1c" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d1711ht_5b57614c22b0_09c57bba7bb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1711ht", "b": "5b57614c22b0", "c": "09c57bba7bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 137, "first_seen": 1787668183, "last_seen": 1791112206, "transport": "t", "ja3_hash": "2ad6edab91151fc85f04312c39a62027", "ja3_variant_count": 1, "ja3_variants": [ "2ad6edab91151fc85f04312c39a62027" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0": 54, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0": 6 }, "ua_disagreement": false } }, { "hash": "t12d1810h2_e8a523a41297_4a065df55c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1810h2", "b": "e8a523a41297", "c": "4a065df55c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 182, "first_seen": 1787706303, "last_seen": 1788610444, "transport": "t", "ja3_hash": "ad287ce5cc6a0032b1ea59066c13f671", "ja3_variant_count": 1, "ja3_variants": [ "ad287ce5cc6a0032b1ea59066c13f671" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 11115 }, "ua_disagreement": false } }, { "hash": "t12d1811h2_e8a523a41297_09c57bba7bb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1811h2", "b": "e8a523a41297", "c": "09c57bba7bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 88, "first_seen": 1787588561, "last_seen": 1788633158, "transport": "t", "ja3_hash": "e60d029eb5e97304e8aa6aaab1090b83", "ja3_variant_count": 1, "ja3_variants": [ "e60d029eb5e97304e8aa6aaab1090b83" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 7379 }, "ua_disagreement": false } }, { "hash": "t12d2010h2_a09f3c656075_fdfedcf8c354", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d2010h2", "b": "a09f3c656075", "c": "fdfedcf8c354", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 139, "first_seen": 1787488748, "last_seen": 1791225779, "transport": "t", "ja3_hash": "eb9b1be313ddd3f1cbbdb89f6efbc784", "ja3_variant_count": 1, "ja3_variants": [ "eb9b1be313ddd3f1cbbdb89f6efbc784" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS/151.0.4129.72 Version/26.0 Mobile/15E148 Safari/604.1": 69, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.15": 85, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 48 }, "ua_disagreement": false } }, { "hash": "t12i1009h2_61a7ad8aa9b6_b2174a2ffc38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1009h2", "b": "61a7ad8aa9b6", "c": "b2174a2ffc38", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-5-11-35-16-45-23-13-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791298202, "last_seen": 1791298202, "transport": "t", "ja3_hash": "ce4a6791282f1320132edaa2ec9a37f3", "ja3_variant_count": 1, "ja3_variants": [ "ce4a6791282f1320132edaa2ec9a37f3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 (compatible; AionBot/1.0)": 5 }, "ua_disagreement": false } }, { "hash": "t12i150100_8daaf6152771_d57af3c6d519", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150100", "b": "8daaf6152771", "c": "d57af3c6d519", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 1, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 195, "first_seen": 1787448797, "last_seen": 1791313210, "transport": "t", "ja3_hash": "89cab90f953fb5d2c8103af10c53d7c3", "ja3_variant_count": 1, "ja3_variants": [ "89cab90f953fb5d2c8103af10c53d7c3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 25, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://bytedance.sg.larkoffice.com/docx/K5bxdypulop3IIxrJb0lO": 9, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 64 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_1b12d417929b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "1b12d417929b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1790040999, "last_seen": 1791240700, "transport": "t", "ja3_hash": "b02a4116df4a3c150f9801e0de653826", "ja3_variant_count": 1, "ja3_variants": [ "b02a4116df4a3c150f9801e0de653826" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_1d37bdd44634", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "1d37bdd44634", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 17, "first_seen": 1787772275, "last_seen": 1790933604, "transport": "t", "ja3_hash": "f1eb9d462739cb2a7fd531dcb55943a6", "ja3_variant_count": 1, "ja3_variants": [ "f1eb9d462739cb2a7fd531dcb55943a6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 3, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 3 }, "ua_disagreement": true } }, { "hash": "t12i150200_8daaf6152771_200cea0bc636", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "200cea0bc636", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 16, "first_seen": 1787674295, "last_seen": 1791109625, "transport": "t", "ja3_hash": "c513353fe49c78206e817738081a86ae", "ja3_variant_count": 3, "ja3_variants": [ "c513353fe49c78206e817738081a86ae", "76ab730acc1aba7659d5d266aaa4e17c", "95195515b96480b9417bb4015491fc7e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 2 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_2d8ee407ef00", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "2d8ee407ef00", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 9, "first_seen": 1788764157, "last_seen": 1791240847, "transport": "t", "ja3_hash": "0b43f677cafd1fed1c913bde73bb8314", "ja3_variant_count": 1, "ja3_variants": [ "0b43f677cafd1fed1c913bde73bb8314" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Vivaldi/7.1": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_62ea8037d6b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "62ea8037d6b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1790025384, "last_seen": 1791286652, "transport": "t", "ja3_hash": "f82c8a82ce851dfe25075e4a626689bb", "ja3_variant_count": 1, "ja3_variants": [ "f82c8a82ce851dfe25075e4a626689bb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 155 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_73956c55d638", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "73956c55d638", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 16, "first_seen": 1788336878, "last_seen": 1791247271, "transport": "t", "ja3_hash": "4aa935ec65fdd495c81cbaeac2499901", "ja3_variant_count": 2, "ja3_variants": [ "4aa935ec65fdd495c81cbaeac2499901", "f823b5443609871a2e5ee414eedc7bbb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_98761281d3c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "98761281d3c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1787783221, "last_seen": 1791244251, "transport": "t", "ja3_hash": "3000731ddca698cd45570d7f24243a75", "ja3_variant_count": 2, "ja3_variants": [ "3000731ddca698cd45570d7f24243a75", "fe1cb1f64d2eded30032ef40ea364e18" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_b2316c06389a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "b2316c06389a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1788006863, "last_seen": 1791299124, "transport": "t", "ja3_hash": "1b1ceaa7d1c8c7d106122fe45364338b", "ja3_variant_count": 2, "ja3_variants": [ "1b1ceaa7d1c8c7d106122fe45364338b", "6660e1fe3f82bde9836f32937b7aa87b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12i150200_8daaf6152771_c798d119e9f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "c798d119e9f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1787818315, "last_seen": 1790998773, "transport": "t", "ja3_hash": "953d501e7688dcc5c70dfa80cdfb910c", "ja3_variant_count": 1, "ja3_variants": [ "953d501e7688dcc5c70dfa80cdfb910c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_c899f8114fe8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "c899f8114fe8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 60, "first_seen": 1787461475, "last_seen": 1791252970, "transport": "t", "ja3_hash": "9e1503afa013a12182c5d11ea5aa892a", "ja3_variant_count": 2, "ja3_variants": [ "9e1503afa013a12182c5d11ea5aa892a", "0fec841b4a5645ac9d03c358c060ed58" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_d1444cee9603", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "d1444cee9603", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1787660708, "last_seen": 1791302056, "transport": "t", "ja3_hash": "5a8d281390ebb1805ba0d824d6da6dca", "ja3_variant_count": 1, "ja3_variants": [ "5a8d281390ebb1805ba0d824d6da6dca" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_dc539c0f9221", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "dc539c0f9221", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1789694709, "last_seen": 1790522747, "transport": "t", "ja3_hash": "54c7408ec6a15741873e5f8cc5105053", "ja3_variant_count": 1, "ja3_variants": [ "54c7408ec6a15741873e5f8cc5105053" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_e1cadbf12fd7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "e1cadbf12fd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 15, "first_seen": 1788345452, "last_seen": 1791207383, "transport": "t", "ja3_hash": "5b43de1c4f53f7d48e3fb4939d56871d", "ja3_variant_count": 1, "ja3_variants": [ "5b43de1c4f53f7d48e3fb4939d56871d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.5.3 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_f0f99180c131", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "f0f99180c131", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1788533523, "last_seen": 1791121244, "transport": "t", "ja3_hash": "ff19204ce1872ddbee45cef90e5a9a56", "ja3_variant_count": 2, "ja3_variants": [ "ff19204ce1872ddbee45cef90e5a9a56", "3ba164134aec11f91acfc10662c2f49c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_f21aec6009d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "f21aec6009d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 9, "first_seen": 1787693379, "last_seen": 1791250461, "transport": "t", "ja3_hash": "4feb8af7b0168bce91763b1a2003306a", "ja3_variant_count": 1, "ja3_variants": [ "4feb8af7b0168bce91763b1a2003306a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 20, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1502h2_8daaf6152771_62ea8037d6b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1502h2", "b": "8daaf6152771", "c": "62ea8037d6b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 16, "first_seen": 1787847890, "last_seen": 1791135130, "transport": "t", "ja3_hash": "f647134690d16ea277d1940f6d10ec9b", "ja3_variant_count": 1, "ja3_variants": [ "f647134690d16ea277d1940f6d10ec9b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_045ae949cf0c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "045ae949cf0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1788452710, "last_seen": 1791152687, "transport": "t", "ja3_hash": "c2bf86a009d42dd9c0371ae6474014f5", "ja3_variant_count": 4, "ja3_variants": [ "c2bf86a009d42dd9c0371ae6474014f5", "3af62d47203816a27bd33098dce4dd8b", "8361f30f628c6238eff033899d878e3b", "b151761ffa7f87541d3782f1914c4594" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1, "slack/26.08.40.0.90016107 (samsung SM-S916B; Android 16; store com.android.vending)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_04b14dc380a8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "04b14dc380a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790034661, "last_seen": 1790034661, "transport": "t", "ja3_hash": "45714cbd0633d51c8e11ec871ca9ae42", "ja3_variant_count": 1, "ja3_variants": [ "45714cbd0633d51c8e11ec871ca9ae42" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_0cfc98c9b22f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "0cfc98c9b22f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790306999, "last_seen": 1790571147, "transport": "t", "ja3_hash": "86a38196d3c6095658e51b15c133fe5e", "ja3_variant_count": 2, "ja3_variants": [ "86a38196d3c6095658e51b15c133fe5e", "20cea4aeab0c63ee5065e378df3ae6ab" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_0dcb31cc573b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "0dcb31cc573b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788362958, "last_seen": 1791219044, "transport": "t", "ja3_hash": "0d3d5e345622da4806b302fe98d6f6ff", "ja3_variant_count": 2, "ja3_variants": [ "0d3d5e345622da4806b302fe98d6f6ff", "7893d07477fa3c75ccb6f6d27f220a5b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_0efd77169a05", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "0efd77169a05", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790643381, "last_seen": 1790998774, "transport": "t", "ja3_hash": "e23bc7d495d4dd5a4bcd4721b11bf363", "ja3_variant_count": 1, "ja3_variants": [ "e23bc7d495d4dd5a4bcd4721b11bf363" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 9 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_0f31f4e7d228", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "0f31f4e7d228", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788656780, "last_seen": 1789755814, "transport": "t", "ja3_hash": "0176e24cd2d89bf72337547d90c9319c", "ja3_variant_count": 1, "ja3_variants": [ "0176e24cd2d89bf72337547d90c9319c" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_0fbbb947d549", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "0fbbb947d549", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656665, "last_seen": 1789656665, "transport": "t", "ja3_hash": "50013c0836f7ae34d9e5bbdf60a7df14", "ja3_variant_count": 1, "ja3_variants": [ "50013c0836f7ae34d9e5bbdf60a7df14" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_0fd8f24c059b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "0fd8f24c059b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789703307, "last_seen": 1791088539, "transport": "t", "ja3_hash": "052d5aa392a6a06d80df186f07b77dce", "ja3_variant_count": 2, "ja3_variants": [ "052d5aa392a6a06d80df186f07b77dce", "9af6b539c6edf5472f03b65eec31c87b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_14b108ac7c7c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "14b108ac7c7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 14, "first_seen": 1788776668, "last_seen": 1791140516, "transport": "t", "ja3_hash": "d4cc8f57869e6a687ebeffe64d875cd6", "ja3_variant_count": 4, "ja3_variants": [ "d4cc8f57869e6a687ebeffe64d875cd6", "71756d250cc23b02d5ea8c2553945814", "63b2057f92863ba3efb908057d5cf677", "529b97421d85336bd33a6d363d2efc78" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_20608c9b2484", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "20608c9b2484", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788962458, "last_seen": 1791294032, "transport": "t", "ja3_hash": "bc3f8989254263cee9f52da4bdf3390c", "ja3_variant_count": 3, "ja3_variants": [ "bc3f8989254263cee9f52da4bdf3390c", "a4790fb972cb1d02ad91e3e2ed7cacc5", "3a5f0cb3ebe5598e56d0b2c48ed86845" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (iPad; CPU OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_243a59383c1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "243a59383c1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788811875, "last_seen": 1791219044, "transport": "t", "ja3_hash": "c0ab34aa3edec978d375f7aa75fd326a", "ja3_variant_count": 2, "ja3_variants": [ "c0ab34aa3edec978d375f7aa75fd326a", "8ff5796c451587aeeab7a0bd35e8873c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_252de785e786", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "252de785e786", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790897619, "last_seen": 1790897619, "transport": "t", "ja3_hash": "5388c0b73ec6a4aab813fc6a91088c51", "ja3_variant_count": 1, "ja3_variants": [ "5388c0b73ec6a4aab813fc6a91088c51" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_2968ded16f02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "2968ded16f02", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790206659, "last_seen": 1790206659, "transport": "t", "ja3_hash": "6fcf2a2c9a341abed5b22df606fe54eb", "ja3_variant_count": 1, "ja3_variants": [ "6fcf2a2c9a341abed5b22df606fe54eb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_29f566491819", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "29f566491819", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790239284, "last_seen": 1790870294, "transport": "t", "ja3_hash": "81c7795fb70bdb9c186450b559702994", "ja3_variant_count": 1, "ja3_variants": [ "81c7795fb70bdb9c186450b559702994" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_2aa3faa7b11f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "2aa3faa7b11f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 9, "first_seen": 1789029046, "last_seen": 1790795796, "transport": "t", "ja3_hash": "e1d75f0067c756f4fa4574be04d79d6e", "ja3_variant_count": 3, "ja3_variants": [ "e1d75f0067c756f4fa4574be04d79d6e", "5218cd15fbb9d6c726e5ea766f8d0476", "9c65e52c6e63aad3c12bb2375da88879" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_2c7b8162415f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "2c7b8162415f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789451917, "last_seen": 1790309697, "transport": "t", "ja3_hash": "de04263c7e60e892459b04fef4eed9d7", "ja3_variant_count": 2, "ja3_variants": [ "de04263c7e60e892459b04fef4eed9d7", "f3b6ebded141b6d26fe3d92e0520c28e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_2e2b5e26d20b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "2e2b5e26d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789028282, "last_seen": 1790195295, "transport": "t", "ja3_hash": "7430343282e1363a12e7176cc8b21194", "ja3_variant_count": 2, "ja3_variants": [ "7430343282e1363a12e7176cc8b21194", "dbd4c5fae36a4a98970aeb719c0da16b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_33fe7f58ec7d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "33fe7f58ec7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789649871, "last_seen": 1790905489, "transport": "t", "ja3_hash": "897962bd7c702c7d4d62bbdda0d115b2", "ja3_variant_count": 1, "ja3_variants": [ "897962bd7c702c7d4d62bbdda0d115b2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_3dded7a9aad6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "3dded7a9aad6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789587731, "last_seen": 1790083710, "transport": "t", "ja3_hash": "55f73612400bbf1c5f45602725f159eb", "ja3_variant_count": 2, "ja3_variants": [ "55f73612400bbf1c5f45602725f159eb", "e0caf4e5edf2d724fbdc317e54c4f36b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_40aa50c61343", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "40aa50c61343", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 7, "first_seen": 1788849164, "last_seen": 1790424892, "transport": "t", "ja3_hash": "65d33b6f18c16a9e78a91345f577eaa5", "ja3_variant_count": 4, "ja3_variants": [ "65d33b6f18c16a9e78a91345f577eaa5", "5f41f7e7f9e38749a4b5581baafec9eb", "4e8fa0dedce14b6828a3ed4c237eace6", "bfaf0473060983100f49d2c333b8467c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_43d44e58c561", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "43d44e58c561", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788454618, "last_seen": 1790264425, "transport": "t", "ja3_hash": "c566cadecd5a212b723054f3d1d1438a", "ja3_variant_count": 1, "ja3_variants": [ "c566cadecd5a212b723054f3d1d1438a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_466d65bc1bee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "466d65bc1bee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790090652, "last_seen": 1790090652, "transport": "t", "ja3_hash": "6e7dc0bd4d7a777d900bb38711c2165d", "ja3_variant_count": 1, "ja3_variants": [ "6e7dc0bd4d7a777d900bb38711c2165d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_46bea0c559da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "46bea0c559da", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789813433, "last_seen": 1790497725, "transport": "t", "ja3_hash": "3b1f25157bf36a8ae1cb21787c7d1fd7", "ja3_variant_count": 3, "ja3_variants": [ "3b1f25157bf36a8ae1cb21787c7d1fd7", "7dcfea75bb25ae022e1f3c5d7228b7ed", "8fc0daab40d2bb09858ecb58b557fbf9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_56408039377a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "56408039377a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790226824, "last_seen": 1790226824, "transport": "t", "ja3_hash": "c4cc2cb261337830c285e5a0550e9afd", "ja3_variant_count": 1, "ja3_variants": [ "c4cc2cb261337830c285e5a0550e9afd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_5a5c3e855d18", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "5a5c3e855d18", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789005254, "last_seen": 1790655122, "transport": "t", "ja3_hash": "ee7aa23c71d242c9a6d4770824c3ce5b", "ja3_variant_count": 2, "ja3_variants": [ "ee7aa23c71d242c9a6d4770824c3ce5b", "2356877ba5d11642b1951ec375cb368d" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": true } }, { "hash": "t12i150300_8daaf6152771_5cbb9ad5c6b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "5cbb9ad5c6b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788844388, "last_seen": 1791112945, "transport": "t", "ja3_hash": "eaab9e9f64a508d05a09f2f9a7a70494", "ja3_variant_count": 2, "ja3_variants": [ "eaab9e9f64a508d05a09f2f9a7a70494", "ed16cf74c4a9faefdbdcaf29305ff2f9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_5f876dcec62d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "5f876dcec62d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790596046, "last_seen": 1790890975, "transport": "t", "ja3_hash": "7f685e0185b9e57d1c711fb90d868ce5", "ja3_variant_count": 2, "ja3_variants": [ "7f685e0185b9e57d1c711fb90d868ce5", "d622b53ec3fb7b021316f1fb9213f674" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 44 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_60d39bbf57b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "60d39bbf57b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787892672, "last_seen": 1789754322, "transport": "t", "ja3_hash": "20a0f8161eff117796a517d7fad2de0c", "ja3_variant_count": 2, "ja3_variants": [ "20a0f8161eff117796a517d7fad2de0c", "da7974d09789764ce63574abd6229be0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_61b38f058b9c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "61b38f058b9c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788454612, "last_seen": 1790316094, "transport": "t", "ja3_hash": "62fbd475d772346b2b9012dac4e57171", "ja3_variant_count": 2, "ja3_variants": [ "62fbd475d772346b2b9012dac4e57171", "04ff28f7af5f638fa1950927ce47e83f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 11 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_63c1024017c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "63c1024017c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789403471, "last_seen": 1790819989, "transport": "t", "ja3_hash": "4893de106d74172b08188a79f38b41cd", "ja3_variant_count": 3, "ja3_variants": [ "4893de106d74172b08188a79f38b41cd", "47385c5d6a33cbdbcff7725be1276aa0", "3adc0a2a25e88c430323da5b49745b63" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_69f0ea65a575", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "69f0ea65a575", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788760119, "last_seen": 1791241332, "transport": "t", "ja3_hash": "ac8770c370691d0603e59b3c6c480b6a", "ja3_variant_count": 2, "ja3_variants": [ "ac8770c370691d0603e59b3c6c480b6a", "61f5979e7a243b5a95da0c9bd4182081" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12i150300_8daaf6152771_6aa674dfc862", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "6aa674dfc862", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789112199, "last_seen": 1790527876, "transport": "t", "ja3_hash": "6766b026e3784338edf635dbb00b0ab1", "ja3_variant_count": 1, "ja3_variants": [ "6766b026e3784338edf635dbb00b0ab1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_703600d2ceac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "703600d2ceac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788814088, "last_seen": 1791213741, "transport": "t", "ja3_hash": "10a6b5981dd3d01d1a84a91d9feeb302", "ja3_variant_count": 2, "ja3_variants": [ "10a6b5981dd3d01d1a84a91d9feeb302", "faecdb5a8eee442973499e5beeb0c92c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_72eff015c141", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "72eff015c141", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788888583, "last_seen": 1788888583, "transport": "t", "ja3_hash": "a9a237393a348e8b02140537b64b47e0", "ja3_variant_count": 1, "ja3_variants": [ "a9a237393a348e8b02140537b64b47e0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_731509cc7d31", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "731509cc7d31", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788795817, "last_seen": 1791031733, "transport": "t", "ja3_hash": "2f2b9562ebc8910f9124a7ebd7440c6f", "ja3_variant_count": 3, "ja3_variants": [ "2f2b9562ebc8910f9124a7ebd7440c6f", "422f678055bd7041716ead54510398f0", "f801c7e9d20509ecbf03999a2e767882" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.5 Mobile/15A372 Safari/604.1": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_756413db9cc9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "756413db9cc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790191229, "last_seen": 1790562852, "transport": "t", "ja3_hash": "48b9d0037120ecd0f9f777f60ff52117", "ja3_variant_count": 1, "ja3_variants": [ "48b9d0037120ecd0f9f777f60ff52117" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_7ab4f4a11621", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "7ab4f4a11621", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790172914, "last_seen": 1791252880, "transport": "t", "ja3_hash": "9f15f79765ae47acc7f39919c1208eeb", "ja3_variant_count": 1, "ja3_variants": [ "9f15f79765ae47acc7f39919c1208eeb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_7b821b73213e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "7b821b73213e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789928934, "last_seen": 1791229709, "transport": "t", "ja3_hash": "11bfe54a8fad87622e024ca17f9cfc10", "ja3_variant_count": 2, "ja3_variants": [ "11bfe54a8fad87622e024ca17f9cfc10", "36d78058f45915444be090778ee36079" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_80a9c4ead107", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "80a9c4ead107", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789966934, "last_seen": 1790948061, "transport": "t", "ja3_hash": "8d95ba02d541805b8c66004e90fac836", "ja3_variant_count": 1, "ja3_variants": [ "8d95ba02d541805b8c66004e90fac836" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_855532499de1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "855532499de1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789690163, "last_seen": 1790535152, "transport": "t", "ja3_hash": "c86f97a3cd63cec0205474ab53a6c2a9", "ja3_variant_count": 1, "ja3_variants": [ "c86f97a3cd63cec0205474ab53a6c2a9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_861dbf3f9010", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "861dbf3f9010", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 7, "first_seen": 1789016257, "last_seen": 1791248959, "transport": "t", "ja3_hash": "cac52c5064fe35a9550ed8015bea939a", "ja3_variant_count": 4, "ja3_variants": [ "cac52c5064fe35a9550ed8015bea939a", "6886911bd59ad4920e6f72c544d2a330", "251801bcb44f1eda6da58ea817952005", "e4282c1cc102c846935889a979ab5387" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 25, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_8834694faa50", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "8834694faa50", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788840754, "last_seen": 1788840754, "transport": "t", "ja3_hash": "40128253aba90aaf48af68c83122762d", "ja3_variant_count": 1, "ja3_variants": [ "40128253aba90aaf48af68c83122762d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_889fca618af4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "889fca618af4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789776260, "last_seen": 1790228717, "transport": "t", "ja3_hash": "5c0b982025c9fbc06bb7f3727de15bea", "ja3_variant_count": 2, "ja3_variants": [ "5c0b982025c9fbc06bb7f3727de15bea", "bacf9a536b88cc2c38ad7cbabd7465b1" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.2006.60 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_8af5f994aba1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "8af5f994aba1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788471548, "last_seen": 1790663005, "transport": "t", "ja3_hash": "12fd83710fc8a062bd8a3be597f516e6", "ja3_variant_count": 1, "ja3_variants": [ "12fd83710fc8a062bd8a3be597f516e6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 5, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 6 }, "ua_disagreement": true } }, { "hash": "t12i150300_8daaf6152771_8cc308a53a60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "8cc308a53a60", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1787678249, "last_seen": 1791111905, "transport": "t", "ja3_hash": "e4fda925e15c38d16aa6050457dfd93d", "ja3_variant_count": 3, "ja3_variants": [ "e4fda925e15c38d16aa6050457dfd93d", "6c03ec73878efffbecc7faaaafb4d221", "9c66ebe73048bc69dbd8baed51223938" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_93de4125407b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "93de4125407b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839683, "last_seen": 1788839683, "transport": "t", "ja3_hash": "a05dfc505b1ac9113c3fb1a57eae2855", "ja3_variant_count": 1, "ja3_variants": [ "a05dfc505b1ac9113c3fb1a57eae2855" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_95b8518dd442", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "95b8518dd442", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788777957, "last_seen": 1790690024, "transport": "t", "ja3_hash": "a801c86bf8101a0e948d1d13a526b271", "ja3_variant_count": 1, "ja3_variants": [ "a801c86bf8101a0e948d1d13a526b271" ], "user_agents": { "Mozilla/5.0 (iPad; CPU OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_977885baa268", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "977885baa268", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790239289, "last_seen": 1790239289, "transport": "t", "ja3_hash": "bc6ec456e00558778ecdf88de5da38df", "ja3_variant_count": 1, "ja3_variants": [ "bc6ec456e00558778ecdf88de5da38df" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_9ae86f3248c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "9ae86f3248c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788302907, "last_seen": 1791134415, "transport": "t", "ja3_hash": "ebbe322c5d34babf52a3ced1fe18074f", "ja3_variant_count": 1, "ja3_variants": [ "ebbe322c5d34babf52a3ced1fe18074f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_9f9a6f207792", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "9f9a6f207792", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 9, "first_seen": 1788684405, "last_seen": 1790884406, "transport": "t", "ja3_hash": "c3cd97d282d8143573ebe6748d4976d7", "ja3_variant_count": 3, "ja3_variants": [ "c3cd97d282d8143573ebe6748d4976d7", "5894f9f4efe1795df774d453960b395c", "a91a370fdfa162ecdc4937464bf38ac1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_a537042d8382", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "a537042d8382", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788509349, "last_seen": 1790675151, "transport": "t", "ja3_hash": "ee378854005883e4ad42bcbb7e235b64", "ja3_variant_count": 2, "ja3_variants": [ "ee378854005883e4ad42bcbb7e235b64", "e62ab1c99a28aa5d847ee6b967fd6ce2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 9 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_a8dac5311dfa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "a8dac5311dfa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789224358, "last_seen": 1790210754, "transport": "t", "ja3_hash": "d8572d5b5b20461fa0e7448b0d546ad8", "ja3_variant_count": 2, "ja3_variants": [ "d8572d5b5b20461fa0e7448b0d546ad8", "302e4cf01d91c18cc250b12a11ca7d32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_acca8ee5e8e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "acca8ee5e8e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790794645, "last_seen": 1790794645, "transport": "t", "ja3_hash": "df037e79e0712f0bc893bda91bad6fcf", "ja3_variant_count": 1, "ja3_variants": [ "df037e79e0712f0bc893bda91bad6fcf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 7 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_ad94e05af490", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "ad94e05af490", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789984922, "last_seen": 1790795172, "transport": "t", "ja3_hash": "ea275afe989362859a3a03f670a7560d", "ja3_variant_count": 3, "ja3_variants": [ "ea275afe989362859a3a03f670a7560d", "3e7d059d5d120b7201e266b06052d78e", "6e287eaefa5ef9e85b939401b8424bdc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 22 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_b1ffd1df4799", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "b1ffd1df4799", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788336571, "last_seen": 1790778974, "transport": "t", "ja3_hash": "6c2b8bdc9e9ea58091e6fd191d951713", "ja3_variant_count": 2, "ja3_variants": [ "6c2b8bdc9e9ea58091e6fd191d951713", "0f81257ce9f5574bc35cced51fcb0370" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_b7bc1ad59d15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "b7bc1ad59d15", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790707734, "last_seen": 1790707734, "transport": "t", "ja3_hash": "5c027dd0b2c5f5a912ef8b546d4328eb", "ja3_variant_count": 1, "ja3_variants": [ "5c027dd0b2c5f5a912ef8b546d4328eb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_b7c45deb0a92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "b7c45deb0a92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790360803, "last_seen": 1790360803, "transport": "t", "ja3_hash": "05d9289540d15fa9fbc8365ce8100c9b", "ja3_variant_count": 1, "ja3_variants": [ "05d9289540d15fa9fbc8365ce8100c9b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 55 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_bdabbfcfee4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "bdabbfcfee4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790266526, "last_seen": 1790282501, "transport": "t", "ja3_hash": "94393ac741f9e578853862ec80f06903", "ja3_variant_count": 2, "ja3_variants": [ "94393ac741f9e578853862ec80f06903", "bf03cd0d527e1f2f86fe7fc13f0921b7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 24, "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_c4fe6519c741", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "c4fe6519c741", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788887725, "last_seen": 1788887725, "transport": "t", "ja3_hash": "7f792a943a1114a65a71d3d9c7ec67a2", "ja3_variant_count": 1, "ja3_variants": [ "7f792a943a1114a65a71d3d9c7ec67a2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_c59844a9907e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "c59844a9907e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788900219, "last_seen": 1790856015, "transport": "t", "ja3_hash": "a96f4dc9e173e20640413dbb1d668579", "ja3_variant_count": 2, "ja3_variants": [ "a96f4dc9e173e20640413dbb1d668579", "a7232a1e17e2950d2bac1f8b78c1520e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_c5a8ebbbfdf0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "c5a8ebbbfdf0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790148281, "last_seen": 1790148281, "transport": "t", "ja3_hash": "3f24a47cf213a719946da82243898018", "ja3_variant_count": 1, "ja3_variants": [ "3f24a47cf213a719946da82243898018" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 2 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_c8afba213708", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "c8afba213708", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788455445, "last_seen": 1790655943, "transport": "t", "ja3_hash": "883de831507a53e07fafb82f7a77cea9", "ja3_variant_count": 1, "ja3_variants": [ "883de831507a53e07fafb82f7a77cea9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_c8c3180d45da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "c8c3180d45da", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788723897, "last_seen": 1791128261, "transport": "t", "ja3_hash": "d93b5db82eac344b9475a589c8dfa479", "ja3_variant_count": 3, "ja3_variants": [ "d93b5db82eac344b9475a589c8dfa479", "3ff04446ef491952db8cd4c0ca5ac28f", "c3a7cccf2f33762db19947620aa6be0b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_cb25bfb5baed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "cb25bfb5baed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788491910, "last_seen": 1791035965, "transport": "t", "ja3_hash": "d555db7b308307e54365d6b33ca81817", "ja3_variant_count": 1, "ja3_variants": [ "d555db7b308307e54365d6b33ca81817" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_cd15ef09578c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "cd15ef09578c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791192514, "last_seen": 1791192514, "transport": "t", "ja3_hash": "b9021277a9dbcfcc01513249679aacb3", "ja3_variant_count": 1, "ja3_variants": [ "b9021277a9dbcfcc01513249679aacb3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_db16c25f22ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "db16c25f22ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789007205, "last_seen": 1790004403, "transport": "t", "ja3_hash": "c2216a9ed9599867698b065681ca977b", "ja3_variant_count": 1, "ja3_variants": [ "c2216a9ed9599867698b065681ca977b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_ddcfd4a8b48a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "ddcfd4a8b48a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790165423, "last_seen": 1790165423, "transport": "t", "ja3_hash": "24a6682aabae19adce5b7015caf742a1", "ja3_variant_count": 1, "ja3_variants": [ "24a6682aabae19adce5b7015caf742a1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_df9b888d714f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "df9b888d714f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789235406, "last_seen": 1790004403, "transport": "t", "ja3_hash": "e7400a4b1c310b90456b5eda25c59cfe", "ja3_variant_count": 1, "ja3_variants": [ "e7400a4b1c310b90456b5eda25c59cfe" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_e0cc06c0e04c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "e0cc06c0e04c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790627678, "last_seen": 1790627678, "transport": "t", "ja3_hash": "f3d784d288d8d0bc1b6f444291fe409b", "ja3_variant_count": 1, "ja3_variants": [ "f3d784d288d8d0bc1b6f444291fe409b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_e36c1c2b7877", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "e36c1c2b7877", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1787811206, "last_seen": 1790856254, "transport": "t", "ja3_hash": "8366ba1af275ca99a31f4f5b130d9b49", "ja3_variant_count": 2, "ja3_variants": [ "8366ba1af275ca99a31f4f5b130d9b49", "217135339d3513b134b8501ec4b8ad49" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12i150300_8daaf6152771_e48e9f2c5c73", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "e48e9f2c5c73", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790553594, "last_seen": 1790553594, "transport": "t", "ja3_hash": "4d30875c02988455cb9e800c13f0c1cf", "ja3_variant_count": 1, "ja3_variants": [ "4d30875c02988455cb9e800c13f0c1cf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_ead02e0fa6fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "ead02e0fa6fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789043642, "last_seen": 1790556366, "transport": "t", "ja3_hash": "75ad192b724befe783f766d52c423125", "ja3_variant_count": 2, "ja3_variants": [ "75ad192b724befe783f766d52c423125", "ba27fa782d33e8fb14318fe47b34855a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_ef3e93476692", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "ef3e93476692", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789315748, "last_seen": 1790597178, "transport": "t", "ja3_hash": "32a061f615a197798deaaed1b2391dbb", "ja3_variant_count": 3, "ja3_variants": [ "32a061f615a197798deaaed1b2391dbb", "ec6f7180f004b094bb99d191c12c4ab1", "f484906d51d7c128e44996719ec013ee" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 28, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_ffd67e517ef8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "ffd67e517ef8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1790245006, "last_seen": 1790723486, "transport": "t", "ja3_hash": "5cf450a550b486a5db7877f1502c8341", "ja3_variant_count": 3, "ja3_variants": [ "5cf450a550b486a5db7877f1502c8341", "bb1158a8a1554848ef5f6b4b535cbb16", "004aac4e412c62306a406c3e3878e6aa" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12i1503h1_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h1", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791199920, "last_seen": 1791199920, "transport": "t", "ja3_hash": "241e81cc3a51de1e0985af3484b569a3", "ja3_variant_count": 1, "ja3_variants": [ "241e81cc3a51de1e0985af3484b569a3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_243a59383c1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "243a59383c1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788595994, "last_seen": 1788595994, "transport": "t", "ja3_hash": "0519941e6e5ab049fbeb14278b587ca5", "ja3_variant_count": 1, "ja3_variants": [ "0519941e6e5ab049fbeb14278b587ca5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 7 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_266c5487f233", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "266c5487f233", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790262132, "last_seen": 1790262132, "transport": "t", "ja3_hash": "6f1114a69f67d10df169b195de0ba0b1", "ja3_variant_count": 1, "ja3_variants": [ "6f1114a69f67d10df169b195de0ba0b1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_29f566491819", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "29f566491819", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790192507, "last_seen": 1791018548, "transport": "t", "ja3_hash": "cd5b7e44cb22de3a9bfe6fe93f391e76", "ja3_variant_count": 2, "ja3_variants": [ "cd5b7e44cb22de3a9bfe6fe93f391e76", "d17310eb6c4f54685d411466bf5c9e09" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_29fb568ecb96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "29fb568ecb96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789027755, "last_seen": 1790096324, "transport": "t", "ja3_hash": "86ec0efa22e82831b3e92206bb06a5ec", "ja3_variant_count": 1, "ja3_variants": [ "86ec0efa22e82831b3e92206bb06a5ec" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 11 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_389b9922d8cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "389b9922d8cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1788723966, "last_seen": 1791021459, "transport": "t", "ja3_hash": "7e34917d199bfde07baa0a3e7479e1ae", "ja3_variant_count": 3, "ja3_variants": [ "7e34917d199bfde07baa0a3e7479e1ae", "e2336bd31319d9fe69834ab675f1762a", "fa398326ec898809da57e8ab38047a10" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_43d44e58c561", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "43d44e58c561", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1790217564, "last_seen": 1791125983, "transport": "t", "ja3_hash": "9adb4aedb875ac4ab162c50f6d3e85e8", "ja3_variant_count": 3, "ja3_variants": [ "9adb4aedb875ac4ab162c50f6d3e85e8", "ed07f81438bd1d0253078799fa7b5472", "423096f18f7e77b5aa203b71ec7944eb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_5983db0d0827", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "5983db0d0827", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790223935, "last_seen": 1790223935, "transport": "t", "ja3_hash": "224be77ae682e57e1778e86544cbc1e1", "ja3_variant_count": 1, "ja3_variants": [ "224be77ae682e57e1778e86544cbc1e1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_60539585631d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "60539585631d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790791445, "last_seen": 1790791445, "transport": "t", "ja3_hash": "57b8e0d5030827ec216c2a2dca63a87b", "ja3_variant_count": 1, "ja3_variants": [ "57b8e0d5030827ec216c2a2dca63a87b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_757efd7250b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "757efd7250b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790365567, "last_seen": 1791192704, "transport": "t", "ja3_hash": "7c81f110c004cef4a3dfc15046fb6f47", "ja3_variant_count": 2, "ja3_variants": [ "7c81f110c004cef4a3dfc15046fb6f47", "6bcd4e6a89a2b6feba9d38fcbb5a44cd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789026290, "last_seen": 1789026290, "transport": "t", "ja3_hash": "5118538a5f3abf1a829fc23f6f7acf3c", "ja3_variant_count": 1, "ja3_variants": [ "5118538a5f3abf1a829fc23f6f7acf3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 10 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_c329806a6f2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "c329806a6f2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790202581, "last_seen": 1791210063, "transport": "t", "ja3_hash": "b8caa759b71eb4acc5ae2c1f98b3ff71", "ja3_variant_count": 2, "ja3_variants": [ "b8caa759b71eb4acc5ae2c1f98b3ff71", "68ac0568097bf1cd07cdd976e8bc74ed" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_cd15ef09578c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "cd15ef09578c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1787963040, "last_seen": 1790686999, "transport": "t", "ja3_hash": "f08ec4ce4feea1cb140842fa3f9e4353", "ja3_variant_count": 3, "ja3_variants": [ "f08ec4ce4feea1cb140842fa3f9e4353", "adcf03159d1b9726318c6d268c6c9a6f", "b4b9cf690190ad460820316cfa1fdbbc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1503ht_8daaf6152771_5983db0d0827", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1503ht", "b": "8daaf6152771", "c": "5983db0d0827", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789623470, "last_seen": 1791222058, "transport": "t", "ja3_hash": "56ad4bc18c379d14cc97b2f46f41508b", "ja3_variant_count": 1, "ja3_variants": [ "56ad4bc18c379d14cc97b2f46f41508b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_0111f19f7b3b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "0111f19f7b3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791035674, "last_seen": 1791035674, "transport": "t", "ja3_hash": "ca6cc01db74399fd8eee08bf8b74f558", "ja3_variant_count": 1, "ja3_variants": [ "ca6cc01db74399fd8eee08bf8b74f558" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_01593bc97d68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "01593bc97d68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-51-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790760780, "last_seen": 1790760780, "transport": "t", "ja3_hash": "1d4f39b2d6e1ceeb558137ac9e3d638b", "ja3_variant_count": 1, "ja3_variants": [ "1d4f39b2d6e1ceeb558137ac9e3d638b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_066c99c0c318", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "066c99c0c318", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788688164, "last_seen": 1788688164, "transport": "t", "ja3_hash": "57505b7d37aaff93681f7c5f4605a5cd", "ja3_variant_count": 1, "ja3_variants": [ "57505b7d37aaff93681f7c5f4605a5cd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_0694ede3e576", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "0694ede3e576", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-27-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790219901, "last_seen": 1790219901, "transport": "t", "ja3_hash": "2a7c2df062bfa25ecf1696f5b354a4f2", "ja3_variant_count": 1, "ja3_variants": [ "2a7c2df062bfa25ecf1696f5b354a4f2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_06ae6f9aa360", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "06ae6f9aa360", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51764-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790310311, "last_seen": 1790310311, "transport": "t", "ja3_hash": "fdfd2733c95b5c45ff1d4114d0843305", "ja3_variant_count": 1, "ja3_variants": [ "fdfd2733c95b5c45ff1d4114d0843305" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_091a4e1e2c66", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "091a4e1e2c66", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790212914, "last_seen": 1790212914, "transport": "t", "ja3_hash": "7fe3a6c8a2cc0647a9204c262bec824f", "ja3_variant_count": 1, "ja3_variants": [ "7fe3a6c8a2cc0647a9204c262bec824f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_0a915cd99898", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "0a915cd99898", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202279, "last_seen": 1790202279, "transport": "t", "ja3_hash": "663adb181e0290381699fbe90597c7d3", "ja3_variant_count": 1, "ja3_variants": [ "663adb181e0290381699fbe90597c7d3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_0eec3ad4a3a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "0eec3ad4a3a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790620110, "last_seen": 1790620110, "transport": "t", "ja3_hash": "4294db3099ee96c6786e037098e24396", "ja3_variant_count": 1, "ja3_variants": [ "4294db3099ee96c6786e037098e24396" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 6 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_0f6d8317e58b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "0f6d8317e58b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789028394, "last_seen": 1791135831, "transport": "t", "ja3_hash": "4ffaa6cd4e8ebd456c86fd799b3189ca", "ja3_variant_count": 2, "ja3_variants": [ "4ffaa6cd4e8ebd456c86fd799b3189ca", "82eb39d029deb853f08978526881774d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 13; SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_0fc7fdb90d90", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "0fc7fdb90d90", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-51-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790746163, "last_seen": 1790746163, "transport": "t", "ja3_hash": "ac113e6ca864a010ef8d8771102220ab", "ja3_variant_count": 1, "ja3_variants": [ "ac113e6ca864a010ef8d8771102220ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_12cdb08aaf55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "12cdb08aaf55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791303617, "last_seen": 1791303617, "transport": "t", "ja3_hash": "7d8fad323ef836d26295ed9ea1137f64", "ja3_variant_count": 1, "ja3_variants": [ "7d8fad323ef836d26295ed9ea1137f64" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 56 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_14fc16eb3ed9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "14fc16eb3ed9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790307868, "last_seen": 1791077537, "transport": "t", "ja3_hash": "5d46d421ae4c48c4f51bb2a559febb21", "ja3_variant_count": 2, "ja3_variants": [ "5d46d421ae4c48c4f51bb2a559febb21", "adad61dbbbbe1b60ee71244ab25b81c1" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_1656810a39fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "1656810a39fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-51-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790221758, "last_seen": 1791192306, "transport": "t", "ja3_hash": "14bc41cd7034968f613d1765c4436c44", "ja3_variant_count": 2, "ja3_variants": [ "14bc41cd7034968f613d1765c4436c44", "10e880df7cafc21057f407f422882b69" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_1cf365ee4dca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "1cf365ee4dca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-11-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790738621, "last_seen": 1790738621, "transport": "t", "ja3_hash": "dcf945d4a6dcc8b38bb5bf97084a89d7", "ja3_variant_count": 1, "ja3_variants": [ "dcf945d4a6dcc8b38bb5bf97084a89d7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_23c0ddd8235e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "23c0ddd8235e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788948586, "last_seen": 1791133017, "transport": "t", "ja3_hash": "de219a9cba40c66db4ce158b5895169f", "ja3_variant_count": 4, "ja3_variants": [ "de219a9cba40c66db4ce158b5895169f", "0d30021a4243a9399d607a953a39c974", "d3d61e2533da8d7fe72b08f6409735b8", "4bfaf1767ab8d005a095a4ac15a32636" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_24e5e8e161dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "24e5e8e161dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-51-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790210183, "last_seen": 1790210183, "transport": "t", "ja3_hash": "cb3f1ac55f027b5e37a1a408a693383d", "ja3_variant_count": 1, "ja3_variants": [ "cb3f1ac55f027b5e37a1a408a693383d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_27884f370e02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "27884f370e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51764-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790249309, "last_seen": 1790400255, "transport": "t", "ja3_hash": "fdbee4cf2ec528d492059a6e5ef8e50b", "ja3_variant_count": 2, "ja3_variants": [ "fdbee4cf2ec528d492059a6e5ef8e50b", "020aa6f84da3c29978d0506549398094" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_28d89457b577", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "28d89457b577", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790149105, "last_seen": 1791007103, "transport": "t", "ja3_hash": "2abd0a0bdabe8932d49d38b21958a872", "ja3_variant_count": 3, "ja3_variants": [ "2abd0a0bdabe8932d49d38b21958a872", "fb62c6425b06724b14754cc1d8df32e1", "1e2845f0050c223c9f845f8573dcdc17" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_2c23c1e9a828", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "2c23c1e9a828", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788811160, "last_seen": 1790457139, "transport": "t", "ja3_hash": "eb70d5c776055146df3c0c853c09c63a", "ja3_variant_count": 3, "ja3_variants": [ "eb70d5c776055146df3c0c853c09c63a", "6fc32b9d567ad7060c9d31e7677bfff7", "c9e25406f735054bc0fe3d25789ea428" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_2ce2910c0600", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "2ce2910c0600", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788617529, "last_seen": 1790579075, "transport": "t", "ja3_hash": "8b91d87918b4be7c1b346eb1a650e615", "ja3_variant_count": 2, "ja3_variants": [ "8b91d87918b4be7c1b346eb1a650e615", "17b343846417b7f2f79ae52cf3b7f986" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_2f00cd803a1e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "2f00cd803a1e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790490098, "last_seen": 1791191684, "transport": "t", "ja3_hash": "2926d186f1fcf32a16a5616a16945d9d", "ja3_variant_count": 3, "ja3_variants": [ "2926d186f1fcf32a16a5616a16945d9d", "a75b66ac00452f35dc302ed2a7d73402", "2a3275bf0bd482bbf5ceda6269e8e82f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_2f813cc6c4cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "2f813cc6c4cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-10-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790465464, "last_seen": 1790465464, "transport": "t", "ja3_hash": "dc3e43b0334608277d0e2831e24deb1f", "ja3_variant_count": 1, "ja3_variants": [ "dc3e43b0334608277d0e2831e24deb1f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_2fddc85497ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "2fddc85497ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788465638, "last_seen": 1788465638, "transport": "t", "ja3_hash": "7f44fa82e8468a23c74f2093724aad48", "ja3_variant_count": 1, "ja3_variants": [ "7f44fa82e8468a23c74f2093724aad48" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_31b38f490a1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "31b38f490a1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-51764-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790790012, "last_seen": 1790790012, "transport": "t", "ja3_hash": "9ce9712cb1d235ad0ce4a8378c5887e2", "ja3_variant_count": 1, "ja3_variants": [ "9ce9712cb1d235ad0ce4a8378c5887e2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_3324bfbb2493", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "3324bfbb2493", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209119, "last_seen": 1790209119, "transport": "t", "ja3_hash": "66cac6f462d9e6f9b4aaf3d1abbc40cc", "ja3_variant_count": 1, "ja3_variants": [ "66cac6f462d9e6f9b4aaf3d1abbc40cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_37204fbd0703", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "37204fbd0703", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790261606, "last_seen": 1790645260, "transport": "t", "ja3_hash": "4678e02b770ab38ef8556cdf0f60c51d", "ja3_variant_count": 2, "ja3_variants": [ "4678e02b770ab38ef8556cdf0f60c51d", "6eb376a38fafb6770b065fb337354bf5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_3a85a3548166", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "3a85a3548166", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788743654, "last_seen": 1788743654, "transport": "t", "ja3_hash": "20df95d6f5863d455e6391288a6da45f", "ja3_variant_count": 1, "ja3_variants": [ "20df95d6f5863d455e6391288a6da45f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_3b7fdc9f0fa5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "3b7fdc9f0fa5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788767887, "last_seen": 1788829267, "transport": "t", "ja3_hash": "9c638315722279865991f616f2ea801a", "ja3_variant_count": 2, "ja3_variants": [ "9c638315722279865991f616f2ea801a", "ab54981e30c3587cbb44d25d53c7889c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_409524cce7c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "409524cce7c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788899785, "last_seen": 1791110151, "transport": "t", "ja3_hash": "19b76a97e17da098e17adf41dab39445", "ja3_variant_count": 2, "ja3_variants": [ "19b76a97e17da098e17adf41dab39445", "cb67c017c1167063538e890732602577" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_40e2c5e20574", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "40e2c5e20574", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788762519, "last_seen": 1788762519, "transport": "t", "ja3_hash": "8e6cf054fd2a7d2208b07a16c7e5afb0", "ja3_variant_count": 1, "ja3_variants": [ "8e6cf054fd2a7d2208b07a16c7e5afb0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_413202455ff3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "413202455ff3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789655106, "last_seen": 1789655106, "transport": "t", "ja3_hash": "50acfa7bf298c10f6ef56bf24b3ff291", "ja3_variant_count": 1, "ja3_variants": [ "50acfa7bf298c10f6ef56bf24b3ff291" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 85 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_44b98863c7ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "44b98863c7ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669085, "last_seen": 1789669085, "transport": "t", "ja3_hash": "38aed29e84564bb0a2e489453d906421", "ja3_variant_count": 1, "ja3_variants": [ "38aed29e84564bb0a2e489453d906421" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_451cade48588", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "451cade48588", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791122306, "last_seen": 1791122306, "transport": "t", "ja3_hash": "9d8a11d1979b35c241b50fce83b10b89", "ja3_variant_count": 1, "ja3_variants": [ "9d8a11d1979b35c241b50fce83b10b89" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_484018c9ef8e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "484018c9ef8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789967065, "last_seen": 1789967065, "transport": "t", "ja3_hash": "118327686f66026aee2adfb50985dd00", "ja3_variant_count": 1, "ja3_variants": [ "118327686f66026aee2adfb50985dd00" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_4ea486ae4269", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "4ea486ae4269", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790475957, "last_seen": 1790475957, "transport": "t", "ja3_hash": "ffa1bc674629748fcb46143e59015919", "ja3_variant_count": 1, "ja3_variants": [ "ffa1bc674629748fcb46143e59015919" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_52ac0c3baaaa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "52ac0c3baaaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790210736, "last_seen": 1790210736, "transport": "t", "ja3_hash": "1e547f3c9110f6b2157bbeabc53c1182", "ja3_variant_count": 1, "ja3_variants": [ "1e547f3c9110f6b2157bbeabc53c1182" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_5450d8b09f3c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "5450d8b09f3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791046327, "last_seen": 1791046327, "transport": "t", "ja3_hash": "44ee910272e5ee2f74064c2bea444367", "ja3_variant_count": 1, "ja3_variants": [ "44ee910272e5ee2f74064c2bea444367" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 42 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_55d5deed8759", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "55d5deed8759", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789683855, "last_seen": 1789683855, "transport": "t", "ja3_hash": "74fb2bd8495d1cb480a031805e3edb02", "ja3_variant_count": 1, "ja3_variants": [ "74fb2bd8495d1cb480a031805e3edb02" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_56064a233722", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "56064a233722", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-51-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789637776, "last_seen": 1789637776, "transport": "t", "ja3_hash": "be139d93b38ae65ff7261d3d05f2497c", "ja3_variant_count": 1, "ja3_variants": [ "be139d93b38ae65ff7261d3d05f2497c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_58765f04dde3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "58765f04dde3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-27-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790236910, "last_seen": 1790905740, "transport": "t", "ja3_hash": "112ebcc64b005a5524f40aa25bc28e0a", "ja3_variant_count": 2, "ja3_variants": [ "112ebcc64b005a5524f40aa25bc28e0a", "f7b508542d0054eb4bc1888f06d2ffa5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_5b6cf97f2b4d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "5b6cf97f2b4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790374740, "last_seen": 1790794694, "transport": "t", "ja3_hash": "b3d5214cd27fc38bdb37e45434c90c9d", "ja3_variant_count": 2, "ja3_variants": [ "b3d5214cd27fc38bdb37e45434c90c9d", "f9bfbe610c251d1721300bb4cdb46cce" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_5bbb1b704472", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "5bbb1b704472", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-18-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790065171, "last_seen": 1790065171, "transport": "t", "ja3_hash": "a517a582d36fb97948259250a2120748", "ja3_variant_count": 1, "ja3_variants": [ "a517a582d36fb97948259250a2120748" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_5c999ff4c11c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "5c999ff4c11c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791221603, "last_seen": 1791221603, "transport": "t", "ja3_hash": "e6310300e549e1ef4e47a2db72bf4c7f", "ja3_variant_count": 1, "ja3_variants": [ "e6310300e549e1ef4e47a2db72bf4c7f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_5d7d641f6cb0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "5d7d641f6cb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790905489, "last_seen": 1790905489, "transport": "t", "ja3_hash": "428eb2e10c0501ccb957daca5b0907a0", "ja3_variant_count": 1, "ja3_variants": [ "428eb2e10c0501ccb957daca5b0907a0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_5f64d2fa02cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "5f64d2fa02cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788827379, "last_seen": 1788827379, "transport": "t", "ja3_hash": "f9eee47498083bec44734c548a7f3053", "ja3_variant_count": 1, "ja3_variants": [ "f9eee47498083bec44734c548a7f3053" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_608c1a10364f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "608c1a10364f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790708541, "last_seen": 1790708541, "transport": "t", "ja3_hash": "6455ed39ff9f4a7737b86ec388bd9422", "ja3_variant_count": 1, "ja3_variants": [ "6455ed39ff9f4a7737b86ec388bd9422" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_61abf689f404", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "61abf689f404", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-5-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790789576, "last_seen": 1790789576, "transport": "t", "ja3_hash": "daab668d0d6806b450fb5cc2ac241857", "ja3_variant_count": 1, "ja3_variants": [ "daab668d0d6806b450fb5cc2ac241857" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_6261885588fb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "6261885588fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790794874, "last_seen": 1790794874, "transport": "t", "ja3_hash": "f68e596b01f9012aad29ae22b8e35ae8", "ja3_variant_count": 1, "ja3_variants": [ "f68e596b01f9012aad29ae22b8e35ae8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_638c44a6fd4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "638c44a6fd4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789641609, "last_seen": 1789641609, "transport": "t", "ja3_hash": "007fe7790c40963b86857d540fc40b7e", "ja3_variant_count": 1, "ja3_variants": [ "007fe7790c40963b86857d540fc40b7e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_652434e64a5e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "652434e64a5e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790626409, "last_seen": 1790626409, "transport": "t", "ja3_hash": "fc4ff6c26dfeff5f9e1270ebb36aa80f", "ja3_variant_count": 1, "ja3_variants": [ "fc4ff6c26dfeff5f9e1270ebb36aa80f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_6ae0f3e02dd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "6ae0f3e02dd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-51-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788837000, "last_seen": 1788837000, "transport": "t", "ja3_hash": "1abd2f63d2064c4b02e93756f4371ca1", "ja3_variant_count": 1, "ja3_variants": [ "1abd2f63d2064c4b02e93756f4371ca1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_6bc12052a735", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "6bc12052a735", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788899955, "last_seen": 1788899955, "transport": "t", "ja3_hash": "26823b5b2496a544b05e8db84814fb39", "ja3_variant_count": 1, "ja3_variants": [ "26823b5b2496a544b05e8db84814fb39" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 22 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_6e6c7339be03", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "6e6c7339be03", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790268696, "last_seen": 1790268696, "transport": "t", "ja3_hash": "4e1991e13b79d59629a9359230640ff7", "ja3_variant_count": 1, "ja3_variants": [ "4e1991e13b79d59629a9359230640ff7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_6f39ef6c591d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "6f39ef6c591d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789240527, "last_seen": 1789240527, "transport": "t", "ja3_hash": "dd2c54e3bfaeb185efccd3755358c022", "ja3_variant_count": 1, "ja3_variants": [ "dd2c54e3bfaeb185efccd3755358c022" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_72491980aba4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "72491980aba4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791255585, "last_seen": 1791255585, "transport": "t", "ja3_hash": "fb369bea9d406f901c55c68099e75ffe", "ja3_variant_count": 1, "ja3_variants": [ "fb369bea9d406f901c55c68099e75ffe" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_73d125b74ac3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "73d125b74ac3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790223550, "last_seen": 1790223550, "transport": "t", "ja3_hash": "496805eec3ddee05e6b6e027545bb440", "ja3_variant_count": 1, "ja3_variants": [ "496805eec3ddee05e6b6e027545bb440" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_762b5886a455", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "762b5886a455", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-5-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791291389, "last_seen": 1791291389, "transport": "t", "ja3_hash": "9e4fc1e6b1a5792bfb8fcd3446e8bcb4", "ja3_variant_count": 1, "ja3_variants": [ "9e4fc1e6b1a5792bfb8fcd3446e8bcb4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_799c94ba25be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "799c94ba25be", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-65281-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790186250, "last_seen": 1790786096, "transport": "t", "ja3_hash": "f9f9e8f50ee2ccf63606274dea86b727", "ja3_variant_count": 1, "ja3_variants": [ "f9f9e8f50ee2ccf63606274dea86b727" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_8116f3cf52d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "8116f3cf52d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788773229, "last_seen": 1790775873, "transport": "t", "ja3_hash": "a394ecba66f626577a53dba5fdf3156e", "ja3_variant_count": 2, "ja3_variants": [ "a394ecba66f626577a53dba5fdf3156e", "4ee82d856172aa83d53dccc05268f168" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_815098a8038a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "815098a8038a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-65281-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789982033, "last_seen": 1790241674, "transport": "t", "ja3_hash": "6fddbc356d7167fe280a548870977993", "ja3_variant_count": 2, "ja3_variants": [ "6fddbc356d7167fe280a548870977993", "72e47ebaee4712a2ffc2edbe06d131dd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_891ee51b43ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "891ee51b43ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-35-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788973155, "last_seen": 1789830218, "transport": "t", "ja3_hash": "6c047de79257740bc291d9dfd7588218", "ja3_variant_count": 4, "ja3_variants": [ "6c047de79257740bc291d9dfd7588218", "ac9940d2c21d34e63da1675a24d87cd1", "57db0146f5adcd0334d7a9ab7526a951", "c7d59c92a768b66dbd5e8c87168d8acf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_899f634b8deb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "899f634b8deb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790233888, "last_seen": 1790307870, "transport": "t", "ja3_hash": "f729b3eb787f6cd27158c1fbb48dd4a7", "ja3_variant_count": 2, "ja3_variants": [ "f729b3eb787f6cd27158c1fbb48dd4a7", "afa64be93b77a11a5ef9070d241a56d8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_908cd72bcdfc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "908cd72bcdfc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790350610, "last_seen": 1790350610, "transport": "t", "ja3_hash": "db8c93756e7a51902bbd0a0bfb19f9b2", "ja3_variant_count": 1, "ja3_variants": [ "db8c93756e7a51902bbd0a0bfb19f9b2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_92d6c89122a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "92d6c89122a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790556368, "last_seen": 1790556368, "transport": "t", "ja3_hash": "d0ba29f6d94b9f9c38ac0dd31a1dfdf8", "ja3_variant_count": 1, "ja3_variants": [ "d0ba29f6d94b9f9c38ac0dd31a1dfdf8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_93b9751e4c3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "93b9751e4c3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-13-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790876460, "last_seen": 1790876460, "transport": "t", "ja3_hash": "f7d2930f1c7cffa64edba010b51208dd", "ja3_variant_count": 1, "ja3_variants": [ "f7d2930f1c7cffa64edba010b51208dd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_9451546dbbb5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "9451546dbbb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-35-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790202593, "last_seen": 1790202593, "transport": "t", "ja3_hash": "4a28f71668245ee3fa43fbf9888e79a7", "ja3_variant_count": 1, "ja3_variants": [ "4a28f71668245ee3fa43fbf9888e79a7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_947b7c75f686", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "947b7c75f686", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790048535, "last_seen": 1790048535, "transport": "t", "ja3_hash": "6675f88cd4767a9f21fdea0748b61a2d", "ja3_variant_count": 1, "ja3_variants": [ "6675f88cd4767a9f21fdea0748b61a2d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_96b01566035c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "96b01566035c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-17613-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791209794, "last_seen": 1791209794, "transport": "t", "ja3_hash": "2c33cf7a0627eaa150718e3cb6d766ef", "ja3_variant_count": 1, "ja3_variants": [ "2c33cf7a0627eaa150718e3cb6d766ef" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_97e1e6b01fa5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "97e1e6b01fa5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790231062, "last_seen": 1790231062, "transport": "t", "ja3_hash": "010d3bf64868216aa8f8a80c3ce78ccf", "ja3_variant_count": 1, "ja3_variants": [ "010d3bf64868216aa8f8a80c3ce78ccf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a23738d3380f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a23738d3380f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-51-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788822425, "last_seen": 1788822425, "transport": "t", "ja3_hash": "21b6e46ff0e4ead3582857f8ecfcf98b", "ja3_variant_count": 1, "ja3_variants": [ "21b6e46ff0e4ead3582857f8ecfcf98b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a3266507da0f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a3266507da0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-65037-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790993818, "last_seen": 1791131189, "transport": "t", "ja3_hash": "01f11ae2cffc548e37101010cc8a9fdc", "ja3_variant_count": 2, "ja3_variants": [ "01f11ae2cffc548e37101010cc8a9fdc", "3dec8082f70ec737604728028e84c424" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a360ad31b19d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a360ad31b19d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51764-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791215867, "last_seen": 1791215867, "transport": "t", "ja3_hash": "0f50d838d9a68fb6b07600a872c28f46", "ja3_variant_count": 1, "ja3_variants": [ "0f50d838d9a68fb6b07600a872c28f46" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a5bcd15278af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a5bcd15278af", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790007253, "last_seen": 1790864545, "transport": "t", "ja3_hash": "f35dab354c6c250813a84c1bac2a4c1b", "ja3_variant_count": 2, "ja3_variants": [ "f35dab354c6c250813a84c1bac2a4c1b", "094bf0a886144aa01c90a71bc7cc775c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a6ecbde58d5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a6ecbde58d5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789763228, "last_seen": 1789763228, "transport": "t", "ja3_hash": "4b15e0ee71596ae3a90707106d85ad60", "ja3_variant_count": 1, "ja3_variants": [ "4b15e0ee71596ae3a90707106d85ad60" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.2890.48 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a9272a33bb59", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a9272a33bb59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791222048, "last_seen": 1791222048, "transport": "t", "ja3_hash": "e9a8bdbcdd14d8931dd77f8606ccd434", "ja3_variant_count": 1, "ja3_variants": [ "e9a8bdbcdd14d8931dd77f8606ccd434" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a934b6d7c01b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a934b6d7c01b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790053082, "last_seen": 1790053082, "transport": "t", "ja3_hash": "281a5235137a5843adba6e89e160d5d1", "ja3_variant_count": 1, "ja3_variants": [ "281a5235137a5843adba6e89e160d5d1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_aae3ce536500", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "aae3ce536500", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-13-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789008979, "last_seen": 1789008979, "transport": "t", "ja3_hash": "027c87e4d13aee0657f4c6b6f71b2e58", "ja3_variant_count": 1, "ja3_variants": [ "027c87e4d13aee0657f4c6b6f71b2e58" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_ab3af0cd00f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "ab3af0cd00f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-51-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788824146, "last_seen": 1789688807, "transport": "t", "ja3_hash": "d01e30f31c5161c9fcd39af263edc4a5", "ja3_variant_count": 2, "ja3_variants": [ "d01e30f31c5161c9fcd39af263edc4a5", "756c8ddb21f58c5ebe94f3d0f0f4f627" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_ab3ffa0ddc4a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "ab3ffa0ddc4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789061247, "last_seen": 1790708635, "transport": "t", "ja3_hash": "5d98c244ae073005e23bf63ecc3bcf17", "ja3_variant_count": 2, "ja3_variants": [ "5d98c244ae073005e23bf63ecc3bcf17", "d8933ee8f2ecb8af02c369605e72ec2d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b11ae3ce6a3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b11ae3ce6a3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789889712, "last_seen": 1789889712, "transport": "t", "ja3_hash": "06c3ace3e714c9e251100496159dbcfb", "ja3_variant_count": 1, "ja3_variants": [ "06c3ace3e714c9e251100496159dbcfb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b21ca7f83aaf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b21ca7f83aaf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788850759, "last_seen": 1790196235, "transport": "t", "ja3_hash": "f45b8171cb773be7ac03dcd5d30566e1", "ja3_variant_count": 2, "ja3_variants": [ "f45b8171cb773be7ac03dcd5d30566e1", "6f1cc9f43b4b513a18f46f1ff7788690" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b3c1546c8a21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b3c1546c8a21", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789698464, "last_seen": 1791161469, "transport": "t", "ja3_hash": "04b27a8e2d4ee3276e74a45806e890f7", "ja3_variant_count": 3, "ja3_variants": [ "04b27a8e2d4ee3276e74a45806e890f7", "38c09b0f0ef74260fafd83720b137f97", "d84a039d2201679979dc51d205659692" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b4f6aecab746", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b4f6aecab746", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790256370, "last_seen": 1790256370, "transport": "t", "ja3_hash": "67987206dbd5b0548d946ded30508b38", "ja3_variant_count": 1, "ja3_variants": [ "67987206dbd5b0548d946ded30508b38" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b623d8bb4e99", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b623d8bb4e99", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789063163, "last_seen": 1791032234, "transport": "t", "ja3_hash": "bfb24a556fef03a3dc8cf88a38f8b66b", "ja3_variant_count": 2, "ja3_variants": [ "bfb24a556fef03a3dc8cf88a38f8b66b", "ebb0b0bc62fff6f1d394c34b8dd14645" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b711ee288075", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b711ee288075", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789595720, "last_seen": 1790191107, "transport": "t", "ja3_hash": "d079d69ac933561524ad9237073a776a", "ja3_variant_count": 2, "ja3_variants": [ "d079d69ac933561524ad9237073a776a", "e2fcc3f78aa58c5662c1d4785f5f7b39" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b745b703419d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b745b703419d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790482705, "last_seen": 1791122030, "transport": "t", "ja3_hash": "9a3e9ecc72fdff56c576b91760b7a1af", "ja3_variant_count": 2, "ja3_variants": [ "9a3e9ecc72fdff56c576b91760b7a1af", "0f3f4aa34f1d4a31ba343dc8fdabc7c0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b7ce223a8af7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b7ce223a8af7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789632083, "last_seen": 1789632083, "transport": "t", "ja3_hash": "706b067c79930da50afc789df6191f1e", "ja3_variant_count": 1, "ja3_variants": [ "706b067c79930da50afc789df6191f1e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b8d2c71dfc92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b8d2c71dfc92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788837389, "last_seen": 1790029247, "transport": "t", "ja3_hash": "90a0f3960ccfb8f85535e310b171e85b", "ja3_variant_count": 3, "ja3_variants": [ "90a0f3960ccfb8f85535e310b171e85b", "acad2ce944e11564fb09a15f3c44567f", "f3cd4dff7a49390f7c421fc18004c7b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_b9ece846094f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "b9ece846094f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790237486, "last_seen": 1790237486, "transport": "t", "ja3_hash": "73f2550b359adfb5c19f7db7a5cbd5e9", "ja3_variant_count": 1, "ja3_variants": [ "73f2550b359adfb5c19f7db7a5cbd5e9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_bbd6089cbede", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "bbd6089cbede", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1790219980, "last_seen": 1790999408, "transport": "t", "ja3_hash": "58dc2acd369a9810baa4abb320d988b2", "ja3_variant_count": 3, "ja3_variants": [ "58dc2acd369a9810baa4abb320d988b2", "1b6b72f966dacc15ade2cd8fd767f043", "53c4c50caca0d77c1c22cb463967a9c3" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_bce43051f4df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "bce43051f4df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-11-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790605355, "last_seen": 1790605355, "transport": "t", "ja3_hash": "e66c8ff5c8859fe0957fb66e3ab2dc2a", "ja3_variant_count": 1, "ja3_variants": [ "e66c8ff5c8859fe0957fb66e3ab2dc2a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_be750165a1b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "be750165a1b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790300532, "last_seen": 1790300532, "transport": "t", "ja3_hash": "4c7f5ca580117a718171314d863cc9dc", "ja3_variant_count": 1, "ja3_variants": [ "4c7f5ca580117a718171314d863cc9dc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 38 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_c1902a62d122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "c1902a62d122", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 23, "first_seen": 1787631201, "last_seen": 1790234948, "transport": "t", "ja3_hash": "ff034cc7e0984b82b375d63658411b28", "ja3_variant_count": 3, "ja3_variants": [ "ff034cc7e0984b82b375d63658411b28", "976ee2c0e5a09d4fd8d81734066061ca", "3f9185c037d42a0fa9566667363cc892" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3333.179 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3406.83 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.2059.48 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_c20fece43dd8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "c20fece43dd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790004402, "last_seen": 1790004402, "transport": "t", "ja3_hash": "c0b2b0bc583de72c2140e650e3bd49ae", "ja3_variant_count": 1, "ja3_variants": [ "c0b2b0bc583de72c2140e650e3bd49ae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 29 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_c58431e52efb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "c58431e52efb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790088966, "last_seen": 1790088966, "transport": "t", "ja3_hash": "a1aa404f49bade45a64febed4a2843f9", "ja3_variant_count": 1, "ja3_variants": [ "a1aa404f49bade45a64febed4a2843f9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_c7b227b2ba90", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "c7b227b2ba90", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-23-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789146366, "last_seen": 1789146366, "transport": "t", "ja3_hash": "2372416187b15469733268d4df80e3ec", "ja3_variant_count": 1, "ja3_variants": [ "2372416187b15469733268d4df80e3ec" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_c89461d13c1b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "c89461d13c1b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790621948, "last_seen": 1790621948, "transport": "t", "ja3_hash": "d6ede38b39136d1b039f4cae916df177", "ja3_variant_count": 1, "ja3_variants": [ "d6ede38b39136d1b039f4cae916df177" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_ca72890db603", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "ca72890db603", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790046454, "last_seen": 1790046454, "transport": "t", "ja3_hash": "24f98999cc01251f22e116d7b32018c9", "ja3_variant_count": 1, "ja3_variants": [ "24f98999cc01251f22e116d7b32018c9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_cbb9fffb90d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "cbb9fffb90d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-65281-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790365623, "last_seen": 1790365623, "transport": "t", "ja3_hash": "75bf65834ed06ef82cf35ca61a2127e5", "ja3_variant_count": 1, "ja3_variants": [ "75bf65834ed06ef82cf35ca61a2127e5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_cc7526e273b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "cc7526e273b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197574, "last_seen": 1790197574, "transport": "t", "ja3_hash": "9c77319a4a7c216140f1a7df0493812b", "ja3_variant_count": 1, "ja3_variants": [ "9c77319a4a7c216140f1a7df0493812b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_d79220568bd7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "d79220568bd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788745074, "last_seen": 1790218767, "transport": "t", "ja3_hash": "6f601476fe2d95d65ecf18a29a4cad85", "ja3_variant_count": 3, "ja3_variants": [ "6f601476fe2d95d65ecf18a29a4cad85", "85765313990ed4067e580508501f0afc", "6a09cc1d42058b0aef663b68690cdeb5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_d80fedb8d2a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "d80fedb8d2a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790702518, "last_seen": 1790702518, "transport": "t", "ja3_hash": "98ee2277fc1ebf5ccf8cb9379dc29061", "ja3_variant_count": 1, "ja3_variants": [ "98ee2277fc1ebf5ccf8cb9379dc29061" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_d9ded312e17a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "d9ded312e17a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-18-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789737248, "last_seen": 1789737248, "transport": "t", "ja3_hash": "2b74c8eb39764e5e6d6e20d73f2da611", "ja3_variant_count": 1, "ja3_variants": [ "2b74c8eb39764e5e6d6e20d73f2da611" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_dab7a2f68b8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "dab7a2f68b8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024333, "last_seen": 1789024333, "transport": "t", "ja3_hash": "5127e707756325603885f1133795eef7", "ja3_variant_count": 1, "ja3_variants": [ "5127e707756325603885f1133795eef7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 28 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_dbdd68ba4708", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "dbdd68ba4708", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790495137, "last_seen": 1790495137, "transport": "t", "ja3_hash": "f911ac17dfdeb38f91deedc9c42d2476", "ja3_variant_count": 1, "ja3_variants": [ "f911ac17dfdeb38f91deedc9c42d2476" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_df67d0944961", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "df67d0944961", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789692983, "last_seen": 1789692983, "transport": "t", "ja3_hash": "a23bdaabb95f09a8320ea66e073e1711", "ja3_variant_count": 1, "ja3_variants": [ "a23bdaabb95f09a8320ea66e073e1711" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_e1126812e820", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "e1126812e820", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790541160, "last_seen": 1790541160, "transport": "t", "ja3_hash": "18bfdeeefc3051b78f9bb8da3fa2ff54", "ja3_variant_count": 1, "ja3_variants": [ "18bfdeeefc3051b78f9bb8da3fa2ff54" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_e2bc29c52c4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "e2bc29c52c4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788884479, "last_seen": 1791246125, "transport": "t", "ja3_hash": "a472b607e2aadc0916695fed65c74de5", "ja3_variant_count": 3, "ja3_variants": [ "a472b607e2aadc0916695fed65c74de5", "c098405c883f014d891c58cfa3a91993", "efffbbb2442d4ae4ba7f7048eb88ad31" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_e78229106cd6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "e78229106cd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-51-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790507117, "last_seen": 1790789574, "transport": "t", "ja3_hash": "caa701119741374ed088c368d23e155b", "ja3_variant_count": 3, "ja3_variants": [ "caa701119741374ed088c368d23e155b", "15fab13268ed4f5739abe943ab00cee6", "35ce52c7371cd79c38e4612013e0133a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_efc86d4b1a7f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "efc86d4b1a7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-27-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790535513, "last_seen": 1790535513, "transport": "t", "ja3_hash": "b0403c9c822efd16ba8ea9189c6ab052", "ja3_variant_count": 1, "ja3_variants": [ "b0403c9c822efd16ba8ea9189c6ab052" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_f09d387358cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "f09d387358cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790170930, "last_seen": 1790532595, "transport": "t", "ja3_hash": "4c26c2f759cc723412b7e359c3e9d0f8", "ja3_variant_count": 1, "ja3_variants": [ "4c26c2f759cc723412b7e359c3e9d0f8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_f0b97db14b89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "f0b97db14b89", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788864922, "last_seen": 1788864922, "transport": "t", "ja3_hash": "5f1f66729ad642df7a896388cf138232", "ja3_variant_count": 1, "ja3_variants": [ "5f1f66729ad642df7a896388cf138232" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_f507a823e386", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "f507a823e386", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788876085, "last_seen": 1788876085, "transport": "t", "ja3_hash": "3d7b671a8a12ce3c4967a225fc84900a", "ja3_variant_count": 1, "ja3_variants": [ "3d7b671a8a12ce3c4967a225fc84900a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_f5bd1ee3cb4f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "f5bd1ee3cb4f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790562010, "last_seen": 1790562010, "transport": "t", "ja3_hash": "66de289b8df763366ad7fd060cfd2aa9", "ja3_variant_count": 1, "ja3_variants": [ "66de289b8df763366ad7fd060cfd2aa9" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_f65af8f5d210", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "f65af8f5d210", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-51-5,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790256351, "last_seen": 1790256351, "transport": "t", "ja3_hash": "92c036de6ee5618b586e4a9693ffbe24", "ja3_variant_count": 1, "ja3_variants": [ "92c036de6ee5618b586e4a9693ffbe24" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_fa7314977c09", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "fa7314977c09", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-51-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790780269, "last_seen": 1790780269, "transport": "t", "ja3_hash": "f9dfb37e308efd2b364adbd317cfa159", "ja3_variant_count": 1, "ja3_variants": [ "f9dfb37e308efd2b364adbd317cfa159" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_fbff61b6da8f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "fbff61b6da8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790538514, "last_seen": 1790538514, "transport": "t", "ja3_hash": "2a9b0320a6c26e40db5d71904da8e69c", "ja3_variant_count": 1, "ja3_variants": [ "2a9b0320a6c26e40db5d71904da8e69c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_fe8352abbea0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "fe8352abbea0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789340853, "last_seen": 1789340853, "transport": "t", "ja3_hash": "c1b02e30d3dbe5b298ba0a160531f62a", "ja3_variant_count": 1, "ja3_variants": [ "c1b02e30d3dbe5b298ba0a160531f62a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_ff736ef4a661", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "ff736ef4a661", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789888326, "last_seen": 1789888326, "transport": "t", "ja3_hash": "d1f3dd872edcba69cb9b26d75fc7db99", "ja3_variant_count": 1, "ja3_variants": [ "d1f3dd872edcba69cb9b26d75fc7db99" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h1_8daaf6152771_4cf75fc30233", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h1", "b": "8daaf6152771", "c": "4cf75fc30233", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790568113, "last_seen": 1790568113, "transport": "t", "ja3_hash": "0f1eb021755770aa066ba95f6c79139e", "ja3_variant_count": 1, "ja3_variants": [ "0f1eb021755770aa066ba95f6c79139e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_0b3eaee61d21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "0b3eaee61d21", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788776153, "last_seen": 1791133015, "transport": "t", "ja3_hash": "328ba2265e5edc8b25f806a1ca4ed266", "ja3_variant_count": 4, "ja3_variants": [ "328ba2265e5edc8b25f806a1ca4ed266", "d2666ba77a4ffd44b83ad71cf2aada48", "f34c44fc36700f9c3d2fb4fd4f0a40b7", "65c3c40207e8a149e98bea4b71b65170" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_11fbab25dc62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "11fbab25dc62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788806441, "last_seen": 1788806441, "transport": "t", "ja3_hash": "11ccb8e7a94e6c9a47b9423d1a358a32", "ja3_variant_count": 1, "ja3_variants": [ "11ccb8e7a94e6c9a47b9423d1a358a32" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_44a66c48c0a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "44a66c48c0a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790193857, "last_seen": 1790941558, "transport": "t", "ja3_hash": "2cf3182113c77f171d0a9cf48a95029a", "ja3_variant_count": 2, "ja3_variants": [ "2cf3182113c77f171d0a9cf48a95029a", "77d19000d12473c405cb3c77089c1a31" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_4c8f8fd17022", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "4c8f8fd17022", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-16-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790825587, "last_seen": 1790825587, "transport": "t", "ja3_hash": "c11f689c32fc199cecf7fb6d726d2052", "ja3_variant_count": 1, "ja3_variants": [ "c11f689c32fc199cecf7fb6d726d2052" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_4cf75fc30233", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "4cf75fc30233", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-16-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790241854, "last_seen": 1790680741, "transport": "t", "ja3_hash": "54cf0ebebe29d45b9a0091ad729ae7c3", "ja3_variant_count": 2, "ja3_variants": [ "54cf0ebebe29d45b9a0091ad729ae7c3", "22e244ca485261a46b53d93d8e2d866e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 5 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_50fd260dc125", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "50fd260dc125", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788676896, "last_seen": 1790593971, "transport": "t", "ja3_hash": "3bdd20f44d1fce09301decf54a98ec32", "ja3_variant_count": 2, "ja3_variants": [ "3bdd20f44d1fce09301decf54a98ec32", "a2c7e5896b1e199dd33f1a589e8cc718" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_5a944c206e4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "5a944c206e4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791151808, "last_seen": 1791151808, "transport": "t", "ja3_hash": "ffe9aaa6a621cd5e7de7100003988c03", "ja3_variant_count": 1, "ja3_variants": [ "ffe9aaa6a621cd5e7de7100003988c03" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_6996bbacfb40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "6996bbacfb40", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788953671, "last_seen": 1788953671, "transport": "t", "ja3_hash": "5e92008c40094395e2f2c483a7cb6224", "ja3_variant_count": 1, "ja3_variants": [ "5e92008c40094395e2f2c483a7cb6224" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_86a05cbcb501", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "86a05cbcb501", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791169815, "last_seen": 1791169815, "transport": "t", "ja3_hash": "bbe2fbf6103c0860eb3ff2f6e0d00d5d", "ja3_variant_count": 1, "ja3_variants": [ "bbe2fbf6103c0860eb3ff2f6e0d00d5d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_8922f1f34fb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "8922f1f34fb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791036711, "last_seen": 1791036711, "transport": "t", "ja3_hash": "c3b770a1e741413fd454a31fc1fd5ba5", "ja3_variant_count": 1, "ja3_variants": [ "c3b770a1e741413fd454a31fc1fd5ba5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_937be5dfd674", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "937be5dfd674", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788727073, "last_seen": 1790225331, "transport": "t", "ja3_hash": "63ccfac2d71d7a7d08f1d20c4b635bfe", "ja3_variant_count": 2, "ja3_variants": [ "63ccfac2d71d7a7d08f1d20c4b635bfe", "0a095f2235caf67f99852c1ae6dbc413" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_989ec4432876", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "989ec4432876", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-16-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791101277, "last_seen": 1791101277, "transport": "t", "ja3_hash": "049419c4f83dc1911141ffe2c60a622d", "ja3_variant_count": 1, "ja3_variants": [ "049419c4f83dc1911141ffe2c60a622d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_afa7c520448c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "afa7c520448c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790699355, "last_seen": 1790699355, "transport": "t", "ja3_hash": "ef42399e99a0a54f6b7e9e09ec6e8ccb", "ja3_variant_count": 1, "ja3_variants": [ "ef42399e99a0a54f6b7e9e09ec6e8ccb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_bc33887b114f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "bc33887b114f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-51-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789638900, "last_seen": 1790548602, "transport": "t", "ja3_hash": "23b09603e1936cce8f117d42a898d3f3", "ja3_variant_count": 2, "ja3_variants": [ "23b09603e1936cce8f117d42a898d3f3", "63185ce11127e6a7189c224da9e10580" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 93 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_c0fedda59e3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "c0fedda59e3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-35-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788989944, "last_seen": 1790517364, "transport": "t", "ja3_hash": "2180a8dfa2aaaf6857097e18cf698061", "ja3_variant_count": 2, "ja3_variants": [ "2180a8dfa2aaaf6857097e18cf698061", "c98537eb3e3a9b25e9dba3a8cf0ffe40" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_d5e7f7f4a3bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "d5e7f7f4a3bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790891006, "last_seen": 1790891006, "transport": "t", "ja3_hash": "bfe6921be3a96d06ed98eb50a67d2bd0", "ja3_variant_count": 1, "ja3_variants": [ "bfe6921be3a96d06ed98eb50a67d2bd0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_e5547b945d12", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "e5547b945d12", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790269140, "last_seen": 1790713607, "transport": "t", "ja3_hash": "98c219d71aa343ee4ecd731fa0ad7445", "ja3_variant_count": 2, "ja3_variants": [ "98c219d71aa343ee4ecd731fa0ad7445", "0cfda4636b911a4580599376d9981173" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_ed171916a550", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "ed171916a550", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110217, "last_seen": 1791110217, "transport": "t", "ja3_hash": "feb7e4200145a0740dd81b8160889ed1", "ja3_variant_count": 1, "ja3_variants": [ "feb7e4200145a0740dd81b8160889ed1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_ee9c13c82eaa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "ee9c13c82eaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110255, "last_seen": 1791110255, "transport": "t", "ja3_hash": "2945514ffe74d45867e0c892443ea321", "ja3_variant_count": 1, "ja3_variants": [ "2945514ffe74d45867e0c892443ea321" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_fbcf0a630c1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "fbcf0a630c1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790043149, "last_seen": 1790111186, "transport": "t", "ja3_hash": "57af2e7b0f0ba067a3d81740ace2fb09", "ja3_variant_count": 2, "ja3_variants": [ "57af2e7b0f0ba067a3d81740ace2fb09", "d86d7667a9e0deda895a59e0f89fb07c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_ffc3aabc4169", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "ffc3aabc4169", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-65281-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790238893, "last_seen": 1790238893, "transport": "t", "ja3_hash": "cdaea4663a15c637dec732af78e57aae", "ja3_variant_count": 1, "ja3_variants": [ "cdaea4663a15c637dec732af78e57aae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_00a5a810affa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "00a5a810affa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788837449, "last_seen": 1788837449, "transport": "t", "ja3_hash": "cae7fa187cbcf4284c7dd0876c682c9a", "ja3_variant_count": 1, "ja3_variants": [ "cae7fa187cbcf4284c7dd0876c682c9a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_02019dace9e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "02019dace9e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-27-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788445197, "last_seen": 1788445197, "transport": "t", "ja3_hash": "06e4eee7d17a36570a1c57d953d78cd1", "ja3_variant_count": 1, "ja3_variants": [ "06e4eee7d17a36570a1c57d953d78cd1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_06b37fbb485a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "06b37fbb485a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790226822, "last_seen": 1790226822, "transport": "t", "ja3_hash": "fcb390cd27fe3ccc990a6df20b767344", "ja3_variant_count": 1, "ja3_variants": [ "fcb390cd27fe3ccc990a6df20b767344" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_0888f58c380f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "0888f58c380f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790562010, "last_seen": 1790562010, "transport": "t", "ja3_hash": "8843c67bb26930d90884d846b00accec", "ja3_variant_count": 1, "ja3_variants": [ "8843c67bb26930d90884d846b00accec" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_0b45b8ed3c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "0b45b8ed3c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-51-5-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790222704, "last_seen": 1790222704, "transport": "t", "ja3_hash": "42836e1e32127cabe18599aecc0bf0a5", "ja3_variant_count": 1, "ja3_variants": [ "42836e1e32127cabe18599aecc0bf0a5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_0bd5a3f4eef5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "0bd5a3f4eef5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790226037, "last_seen": 1790226037, "transport": "t", "ja3_hash": "0ebb89bea43555824bfc19093b4db9b2", "ja3_variant_count": 1, "ja3_variants": [ "0ebb89bea43555824bfc19093b4db9b2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_10fe87681b88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "10fe87681b88", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790606127, "last_seen": 1790606127, "transport": "t", "ja3_hash": "f152cfaba02ad4a4c735d01292f5c696", "ja3_variant_count": 1, "ja3_variants": [ "f152cfaba02ad4a4c735d01292f5c696" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 9 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_12894e370ada", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "12894e370ada", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-51764-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508424, "last_seen": 1788508424, "transport": "t", "ja3_hash": "805a7ec53cd8399dc271a1d8f181ddc4", "ja3_variant_count": 1, "ja3_variants": [ "805a7ec53cd8399dc271a1d8f181ddc4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_1635d394a76c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "1635d394a76c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-11-51-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789551716, "last_seen": 1790810166, "transport": "t", "ja3_hash": "b46306f442dc99c066ac5d7c703701d4", "ja3_variant_count": 2, "ja3_variants": [ "b46306f442dc99c066ac5d7c703701d4", "45e5d7a8f8ac3869239c14ed73c4d57d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_196596060592", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "196596060592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788788919, "last_seen": 1788788919, "transport": "t", "ja3_hash": "c9cd54c56888bc151cb0c3017acf08af", "ja3_variant_count": 1, "ja3_variants": [ "c9cd54c56888bc151cb0c3017acf08af" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_1c2d3e276fca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "1c2d3e276fca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-23-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791183491, "last_seen": 1791183491, "transport": "t", "ja3_hash": "4168d973791685aee65561ccf29f8209", "ja3_variant_count": 1, "ja3_variants": [ "4168d973791685aee65561ccf29f8209" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_1d3b1989452e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "1d3b1989452e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-51-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789678215, "last_seen": 1790526844, "transport": "t", "ja3_hash": "023ada2b77b069d4979c2e1a3f026277", "ja3_variant_count": 2, "ja3_variants": [ "023ada2b77b069d4979c2e1a3f026277", "747cb05f6ca8a381e34f7a045ceeb5d6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_21755c9fc930", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "21755c9fc930", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789950623, "last_seen": 1789950623, "transport": "t", "ja3_hash": "595f930df9d862d804408f1162012db2", "ja3_variant_count": 1, "ja3_variants": [ "595f930df9d862d804408f1162012db2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_234c8046f59a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "234c8046f59a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-51-65281-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790997436, "last_seen": 1790997436, "transport": "t", "ja3_hash": "543b1a05426a62d902183200c49ab38b", "ja3_variant_count": 1, "ja3_variants": [ "543b1a05426a62d902183200c49ab38b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_27614f111e7a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "27614f111e7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-27-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790826388, "last_seen": 1790826388, "transport": "t", "ja3_hash": "a5b9158d7ec8ae09247a0e904f3ba302", "ja3_variant_count": 1, "ja3_variants": [ "a5b9158d7ec8ae09247a0e904f3ba302" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_2b1d9c5a8fe1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "2b1d9c5a8fe1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-27-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791160060, "last_seen": 1791160060, "transport": "t", "ja3_hash": "e1f26a4cb1404e06561869112ad56745", "ja3_variant_count": 1, "ja3_variants": [ "e1f26a4cb1404e06561869112ad56745" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_2d0ccb55ba04", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "2d0ccb55ba04", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-45-5-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789929463, "last_seen": 1790507368, "transport": "t", "ja3_hash": "92f7419a22de4181c8e479b79701135c", "ja3_variant_count": 2, "ja3_variants": [ "92f7419a22de4181c8e479b79701135c", "043a8def104e9f55d80c38608ea2ee2a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_2fd4dde2d7cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "2fd4dde2d7cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-65281-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790074688, "last_seen": 1790074688, "transport": "t", "ja3_hash": "6830074de99fd5f9bc1d2a0cc33d63b8", "ja3_variant_count": 1, "ja3_variants": [ "6830074de99fd5f9bc1d2a0cc33d63b8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 7 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_32b7e919372a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "32b7e919372a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-13-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788751428, "last_seen": 1788751428, "transport": "t", "ja3_hash": "5027e66c1c6b83fab4e0c7ed73740701", "ja3_variant_count": 1, "ja3_variants": [ "5027e66c1c6b83fab4e0c7ed73740701" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_332d7d2c3381", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "332d7d2c3381", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51764-17613-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790314075, "last_seen": 1790314075, "transport": "t", "ja3_hash": "7d468b5564db653730408bcf43ba3bbc", "ja3_variant_count": 1, "ja3_variants": [ "7d468b5564db653730408bcf43ba3bbc" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_364bc988e4bd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "364bc988e4bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-51-10-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790738620, "last_seen": 1790738620, "transport": "t", "ja3_hash": "958993ee73c8ede695c1838649414594", "ja3_variant_count": 1, "ja3_variants": [ "958993ee73c8ede695c1838649414594" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_380a2780bb20", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "380a2780bb20", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730643, "last_seen": 1789730643, "transport": "t", "ja3_hash": "94fd96e541190189cca49ee5fe056f01", "ja3_variant_count": 1, "ja3_variants": [ "94fd96e541190189cca49ee5fe056f01" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3868ac5b9628", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3868ac5b9628", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-51-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789753036, "last_seen": 1791077426, "transport": "t", "ja3_hash": "b193c2662a0b7a7ba43fecc52d7013d5", "ja3_variant_count": 2, "ja3_variants": [ "b193c2662a0b7a7ba43fecc52d7013d5", "5245f9cbf3c3ce5da22f0867f53d951e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_38c232bfd579", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "38c232bfd579", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790995172, "last_seen": 1790995172, "transport": "t", "ja3_hash": "40ed25f8e8f6f729417eb134b7ecff63", "ja3_variant_count": 1, "ja3_variants": [ "40ed25f8e8f6f729417eb134b7ecff63" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_39324acfbe15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "39324acfbe15", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788867988, "last_seen": 1788867988, "transport": "t", "ja3_hash": "0864775a6594b2819e781afca22fd375", "ja3_variant_count": 1, "ja3_variants": [ "0864775a6594b2819e781afca22fd375" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3e37e8d1526f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3e37e8d1526f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-65037-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790607044, "last_seen": 1790607044, "transport": "t", "ja3_hash": "1549c6d6c32b74c7ccc5308896fe08a5", "ja3_variant_count": 1, "ja3_variants": [ "1549c6d6c32b74c7ccc5308896fe08a5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3eb85d922e19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3eb85d922e19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-13-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790532851, "last_seen": 1791207779, "transport": "t", "ja3_hash": "be8841a2b1d57f3e56b482a2fb1afc50", "ja3_variant_count": 2, "ja3_variants": [ "be8841a2b1d57f3e56b482a2fb1afc50", "c21cd7b55d08f0446221fffac3302e58" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_474a064f242d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "474a064f242d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790172562, "last_seen": 1790172562, "transport": "t", "ja3_hash": "1dc3573d7d5f331faffd776f45039342", "ja3_variant_count": 1, "ja3_variants": [ "1dc3573d7d5f331faffd776f45039342" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_4861b6a7afe3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "4861b6a7afe3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-18-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789068106, "last_seen": 1791228111, "transport": "t", "ja3_hash": "147bf6fae2ea8ee4e663378cb94540c7", "ja3_variant_count": 2, "ja3_variants": [ "147bf6fae2ea8ee4e663378cb94540c7", "bdcb099a2fc55585ce51b41d35545aae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 3 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_48bd592e127a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "48bd592e127a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-35-17613-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790892386, "last_seen": 1790892386, "transport": "t", "ja3_hash": "419b369bdfc8e73654d094f49c3eb144", "ja3_variant_count": 1, "ja3_variants": [ "419b369bdfc8e73654d094f49c3eb144" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_48f04ac861b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "48f04ac861b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-51-10-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790571112, "last_seen": 1790571112, "transport": "t", "ja3_hash": "b94bee4e6fe0b968ebf8e40afc4e4f4b", "ja3_variant_count": 1, "ja3_variants": [ "b94bee4e6fe0b968ebf8e40afc4e4f4b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_4d2458c66a75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "4d2458c66a75", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790256278, "last_seen": 1790256278, "transport": "t", "ja3_hash": "53b18f109bb598799dac504856777ce5", "ja3_variant_count": 1, "ja3_variants": [ "53b18f109bb598799dac504856777ce5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_4e9526171880", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "4e9526171880", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-65281-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791232265, "last_seen": 1791232265, "transport": "t", "ja3_hash": "fc704b0181fadef2275ad4237d369b00", "ja3_variant_count": 1, "ja3_variants": [ "fc704b0181fadef2275ad4237d369b00" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_5571674d786e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "5571674d786e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790224419, "last_seen": 1790224419, "transport": "t", "ja3_hash": "014f7b05f25240190f7f14383c1207a5", "ja3_variant_count": 1, "ja3_variants": [ "014f7b05f25240190f7f14383c1207a5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_57a3bca29026", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "57a3bca29026", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-65281-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790684321, "last_seen": 1790684321, "transport": "t", "ja3_hash": "a1cde3b6cb66ea7a8e1c80928acfbb30", "ja3_variant_count": 1, "ja3_variants": [ "a1cde3b6cb66ea7a8e1c80928acfbb30" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_57ffad0cc8a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "57ffad0cc8a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-51-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790242046, "last_seen": 1790242046, "transport": "t", "ja3_hash": "f8d64263a40077307673cb14daf3b13e", "ja3_variant_count": 1, "ja3_variants": [ "f8d64263a40077307673cb14daf3b13e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_58a63cd320d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "58a63cd320d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-35-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790770025, "last_seen": 1790770025, "transport": "t", "ja3_hash": "2e8aa928b40fdab09918bf5b9fe7038a", "ja3_variant_count": 1, "ja3_variants": [ "2e8aa928b40fdab09918bf5b9fe7038a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_5c004de10948", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "5c004de10948", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-51-51764-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791093920, "last_seen": 1791093920, "transport": "t", "ja3_hash": "842e74c5c9b23904bb9ce1db93f6ab7e", "ja3_variant_count": 1, "ja3_variants": [ "842e74c5c9b23904bb9ce1db93f6ab7e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_5e21d66cbf29", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "5e21d66cbf29", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65037-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791285260, "last_seen": 1791285260, "transport": "t", "ja3_hash": "126caf74614aa4fdc45f26975a7967c8", "ja3_variant_count": 1, "ja3_variants": [ "126caf74614aa4fdc45f26975a7967c8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_62532abf2480", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "62532abf2480", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-5-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789686522, "last_seen": 1789686522, "transport": "t", "ja3_hash": "a129cb80c4d9dacd1b6f3016b27f7a57", "ja3_variant_count": 1, "ja3_variants": [ "a129cb80c4d9dacd1b6f3016b27f7a57" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_625b99951d10", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "625b99951d10", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-45-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790614835, "last_seen": 1790614835, "transport": "t", "ja3_hash": "7d9417a7fd21d7fc04c00a7f257365eb", "ja3_variant_count": 1, "ja3_variants": [ "7d9417a7fd21d7fc04c00a7f257365eb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_660e77fdb33a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "660e77fdb33a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789100520, "last_seen": 1789100520, "transport": "t", "ja3_hash": "2224f6aab636c4ba6c7fd4f51a20ebd8", "ja3_variant_count": 1, "ja3_variants": [ "2224f6aab636c4ba6c7fd4f51a20ebd8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_6807edeb9853", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "6807edeb9853", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790991806, "last_seen": 1790991806, "transport": "t", "ja3_hash": "dd5da1ca42510dfcaab6b12dfebe2756", "ja3_variant_count": 1, "ja3_variants": [ "dd5da1ca42510dfcaab6b12dfebe2756" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_71bf90227c28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "71bf90227c28", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-13-5-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790118338, "last_seen": 1790118338, "transport": "t", "ja3_hash": "431b9214b8eb36f7480e98770ead0c0b", "ja3_variant_count": 1, "ja3_variants": [ "431b9214b8eb36f7480e98770ead0c0b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_74b2a030724f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "74b2a030724f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788617601, "last_seen": 1788617601, "transport": "t", "ja3_hash": "9b8a5fdb6389ad0b325993c34ddb9667", "ja3_variant_count": 1, "ja3_variants": [ "9b8a5fdb6389ad0b325993c34ddb9667" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_74ba1199eb55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "74ba1199eb55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-27-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788866861, "last_seen": 1788866861, "transport": "t", "ja3_hash": "c5e1848a969bc0ca18a36cd6167b9e39", "ja3_variant_count": 1, "ja3_variants": [ "c5e1848a969bc0ca18a36cd6167b9e39" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_750c09a938cd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "750c09a938cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789217883, "last_seen": 1789217883, "transport": "t", "ja3_hash": "fb8bfdd479809908e30e9a3ad720670a", "ja3_variant_count": 1, "ja3_variants": [ "fb8bfdd479809908e30e9a3ad720670a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_7588f98e390c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "7588f98e390c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789899455, "last_seen": 1789899455, "transport": "t", "ja3_hash": "ba4d5d48ace3d32d8a6a7f5dcc82da24", "ja3_variant_count": 1, "ja3_variants": [ "ba4d5d48ace3d32d8a6a7f5dcc82da24" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_77e47693b779", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "77e47693b779", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-27-23-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790850451, "last_seen": 1790850451, "transport": "t", "ja3_hash": "cac229d53833ddafd174acf733700c10", "ja3_variant_count": 1, "ja3_variants": [ "cac229d53833ddafd174acf733700c10" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 14 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_7857931b0f76", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "7857931b0f76", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790650551, "last_seen": 1790650551, "transport": "t", "ja3_hash": "d7c3f17b4b840b7d0f286f47d53c94af", "ja3_variant_count": 1, "ja3_variants": [ "d7c3f17b4b840b7d0f286f47d53c94af" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 YaBrowser/25.2.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_7bdb926b20d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "7bdb926b20d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-5-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788772834, "last_seen": 1788772834, "transport": "t", "ja3_hash": "02023e8b728f9f280d10c5eb61b79a8c", "ja3_variant_count": 1, "ja3_variants": [ "02023e8b728f9f280d10c5eb61b79a8c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_7cf296011e62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "7cf296011e62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790820586, "last_seen": 1790820586, "transport": "t", "ja3_hash": "db5057d631905c380a2ff6bccc320d04", "ja3_variant_count": 1, "ja3_variants": [ "db5057d631905c380a2ff6bccc320d04" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_80abe2e6cf05", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "80abe2e6cf05", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788953964, "last_seen": 1788953964, "transport": "t", "ja3_hash": "de2175a2c08fafdf14a080df6dfa3082", "ja3_variant_count": 1, "ja3_variants": [ "de2175a2c08fafdf14a080df6dfa3082" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_81f81a997a1e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "81f81a997a1e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-13-17613-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790708624, "last_seen": 1790708624, "transport": "t", "ja3_hash": "0366e0609d5b29fbbf4f84cc43ff034e", "ja3_variant_count": 1, "ja3_variants": [ "0366e0609d5b29fbbf4f84cc43ff034e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_82d0e204650f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "82d0e204650f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-17613-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791183485, "last_seen": 1791183485, "transport": "t", "ja3_hash": "c319d178c202a377ee580931a6971c5d", "ja3_variant_count": 1, "ja3_variants": [ "c319d178c202a377ee580931a6971c5d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_887ef72b1cda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "887ef72b1cda", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788829815, "last_seen": 1788829815, "transport": "t", "ja3_hash": "5ecdb6fa8bb1d58b8b8a3a26bcc9ebe8", "ja3_variant_count": 1, "ja3_variants": [ "5ecdb6fa8bb1d58b8b8a3a26bcc9ebe8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_8ab5f1308bde", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "8ab5f1308bde", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-27-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790656272, "last_seen": 1790656272, "transport": "t", "ja3_hash": "e89bfd408b2ad3e5916e7a23f4119ea4", "ja3_variant_count": 1, "ja3_variants": [ "e89bfd408b2ad3e5916e7a23f4119ea4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_8c8ce6b704e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "8c8ce6b704e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788731383, "last_seen": 1788731383, "transport": "t", "ja3_hash": "00b60eb4f153873fdc5392251e350ca1", "ja3_variant_count": 1, "ja3_variants": [ "00b60eb4f153873fdc5392251e350ca1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_8d9bd0c2f7ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "8d9bd0c2f7ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-23-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790976690, "last_seen": 1790976690, "transport": "t", "ja3_hash": "2818fa47ce44675fc4b88497824ee67a", "ja3_variant_count": 1, "ja3_variants": [ "2818fa47ce44675fc4b88497824ee67a" ], "user_agents": { "\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_955fac1a2975", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "955fac1a2975", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-18-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791002905, "last_seen": 1791002905, "transport": "t", "ja3_hash": "49674a768368e5f88784034618228eb5", "ja3_variant_count": 1, "ja3_variants": [ "49674a768368e5f88784034618228eb5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_97eebc4013de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "97eebc4013de", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-45-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790702452, "last_seen": 1790702452, "transport": "t", "ja3_hash": "2c8c4e6a4f3bf0a9a0f2e91a9dce3b3f", "ja3_variant_count": 1, "ja3_variants": [ "2c8c4e6a4f3bf0a9a0f2e91a9dce3b3f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_9c8e9a62a583", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "9c8e9a62a583", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790645589, "last_seen": 1790645589, "transport": "t", "ja3_hash": "515915a54f480deda68100561aeff001", "ja3_variant_count": 1, "ja3_variants": [ "515915a54f480deda68100561aeff001" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a13a5863402e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a13a5863402e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-17613-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790262850, "last_seen": 1790262850, "transport": "t", "ja3_hash": "d26ada6e0be49385b7e3b16910325401", "ja3_variant_count": 1, "ja3_variants": [ "d26ada6e0be49385b7e3b16910325401" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a548fb0c7456", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a548fb0c7456", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-18-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791168408, "last_seen": 1791168408, "transport": "t", "ja3_hash": "7d4659262190a65705323012400fa9e2", "ja3_variant_count": 1, "ja3_variants": [ "7d4659262190a65705323012400fa9e2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a647d6cb5232", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a647d6cb5232", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-17613-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790160968, "last_seen": 1790160968, "transport": "t", "ja3_hash": "8ea41d51b19ce0ac74004d05a9cd2f80", "ja3_variant_count": 1, "ja3_variants": [ "8ea41d51b19ce0ac74004d05a9cd2f80" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a725d68ee6a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a725d68ee6a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51764-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789470191, "last_seen": 1789470191, "transport": "t", "ja3_hash": "4506b1238289b27d56a83db7fffe2e70", "ja3_variant_count": 1, "ja3_variants": [ "4506b1238289b27d56a83db7fffe2e70" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a8778362cad2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a8778362cad2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-11-35-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791285737, "last_seen": 1791285737, "transport": "t", "ja3_hash": "9d97da95c0776651023bf940e1c15d7e", "ja3_variant_count": 1, "ja3_variants": [ "9d97da95c0776651023bf940e1c15d7e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a8c879d9e493", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a8c879d9e493", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-65281-18-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790334598, "last_seen": 1790334598, "transport": "t", "ja3_hash": "b1c639dae5a03f79b9fe51e61663de69", "ja3_variant_count": 1, "ja3_variants": [ "b1c639dae5a03f79b9fe51e61663de69" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 41 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a9f02d1452a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a9f02d1452a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-27-51-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790466960, "last_seen": 1790466960, "transport": "t", "ja3_hash": "ed977f2ec0bb683e385564319fb20bce", "ja3_variant_count": 1, "ja3_variants": [ "ed977f2ec0bb683e385564319fb20bce" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_ad6cd6e21ec8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "ad6cd6e21ec8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-51-65281-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790658026, "last_seen": 1790658026, "transport": "t", "ja3_hash": "47abf97e9e5765c1873a8c976b344935", "ja3_variant_count": 1, "ja3_variants": [ "47abf97e9e5765c1873a8c976b344935" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.5 Mobile/15A372 Safari/604.1": 3 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_adf4075135e8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "adf4075135e8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790617292, "last_seen": 1790617292, "transport": "t", "ja3_hash": "ad59420cbb99f1888520c04e2002a79d", "ja3_variant_count": 1, "ja3_variants": [ "ad59420cbb99f1888520c04e2002a79d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_ae76c64e55dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "ae76c64e55dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-4832-27-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788642766, "last_seen": 1788642766, "transport": "t", "ja3_hash": "d6d6feba6cd1e1462666b069671a8f78", "ja3_variant_count": 1, "ja3_variants": [ "d6d6feba6cd1e1462666b069671a8f78" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_ae8603611079", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "ae8603611079", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788981450, "last_seen": 1788981450, "transport": "t", "ja3_hash": "8af9c6e2449cbbdf993b8c942f96c2aa", "ja3_variant_count": 1, "ja3_variants": [ "8af9c6e2449cbbdf993b8c942f96c2aa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_b51b2d97c520", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "b51b2d97c520", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-5-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789751583, "last_seen": 1789751583, "transport": "t", "ja3_hash": "b9e02fc6f4d63117d61aabaa79fc54d1", "ja3_variant_count": 1, "ja3_variants": [ "b9e02fc6f4d63117d61aabaa79fc54d1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 170 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_b54fac9b3f83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "b54fac9b3f83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-45-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790207207, "last_seen": 1790207207, "transport": "t", "ja3_hash": "547ccaf3d94331bbbb6d3e7522256388", "ja3_variant_count": 1, "ja3_variants": [ "547ccaf3d94331bbbb6d3e7522256388" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_b8b7ae883ecb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "b8b7ae883ecb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-51-45-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789637304, "last_seen": 1789637304, "transport": "t", "ja3_hash": "f71cbb7ff3489a8085c98a8bd46af3ce", "ja3_variant_count": 1, "ja3_variants": [ "f71cbb7ff3489a8085c98a8bd46af3ce" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_c0870eaf8f4f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "c0870eaf8f4f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-27-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791287519, "last_seen": 1791287519, "transport": "t", "ja3_hash": "51ce02790d450e6f55c4b24b48322baa", "ja3_variant_count": 1, "ja3_variants": [ "51ce02790d450e6f55c4b24b48322baa" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_c62758775ed0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "c62758775ed0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-35-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788975151, "last_seen": 1789656713, "transport": "t", "ja3_hash": "7ee71bf85950954a291615902764fe68", "ja3_variant_count": 2, "ja3_variants": [ "7ee71bf85950954a291615902764fe68", "9f9eb6fab4ad963c3a02b0524c2ae823" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_c7e02e582735", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "c7e02e582735", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790750833, "last_seen": 1790750833, "transport": "t", "ja3_hash": "0ee824d77b21bc026c3a274e214b3906", "ja3_variant_count": 1, "ja3_variants": [ "0ee824d77b21bc026c3a274e214b3906" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_cd371d06426a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "cd371d06426a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790258373, "last_seen": 1790258373, "transport": "t", "ja3_hash": "f94370c65511823b2fb9cfac4e3ad482", "ja3_variant_count": 1, "ja3_variants": [ "f94370c65511823b2fb9cfac4e3ad482" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_cf22eaaa2441", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "cf22eaaa2441", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789831232, "last_seen": 1789831232, "transport": "t", "ja3_hash": "54548ad810ac1cc0ec885295cfded9eb", "ja3_variant_count": 1, "ja3_variants": [ "54548ad810ac1cc0ec885295cfded9eb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_d4adaf7c647d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "d4adaf7c647d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-5-51-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027362, "last_seen": 1789027362, "transport": "t", "ja3_hash": "c5ae8db906db285d05fc2e429fc688d8", "ja3_variant_count": 1, "ja3_variants": [ "c5ae8db906db285d05fc2e429fc688d8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_d97a14f2ea98", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "d97a14f2ea98", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-51-17613-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790715328, "last_seen": 1791302811, "transport": "t", "ja3_hash": "6fc143453f79373abba3b4caf3535339", "ja3_variant_count": 2, "ja3_variants": [ "6fc143453f79373abba3b4caf3535339", "f8c572ca097125a5b319f99c924acdf0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_db35d37cce2e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "db35d37cce2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790124025, "last_seen": 1790730174, "transport": "t", "ja3_hash": "6bc3a7fd5261842bc2a221ffb7b38655", "ja3_variant_count": 2, "ja3_variants": [ "6bc3a7fd5261842bc2a221ffb7b38655", "cfab642a3819c3be97d56bf55822e31d" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_e8a2ff3e190e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "e8a2ff3e190e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-23-27-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788806403, "last_seen": 1790215876, "transport": "t", "ja3_hash": "1f789fa2fe5116516f8ac7b0a00c4e0f", "ja3_variant_count": 2, "ja3_variants": [ "1f789fa2fe5116516f8ac7b0a00c4e0f", "63fbca09287d066b71b11bb05fec039d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_ead29e7b9cdb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "ead29e7b9cdb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-51764-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790991550, "last_seen": 1790991550, "transport": "t", "ja3_hash": "6e9278a78658dd730f57893cd9b8387c", "ja3_variant_count": 1, "ja3_variants": [ "6e9278a78658dd730f57893cd9b8387c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_eba26e8ef5e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "eba26e8ef5e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791162187, "last_seen": 1791162187, "transport": "t", "ja3_hash": "0ef0f3649ccf9522af6a2b31968b25ac", "ja3_variant_count": 1, "ja3_variants": [ "0ef0f3649ccf9522af6a2b31968b25ac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_efd731c0cfef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "efd731c0cfef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-17613-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789146369, "last_seen": 1789146369, "transport": "t", "ja3_hash": "ffffb4f3c3c241bc9bdfdd06435f6124", "ja3_variant_count": 1, "ja3_variants": [ "ffffb4f3c3c241bc9bdfdd06435f6124" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f53d4f0c6d83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f53d4f0c6d83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788574076, "last_seen": 1790881521, "transport": "t", "ja3_hash": "41ec2ad0de8d1442e54b1e33b52f26c9", "ja3_variant_count": 2, "ja3_variants": [ "41ec2ad0de8d1442e54b1e33b52f26c9", "93e009ec8c98c07eaed52bf0e5db2238" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12i150500_8daaf6152771_f5f663cb0124", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f5f663cb0124", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788989474, "last_seen": 1788989474, "transport": "t", "ja3_hash": "311579d755e39c5982598fd2570bf9c9", "ja3_variant_count": 1, "ja3_variants": [ "311579d755e39c5982598fd2570bf9c9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f7eeb30d850a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f7eeb30d850a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-27-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789267468, "last_seen": 1789267468, "transport": "t", "ja3_hash": "041e9a98b24d83e050b9d66988771c00", "ja3_variant_count": 1, "ja3_variants": [ "041e9a98b24d83e050b9d66988771c00" ], "user_agents": { "Mozilla/5.0 (Linux; Android 13; SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f8633ab59c6a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f8633ab59c6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-10-11-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790236636, "last_seen": 1790236636, "transport": "t", "ja3_hash": "6e9392ea8fef6814903778eb7805ac32", "ja3_variant_count": 1, "ja3_variants": [ "6e9392ea8fef6814903778eb7805ac32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f9ec18a3129f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f9ec18a3129f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-51-18-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790517748, "last_seen": 1790517748, "transport": "t", "ja3_hash": "19fcfc5c50f77dc074089a1e8c7326e3", "ja3_variant_count": 1, "ja3_variants": [ "19fcfc5c50f77dc074089a1e8c7326e3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_fa0b95461a4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "fa0b95461a4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-51-45-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789436391, "last_seen": 1789436391, "transport": "t", "ja3_hash": "8eae7d518801095773b50c5441a20fc9", "ja3_variant_count": 1, "ja3_variants": [ "8eae7d518801095773b50c5441a20fc9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_fc367d277595", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "fc367d277595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-23-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789812224, "last_seen": 1789812224, "transport": "t", "ja3_hash": "c7c109b14ef38fc29a8fe36ff26a91f7", "ja3_variant_count": 1, "ja3_variants": [ "c7c109b14ef38fc29a8fe36ff26a91f7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_fee7f720eaff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "fee7f720eaff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-65037-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789770854, "last_seen": 1790870985, "transport": "t", "ja3_hash": "c83b44d2b35473d41f225fe703782b6c", "ja3_variant_count": 2, "ja3_variants": [ "c83b44d2b35473d41f225fe703782b6c", "a3522381d201ebe8c40d8af54d4116c2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1505h1_8daaf6152771_07e4f9b8ebbb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h1", "b": "8daaf6152771", "c": "07e4f9b8ebbb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790533565, "last_seen": 1790533565, "transport": "t", "ja3_hash": "3ab90475f07ba49cad9ff88366bf5427", "ja3_variant_count": 1, "ja3_variants": [ "3ab90475f07ba49cad9ff88366bf5427" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h1_8daaf6152771_d6a7f0f15e43", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h1", "b": "8daaf6152771", "c": "d6a7f0f15e43", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791265253, "last_seen": 1791265253, "transport": "t", "ja3_hash": "95f2926de5e098feef8767c52c1eafb6", "ja3_variant_count": 1, "ja3_variants": [ "95f2926de5e098feef8767c52c1eafb6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_00e5fdb5727a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "00e5fdb5727a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789118480, "last_seen": 1789118480, "transport": "t", "ja3_hash": "018ad0452e9a3ecd4d2dbc8a4b7f7e40", "ja3_variant_count": 1, "ja3_variants": [ "018ad0452e9a3ecd4d2dbc8a4b7f7e40" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_018dfa0d69ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "018dfa0d69ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789839355, "last_seen": 1789839355, "transport": "t", "ja3_hash": "1cd70a95eb345c1daa611289c1630293", "ja3_variant_count": 1, "ja3_variants": [ "1cd70a95eb345c1daa611289c1630293" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_0ed55ef70383", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "0ed55ef70383", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-16-13-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790516682, "last_seen": 1790516682, "transport": "t", "ja3_hash": "f95ffa240d2cbc39d820756e57b00eb5", "ja3_variant_count": 1, "ja3_variants": [ "f95ffa240d2cbc39d820756e57b00eb5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_1486ec6095e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "1486ec6095e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789732681, "last_seen": 1789732681, "transport": "t", "ja3_hash": "7bbce73c1ab0f5a56863604eb85ec61a", "ja3_variant_count": 1, "ja3_variants": [ "7bbce73c1ab0f5a56863604eb85ec61a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 29 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_15067eac09f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "15067eac09f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-65281-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788874852, "last_seen": 1788874852, "transport": "t", "ja3_hash": "60424e7d730e2ba320597814130b1686", "ja3_variant_count": 1, "ja3_variants": [ "60424e7d730e2ba320597814130b1686" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_215713d6aacd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "215713d6aacd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-16-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790237642, "last_seen": 1790729388, "transport": "t", "ja3_hash": "1c469e8e3159140f0763d3f9c5fefd00", "ja3_variant_count": 2, "ja3_variants": [ "1c469e8e3159140f0763d3f9c5fefd00", "217a40cd069bfe1c2f4b53594a658cc1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_249aebe329b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "249aebe329b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-5-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791110255, "last_seen": 1791213907, "transport": "t", "ja3_hash": "4a0d5292a088217deb1fa4bd74fb19dd", "ja3_variant_count": 2, "ja3_variants": [ "4a0d5292a088217deb1fa4bd74fb19dd", "95f7430ef7ae50950916cdfe0025ba78" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_24de37dbacc0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "24de37dbacc0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-18-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790730246, "last_seen": 1790730246, "transport": "t", "ja3_hash": "9daef002714494c926421a89ac7c617e", "ja3_variant_count": 1, "ja3_variants": [ "9daef002714494c926421a89ac7c617e" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_2cf7292e4b88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "2cf7292e4b88", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-16-13-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788489306, "last_seen": 1789029452, "transport": "t", "ja3_hash": "0a446f8cbc0a0b860185e49cb5e77ca9", "ja3_variant_count": 2, "ja3_variants": [ "0a446f8cbc0a0b860185e49cb5e77ca9", "f087001ee769d6e3cd396e11a59fe52f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_3c4171387c6a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "3c4171387c6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-18-51-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790910149, "last_seen": 1790910149, "transport": "t", "ja3_hash": "eb82620bbe57e0e3fd5eab57760348fc", "ja3_variant_count": 1, "ja3_variants": [ "eb82620bbe57e0e3fd5eab57760348fc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_3ede70aea242", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "3ede70aea242", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-16-45-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788902993, "last_seen": 1788902993, "transport": "t", "ja3_hash": "1db8ce339cb792a9f1f455cab9f85d6f", "ja3_variant_count": 1, "ja3_variants": [ "1db8ce339cb792a9f1f455cab9f85d6f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_3f6cec4fe4d3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "3f6cec4fe4d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-51-17613-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790235720, "last_seen": 1790235720, "transport": "t", "ja3_hash": "7ae5a7d5815e1a0027715880f837dad8", "ja3_variant_count": 1, "ja3_variants": [ "7ae5a7d5815e1a0027715880f837dad8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_414261538b63", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "414261538b63", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-16-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790722108, "last_seen": 1791018548, "transport": "t", "ja3_hash": "98b0bd34b9a861052dd284506ec021bf", "ja3_variant_count": 2, "ja3_variants": [ "98b0bd34b9a861052dd284506ec021bf", "720c62ab884d132374d7e6552fdc0342" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_48c49dda0114", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "48c49dda0114", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-13-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790221180, "last_seen": 1790221180, "transport": "t", "ja3_hash": "72c8a596b18ab9ff788e36b926124aa7", "ja3_variant_count": 1, "ja3_variants": [ "72c8a596b18ab9ff788e36b926124aa7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_4fbed1a3bf06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "4fbed1a3bf06", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-17613-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790235506, "last_seen": 1790235506, "transport": "t", "ja3_hash": "d08158d6df538f2b2a311615826c7f55", "ja3_variant_count": 1, "ja3_variants": [ "d08158d6df538f2b2a311615826c7f55" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_50e27b483c85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "50e27b483c85", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-16-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790601304, "last_seen": 1790601304, "transport": "t", "ja3_hash": "96e26a11ddb7ef3233d7600726f57ad9", "ja3_variant_count": 1, "ja3_variants": [ "96e26a11ddb7ef3233d7600726f57ad9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 4 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_5697063f5c25", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "5697063f5c25", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-45-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790176839, "last_seen": 1790176839, "transport": "t", "ja3_hash": "8013317d0bf303abac68d43aed91b4dd", "ja3_variant_count": 1, "ja3_variants": [ "8013317d0bf303abac68d43aed91b4dd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_576eefa15e01", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "576eefa15e01", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-51-13-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789698047, "last_seen": 1789698047, "transport": "t", "ja3_hash": "9d60fad3d4b13ba4a6137f650aa3472d", "ja3_variant_count": 1, "ja3_variants": [ "9d60fad3d4b13ba4a6137f650aa3472d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_593de5067a8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "593de5067a8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788728081, "last_seen": 1788728081, "transport": "t", "ja3_hash": "464289aef370a8e9daf864a80971f29a", "ja3_variant_count": 1, "ja3_variants": [ "464289aef370a8e9daf864a80971f29a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_6459372540ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "6459372540ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-18-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790200840, "last_seen": 1790200840, "transport": "t", "ja3_hash": "41e0e90c9b698d461697a3d3ff2313ef", "ja3_variant_count": 1, "ja3_variants": [ "41e0e90c9b698d461697a3d3ff2313ef" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_77152613864b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "77152613864b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-16-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791272580, "last_seen": 1791272580, "transport": "t", "ja3_hash": "6e0ebfb10c180049b66b667e1f8df3df", "ja3_variant_count": 1, "ja3_variants": [ "6e0ebfb10c180049b66b667e1f8df3df" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_7a9b9a19fcfc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "7a9b9a19fcfc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788780463, "last_seen": 1788780463, "transport": "t", "ja3_hash": "35376d3d7a80a30d4598ddbecc86c76a", "ja3_variant_count": 1, "ja3_variants": [ "35376d3d7a80a30d4598ddbecc86c76a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_81c0aea2cb2c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "81c0aea2cb2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-45-16-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790256333, "last_seen": 1790256333, "transport": "t", "ja3_hash": "50e02ed3c7e3ff7bd2ae7a4f054905cd", "ja3_variant_count": 1, "ja3_variants": [ "50e02ed3c7e3ff7bd2ae7a4f054905cd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_865f5858365c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "865f5858365c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791135417, "last_seen": 1791135417, "transport": "t", "ja3_hash": "3f667f31daf07931a6a2b4f8522d42bf", "ja3_variant_count": 1, "ja3_variants": [ "3f667f31daf07931a6a2b4f8522d42bf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_90d704a1ce5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "90d704a1ce5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790689790, "last_seen": 1790689790, "transport": "t", "ja3_hash": "9b69f3a78f1ad5306cb7989f3c1e7e44", "ja3_variant_count": 1, "ja3_variants": [ "9b69f3a78f1ad5306cb7989f3c1e7e44" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_973c2305602d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "973c2305602d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-16-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788659605, "last_seen": 1788659605, "transport": "t", "ja3_hash": "1fadbace1082bf44b4e01700b200acd0", "ja3_variant_count": 1, "ja3_variants": [ "1fadbace1082bf44b4e01700b200acd0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_979e2dce12af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "979e2dce12af", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-17613-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788775530, "last_seen": 1791014957, "transport": "t", "ja3_hash": "b93532ca1d96890f6ea34ea0bee88e39", "ja3_variant_count": 2, "ja3_variants": [ "b93532ca1d96890f6ea34ea0bee88e39", "6c3e86f548547fc8301615816bf9b755" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_9d0a82b4e08d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "9d0a82b4e08d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789645501, "last_seen": 1789645501, "transport": "t", "ja3_hash": "2f26fbd693cfd8254756e28b07ac25cc", "ja3_variant_count": 1, "ja3_variants": [ "2f26fbd693cfd8254756e28b07ac25cc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_9e0eea664116", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "9e0eea664116", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-27-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789783695, "last_seen": 1789783695, "transport": "t", "ja3_hash": "92f1a99b1dd344c241b01a4c5ef2fefb", "ja3_variant_count": 1, "ja3_variants": [ "92f1a99b1dd344c241b01a4c5ef2fefb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_a03da84f8e20", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "a03da84f8e20", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-17613-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791045159, "last_seen": 1791045159, "transport": "t", "ja3_hash": "05fbe2a392e6279a7122171d084240ab", "ja3_variant_count": 1, "ja3_variants": [ "05fbe2a392e6279a7122171d084240ab" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_a1a8e7adc85b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "a1a8e7adc85b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-65037-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789490176, "last_seen": 1789490176, "transport": "t", "ja3_hash": "26d00d41aa1e8d85a2b2031f483ae021", "ja3_variant_count": 1, "ja3_variants": [ "26d00d41aa1e8d85a2b2031f483ae021" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_aa9c8f4595c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "aa9c8f4595c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789569357, "last_seen": 1789569357, "transport": "t", "ja3_hash": "059d4e98c7e0ed46cf6e05c21fa3a679", "ja3_variant_count": 1, "ja3_variants": [ "059d4e98c7e0ed46cf6e05c21fa3a679" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_ab6fe90bc22d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "ab6fe90bc22d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790214872, "last_seen": 1790214872, "transport": "t", "ja3_hash": "c8a8de78ebea52f7fe82ced634eccf3f", "ja3_variant_count": 1, "ja3_variants": [ "c8a8de78ebea52f7fe82ced634eccf3f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_b54375549db3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "b54375549db3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-4832-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789636623, "last_seen": 1789636623, "transport": "t", "ja3_hash": "932b95e77f9a7e08c313cd332ac82511", "ja3_variant_count": 1, "ja3_variants": [ "932b95e77f9a7e08c313cd332ac82511" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_b8096f3c2241", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "b8096f3c2241", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-5-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788762399, "last_seen": 1788762399, "transport": "t", "ja3_hash": "7d63d16968b32839a92992a50c24a765", "ja3_variant_count": 1, "ja3_variants": [ "7d63d16968b32839a92992a50c24a765" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_b913789bd8fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "b913789bd8fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-10-16-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790245411, "last_seen": 1790245411, "transport": "t", "ja3_hash": "8bf9ed3096ba2c56925fb668a33db642", "ja3_variant_count": 1, "ja3_variants": [ "8bf9ed3096ba2c56925fb668a33db642" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_c2e3a95f8649", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "c2e3a95f8649", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-35-27-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788797539, "last_seen": 1788797539, "transport": "t", "ja3_hash": "c8a372b0b994eb4d645a2b0c5b0436d4", "ja3_variant_count": 1, "ja3_variants": [ "c8a372b0b994eb4d645a2b0c5b0436d4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_cf82c4fa2215", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "cf82c4fa2215", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-51764-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791101275, "last_seen": 1791101275, "transport": "t", "ja3_hash": "ab6727e2d61d30d925fa1a942aef11b9", "ja3_variant_count": 1, "ja3_variants": [ "ab6727e2d61d30d925fa1a942aef11b9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_d895c19cee2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "d895c19cee2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-51-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788973300, "last_seen": 1788973300, "transport": "t", "ja3_hash": "769e108ffb08e6d679f1c9c5a2e47446", "ja3_variant_count": 1, "ja3_variants": [ "769e108ffb08e6d679f1c9c5a2e47446" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_e33ca6fe2ab0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "e33ca6fe2ab0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-16-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791054472, "last_seen": 1791054472, "transport": "t", "ja3_hash": "0fc87ea97c80eed793c2c6ca3432e247", "ja3_variant_count": 1, "ja3_variants": [ "0fc87ea97c80eed793c2c6ca3432e247" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_e88585ec13f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "e88585ec13f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790245005, "last_seen": 1790245005, "transport": "t", "ja3_hash": "a4f15bec38e8a38110e01664e7da537c", "ja3_variant_count": 1, "ja3_variants": [ "a4f15bec38e8a38110e01664e7da537c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_eab4904aa888", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "eab4904aa888", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-13-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789950015, "last_seen": 1789950015, "transport": "t", "ja3_hash": "b77bfee0263042359bbc0f2ab3434d14", "ja3_variant_count": 1, "ja3_variants": [ "b77bfee0263042359bbc0f2ab3434d14" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_ef19d2af4c1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "ef19d2af4c1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-18-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790235251, "last_seen": 1790235251, "transport": "t", "ja3_hash": "308ba5317d235a351f4d8c676c602db5", "ja3_variant_count": 1, "ja3_variants": [ "308ba5317d235a351f4d8c676c602db5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_f4757612fa37", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "f4757612fa37", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-51-65281-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788572484, "last_seen": 1788572484, "transport": "t", "ja3_hash": "840aa65d686163899e60c2161fac1715", "ja3_variant_count": 1, "ja3_variants": [ "840aa65d686163899e60c2161fac1715" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_f4ca7a797661", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "f4ca7a797661", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-65037-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241008, "last_seen": 1790241008, "transport": "t", "ja3_hash": "7cfb9b54e8a3f752c6dac6525002a1aa", "ja3_variant_count": 1, "ja3_variants": [ "7cfb9b54e8a3f752c6dac6525002a1aa" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_fae1f4605f12", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "fae1f4605f12", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-16-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791093154, "last_seen": 1791093154, "transport": "t", "ja3_hash": "49a5a5da0e5a8ddb0cf7cf901679250b", "ja3_variant_count": 1, "ja3_variants": [ "49a5a5da0e5a8ddb0cf7cf901679250b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_fbfbc27b821f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "fbfbc27b821f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-51764-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790698932, "last_seen": 1790698932, "transport": "t", "ja3_hash": "51a8a41a507d4ccb2445651255b36201", "ja3_variant_count": 1, "ja3_variants": [ "51a8a41a507d4ccb2445651255b36201" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 92 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_094197fcbfad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "094197fcbfad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-35-11-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789150683, "last_seen": 1789150683, "transport": "t", "ja3_hash": "46f950b3e22a46838f5c619e79951c71", "ja3_variant_count": 1, "ja3_variants": [ "46f950b3e22a46838f5c619e79951c71" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 38 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_0b3516cedc89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "0b3516cedc89", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-35-18-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790160504, "last_seen": 1790160504, "transport": "t", "ja3_hash": "392b4aa97f5e8b599642a885eb330783", "ja3_variant_count": 1, "ja3_variants": [ "392b4aa97f5e8b599642a885eb330783" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_0ba13315f866", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "0ba13315f866", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-65281-51-27-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791120213, "last_seen": 1791120213, "transport": "t", "ja3_hash": "af43c8e0cc82b1aa78e499fab0a9e01a", "ja3_variant_count": 1, "ja3_variants": [ "af43c8e0cc82b1aa78e499fab0a9e01a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_0bbd1e906efe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "0bbd1e906efe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-23-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791183526, "last_seen": 1791183526, "transport": "t", "ja3_hash": "75c633b99593aa10f0a42ae1d6c43f74", "ja3_variant_count": 1, "ja3_variants": [ "75c633b99593aa10f0a42ae1d6c43f74" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_0d1d30308122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "0d1d30308122", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-65281-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656768, "last_seen": 1789656768, "transport": "t", "ja3_hash": "cda32ff5aeca18c0fd1f5ed1f35cef66", "ja3_variant_count": 1, "ja3_variants": [ "cda32ff5aeca18c0fd1f5ed1f35cef66" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Vivaldi/7.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_1836b75ad1a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "1836b75ad1a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-23-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790245475, "last_seen": 1790245475, "transport": "t", "ja3_hash": "9445e24fe5aea731764b0f3aaae70ac7", "ja3_variant_count": 1, "ja3_variants": [ "9445e24fe5aea731764b0f3aaae70ac7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_1837135c42ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "1837135c42ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-35-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789658528, "last_seen": 1791088627, "transport": "t", "ja3_hash": "1cfccb5c22ce4bd2962d803d9d028cbc", "ja3_variant_count": 3, "ja3_variants": [ "1cfccb5c22ce4bd2962d803d9d028cbc", "b65b5ad9a34aafd7313be309ef0c72e9", "d0b2002d225e51d58f6de471d013d274" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_19ea8a4109d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "19ea8a4109d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-5-65037-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790555031, "last_seen": 1790555031, "transport": "t", "ja3_hash": "5031a3bac27bc7a34f0e858df27b04d3", "ja3_variant_count": 1, "ja3_variants": [ "5031a3bac27bc7a34f0e858df27b04d3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_1d4268fe7de8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "1d4268fe7de8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-10-45-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788792121, "last_seen": 1788792121, "transport": "t", "ja3_hash": "57aa0c7b9166681739b8cf354aafed1e", "ja3_variant_count": 1, "ja3_variants": [ "57aa0c7b9166681739b8cf354aafed1e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_1f7ce424fedd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "1f7ce424fedd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-65281-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790256498, "last_seen": 1790256498, "transport": "t", "ja3_hash": "21d9207233a2bfcd9ddcbd62cccb8354", "ja3_variant_count": 1, "ja3_variants": [ "21d9207233a2bfcd9ddcbd62cccb8354" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_273873507a31", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "273873507a31", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-45-13-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790697951, "last_seen": 1790697951, "transport": "t", "ja3_hash": "e7f2575924be9f62254bb3cb5db7aa11", "ja3_variant_count": 1, "ja3_variants": [ "e7f2575924be9f62254bb3cb5db7aa11" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_27a77a2864e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "27a77a2864e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-65281-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202319, "last_seen": 1790202319, "transport": "t", "ja3_hash": "f2cb187d6d2d7983bbe6ec5c58be1152", "ja3_variant_count": 1, "ja3_variants": [ "f2cb187d6d2d7983bbe6ec5c58be1152" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_293be4868a3b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "293be4868a3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-10-65037-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789294829, "last_seen": 1789294829, "transport": "t", "ja3_hash": "460b9883568cd0871063e106a19878e7", "ja3_variant_count": 1, "ja3_variants": [ "460b9883568cd0871063e106a19878e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_2d3c86a2df51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "2d3c86a2df51", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-13-23-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790409410, "last_seen": 1790409410, "transport": "t", "ja3_hash": "d3d9c464e9b1ae037aed13a183de4ff7", "ja3_variant_count": 1, "ja3_variants": [ "d3d9c464e9b1ae037aed13a183de4ff7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_3214943c4210", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "3214943c4210", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-45-10-23-35,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790207526, "last_seen": 1790207526, "transport": "t", "ja3_hash": "bcd6106ea729ad04ad72c2c0c05fe0bc", "ja3_variant_count": 1, "ja3_variants": [ "bcd6106ea729ad04ad72c2c0c05fe0bc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_32ceffa8c324", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "32ceffa8c324", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-27-51-17613-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790797361, "last_seen": 1790797361, "transport": "t", "ja3_hash": "c4292e36fbe88b3fa05c8085ae8b7672", "ja3_variant_count": 1, "ja3_variants": [ "c4292e36fbe88b3fa05c8085ae8b7672" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_35bab2dd8b08", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "35bab2dd8b08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-17613-45-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790015356, "last_seen": 1790015356, "transport": "t", "ja3_hash": "5abd9fce58f04df96d2d329968d7da57", "ja3_variant_count": 1, "ja3_variants": [ "5abd9fce58f04df96d2d329968d7da57" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_35f0403f2753", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "35f0403f2753", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-13-5-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791154162, "last_seen": 1791154162, "transport": "t", "ja3_hash": "4ef1246b339161e3f317f5c415d6bd6a", "ja3_variant_count": 1, "ja3_variants": [ "4ef1246b339161e3f317f5c415d6bd6a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 90 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_36d2fa7d59da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "36d2fa7d59da", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-27-18-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790537078, "last_seen": 1790537078, "transport": "t", "ja3_hash": "34e3d3b97ec5b84c2896029188f85cdd", "ja3_variant_count": 1, "ja3_variants": [ "34e3d3b97ec5b84c2896029188f85cdd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_39655852cc9d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "39655852cc9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-35-65281-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789014945, "last_seen": 1789014945, "transport": "t", "ja3_hash": "bf2c4cc8170df97c3b17849ac71950f6", "ja3_variant_count": 1, "ja3_variants": [ "bf2c4cc8170df97c3b17849ac71950f6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_3c0553fe1d7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "3c0553fe1d7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-5-11-65281-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789912447, "last_seen": 1789912447, "transport": "t", "ja3_hash": "d693e2d2fb026a51efa092b7d23da74a", "ja3_variant_count": 1, "ja3_variants": [ "d693e2d2fb026a51efa092b7d23da74a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_3dbf02c10693", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "3dbf02c10693", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-65281-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790850418, "last_seen": 1790850418, "transport": "t", "ja3_hash": "0dbc2a6b184b106540ffe12f60216fe5", "ja3_variant_count": 1, "ja3_variants": [ "0dbc2a6b184b106540ffe12f60216fe5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_4334c424629a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "4334c424629a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-45-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789396325, "last_seen": 1789396325, "transport": "t", "ja3_hash": "4f8539eb293095783a2ae2b10e87c92b", "ja3_variant_count": 1, "ja3_variants": [ "4f8539eb293095783a2ae2b10e87c92b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_45954740716e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "45954740716e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-18-45-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788885162, "last_seen": 1788885162, "transport": "t", "ja3_hash": "e9bb4c3de8aae64328f39eaff1f91c30", "ja3_variant_count": 1, "ja3_variants": [ "e9bb4c3de8aae64328f39eaff1f91c30" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_47ac6c6295a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "47ac6c6295a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-10-65281-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790195799, "last_seen": 1791135749, "transport": "t", "ja3_hash": "0cc5b0993668ad2e558897b0647098c2", "ja3_variant_count": 2, "ja3_variants": [ "0cc5b0993668ad2e558897b0647098c2", "8d799dc68927942c39eaf08f92d84a7e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_47b1dd9b6321", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "47b1dd9b6321", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-10-51-23-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790842307, "last_seen": 1790842307, "transport": "t", "ja3_hash": "41ca3bc83a544f2d2582cb070552ac63", "ja3_variant_count": 1, "ja3_variants": [ "41ca3bc83a544f2d2582cb070552ac63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_4abb65c9bf47", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "4abb65c9bf47", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-65037-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788834513, "last_seen": 1788834513, "transport": "t", "ja3_hash": "ce5f63bcc037f034cc4bae73f7d9964c", "ja3_variant_count": 1, "ja3_variants": [ "ce5f63bcc037f034cc4bae73f7d9964c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_4d889e96c0b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "4d889e96c0b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-35-51-13-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790242949, "last_seen": 1791030951, "transport": "t", "ja3_hash": "7e423bf318fa9e670379dcbd77d84c12", "ja3_variant_count": 2, "ja3_variants": [ "7e423bf318fa9e670379dcbd77d84c12", "7e005540fdc4a918960210163dca9b09" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_4f691f6a79a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "4f691f6a79a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-65281-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241248, "last_seen": 1790241248, "transport": "t", "ja3_hash": "5c2fbfb6616dd846b6870598d19c2c7d", "ja3_variant_count": 1, "ja3_variants": [ "5c2fbfb6616dd846b6870598d19c2c7d" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_5550c7bdc92f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "5550c7bdc92f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-35-17613-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790819989, "last_seen": 1790819989, "transport": "t", "ja3_hash": "099d0d3813812836d864c01f318530a0", "ja3_variant_count": 1, "ja3_variants": [ "099d0d3813812836d864c01f318530a0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_56ad2cfda573", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "56ad2cfda573", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-5-23-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788808556, "last_seen": 1788808556, "transport": "t", "ja3_hash": "6f6c1aa7c2d39c3fad8cdd60997eb67c", "ja3_variant_count": 1, "ja3_variants": [ "6f6c1aa7c2d39c3fad8cdd60997eb67c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_5c0ef4f6936f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "5c0ef4f6936f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-17613-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790246708, "last_seen": 1790246708, "transport": "t", "ja3_hash": "730cc46133b3e9ee6b7535a9b090429a", "ja3_variant_count": 1, "ja3_variants": [ "730cc46133b3e9ee6b7535a9b090429a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_5e9c0a953b1a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "5e9c0a953b1a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65037-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790532954, "last_seen": 1790532954, "transport": "t", "ja3_hash": "279daef87f6ca7b35ca357dd5d2ccce4", "ja3_variant_count": 1, "ja3_variants": [ "279daef87f6ca7b35ca357dd5d2ccce4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_643b8426ca4a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "643b8426ca4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-45-65281-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791278937, "last_seen": 1791278937, "transport": "t", "ja3_hash": "367b2a03aaad1d7d64991bb36a0293f8", "ja3_variant_count": 1, "ja3_variants": [ "367b2a03aaad1d7d64991bb36a0293f8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_675fbd75641a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "675fbd75641a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-35-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788837758, "last_seen": 1788942574, "transport": "t", "ja3_hash": "08e00a1f2982c0cd885a9fbb17a07360", "ja3_variant_count": 2, "ja3_variants": [ "08e00a1f2982c0cd885a9fbb17a07360", "13a8718529641ac0b769e76ada53536f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_6e28f47db6e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "6e28f47db6e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-27-35-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788762168, "last_seen": 1788762168, "transport": "t", "ja3_hash": "60c606bdba03701d90f0a0cc1fc90e89", "ja3_variant_count": 1, "ja3_variants": [ "60c606bdba03701d90f0a0cc1fc90e89" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_791c1a01ccb1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "791c1a01ccb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-5-51-10-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790531167, "last_seen": 1790531167, "transport": "t", "ja3_hash": "393a3c8ed218232d6fa6c39e7830f03e", "ja3_variant_count": 1, "ja3_variants": [ "393a3c8ed218232d6fa6c39e7830f03e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_7a5b9a87fdd6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "7a5b9a87fdd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-13-51-18-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789351842, "last_seen": 1789351842, "transport": "t", "ja3_hash": "d5caa4272578dbc49a5a206e1dab3ebf", "ja3_variant_count": 1, "ja3_variants": [ "d5caa4272578dbc49a5a206e1dab3ebf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_7b71c96bb12b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "7b71c96bb12b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17513-65037-10-11-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790519970, "last_seen": 1790519970, "transport": "t", "ja3_hash": "2f71a9edeed3868e33735da30b525e5f", "ja3_variant_count": 1, "ja3_variants": [ "2f71a9edeed3868e33735da30b525e5f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_7e4550f4627f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "7e4550f4627f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-17613-18-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788639820, "last_seen": 1788639820, "transport": "t", "ja3_hash": "406fdd8bb137893eea991b1279bd37e7", "ja3_variant_count": 1, "ja3_variants": [ "406fdd8bb137893eea991b1279bd37e7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_827bc458bef3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "827bc458bef3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-35-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790794874, "last_seen": 1790794874, "transport": "t", "ja3_hash": "3359ef149ef8a01ff559eb40bdf8b8c4", "ja3_variant_count": 1, "ja3_variants": [ "3359ef149ef8a01ff559eb40bdf8b8c4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_83dbbd15e0d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "83dbbd15e0d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-35-10-51-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791139668, "last_seen": 1791139668, "transport": "t", "ja3_hash": "f51f45451548be45159cddcaca8b134d", "ja3_variant_count": 1, "ja3_variants": [ "f51f45451548be45159cddcaca8b134d" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_864251b56dc3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "864251b56dc3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-5-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931632, "last_seen": 1789931632, "transport": "t", "ja3_hash": "7973f7f5936427c09f460d3ede41effe", "ja3_variant_count": 1, "ja3_variants": [ "7973f7f5936427c09f460d3ede41effe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 6 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_864c1b8d46e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "864c1b8d46e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-51-18-23-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790256370, "last_seen": 1790256370, "transport": "t", "ja3_hash": "7a032d6a2c0166ca71a5eeafbd34ee0f", "ja3_variant_count": 1, "ja3_variants": [ "7a032d6a2c0166ca71a5eeafbd34ee0f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_86b38226b296", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "86b38226b296", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-45-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788646790, "last_seen": 1788646790, "transport": "t", "ja3_hash": "ddea8f9f3488d07bf13772ab6400476b", "ja3_variant_count": 1, "ja3_variants": [ "ddea8f9f3488d07bf13772ab6400476b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_887fb496a537", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "887fb496a537", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-27-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788793361, "last_seen": 1788793361, "transport": "t", "ja3_hash": "2a0b845caf441253ea56fc6706f4f945", "ja3_variant_count": 1, "ja3_variants": [ "2a0b845caf441253ea56fc6706f4f945" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_90778be49b34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "90778be49b34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-18-65037-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789559497, "last_seen": 1789559497, "transport": "t", "ja3_hash": "2472f16a51e5c8eefc5549cd6f6c444e", "ja3_variant_count": 1, "ja3_variants": [ "2472f16a51e5c8eefc5549cd6f6c444e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_9605944f5499", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "9605944f5499", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-65281-17613-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790167622, "last_seen": 1790167622, "transport": "t", "ja3_hash": "d1dd0d34fe3c2704455ed0af3cc716ec", "ja3_variant_count": 1, "ja3_variants": [ "d1dd0d34fe3c2704455ed0af3cc716ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_98c14a1156fd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "98c14a1156fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-18-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788763552, "last_seen": 1788763552, "transport": "t", "ja3_hash": "1854b013a90cd517c36ba23f6144a2ef", "ja3_variant_count": 1, "ja3_variants": [ "1854b013a90cd517c36ba23f6144a2ef" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_9e31763dec8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "9e31763dec8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-65281-13-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788996102, "last_seen": 1788996102, "transport": "t", "ja3_hash": "3df825244ad13c1c818a4104196eebdc", "ja3_variant_count": 1, "ja3_variants": [ "3df825244ad13c1c818a4104196eebdc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_a32a8511cf52", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "a32a8511cf52", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-51-35-13-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789654447, "last_seen": 1789654447, "transport": "t", "ja3_hash": "35ede6be2c8aa384d072bc17b99a4d98", "ja3_variant_count": 1, "ja3_variants": [ "35ede6be2c8aa384d072bc17b99a4d98" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_a33076a6e985", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "a33076a6e985", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-65281-17613-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789023381, "last_seen": 1789023381, "transport": "t", "ja3_hash": "6b1807b8ca919722d9cf83437c6e79d2", "ja3_variant_count": 1, "ja3_variants": [ "6b1807b8ca919722d9cf83437c6e79d2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_a8c6caa2cda1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "a8c6caa2cda1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-11-65281-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790066291, "last_seen": 1790066291, "transport": "t", "ja3_hash": "1b0d37d208eb4356794118434d2041b3", "ja3_variant_count": 1, "ja3_variants": [ "1b0d37d208eb4356794118434d2041b3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_ad086e4afecd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "ad086e4afecd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-51-18-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789710732, "last_seen": 1789710732, "transport": "t", "ja3_hash": "5ea94096664495f688806fe402ca2c0f", "ja3_variant_count": 1, "ja3_variants": [ "5ea94096664495f688806fe402ca2c0f" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.2208.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_ae03bb9a7348", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "ae03bb9a7348", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-65281-10-51-65037,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789882084, "last_seen": 1789882084, "transport": "t", "ja3_hash": "c3601a1dbb3da1b47e9089a523d264b4", "ja3_variant_count": 1, "ja3_variants": [ "c3601a1dbb3da1b47e9089a523d264b4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_b45a77358524", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "b45a77358524", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-35-5-13-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790056518, "last_seen": 1790056518, "transport": "t", "ja3_hash": "71ef8f65d6776bc53bd403cd5dff8343", "ja3_variant_count": 1, "ja3_variants": [ "71ef8f65d6776bc53bd403cd5dff8343" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_b58807c43663", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "b58807c43663", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-17613-27-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788811394, "last_seen": 1788811394, "transport": "t", "ja3_hash": "060bbd6e1d92bc12be702075773203ba", "ja3_variant_count": 1, "ja3_variants": [ "060bbd6e1d92bc12be702075773203ba" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_b925890feb60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "b925890feb60", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-45-23-65281-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790905489, "last_seen": 1790905489, "transport": "t", "ja3_hash": "289ad93aef1c5291e9401739bbc5c881", "ja3_variant_count": 1, "ja3_variants": [ "289ad93aef1c5291e9401739bbc5c881" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_b9e80a578e89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "b9e80a578e89", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-10-13-51-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790548427, "last_seen": 1790548427, "transport": "t", "ja3_hash": "97ff492e132e39c0bf1ff29db858770d", "ja3_variant_count": 1, "ja3_variants": [ "97ff492e132e39c0bf1ff29db858770d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_bb29892b6387", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "bb29892b6387", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-65281-11-5-17613,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789746836, "last_seen": 1789746836, "transport": "t", "ja3_hash": "4833e205566d65d4cd47d10fb77a938d", "ja3_variant_count": 1, "ja3_variants": [ "4833e205566d65d4cd47d10fb77a938d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_c2b9f23dfe57", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "c2b9f23dfe57", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-13-51-27-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790124010, "last_seen": 1790124010, "transport": "t", "ja3_hash": "1572aa97a38b247a678b713af233890e", "ja3_variant_count": 1, "ja3_variants": [ "1572aa97a38b247a678b713af233890e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 23 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_c2efd3ad11ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "c2efd3ad11ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-51-11-5-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789593936, "last_seen": 1789593936, "transport": "t", "ja3_hash": "2a3996870a894cd1fdfc7d139577e9ae", "ja3_variant_count": 1, "ja3_variants": [ "2a3996870a894cd1fdfc7d139577e9ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_c788fcd305a2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "c788fcd305a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-51-18-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791078367, "last_seen": 1791078367, "transport": "t", "ja3_hash": "b0ed380c7039515b211b7f39936f4b53", "ja3_variant_count": 1, "ja3_variants": [ "b0ed380c7039515b211b7f39936f4b53" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_c95607385809", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "c95607385809", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-23-11-27-17613,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790237242, "last_seen": 1790237242, "transport": "t", "ja3_hash": "b6ed52334ed0d6af86518fe01e0d0c43", "ja3_variant_count": 1, "ja3_variants": [ "b6ed52334ed0d6af86518fe01e0d0c43" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_c95dfcd3174a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "c95dfcd3174a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65037-45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791110328, "last_seen": 1791110328, "transport": "t", "ja3_hash": "3aab92cb5f1eb873393081c68575bb5c", "ja3_variant_count": 1, "ja3_variants": [ "3aab92cb5f1eb873393081c68575bb5c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_cf2ea50fd026", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "cf2ea50fd026", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-13-23-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788607231, "last_seen": 1788607231, "transport": "t", "ja3_hash": "8cbd91226e422fa2d686caf345d20770", "ja3_variant_count": 1, "ja3_variants": [ "8cbd91226e422fa2d686caf345d20770" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_d1a7622268d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "d1a7622268d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-10-65281-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791209369, "last_seen": 1791209369, "transport": "t", "ja3_hash": "0800f80ae4318d787809025fcec8a730", "ja3_variant_count": 1, "ja3_variants": [ "0800f80ae4318d787809025fcec8a730" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_de1f247ae4a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "de1f247ae4a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-10-18-5-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788849129, "last_seen": 1788849129, "transport": "t", "ja3_hash": "a8e6845affb60e65c55d491dc579ed3f", "ja3_variant_count": 1, "ja3_variants": [ "a8e6845affb60e65c55d491dc579ed3f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_e4140d2a0147", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "e4140d2a0147", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-23-18-51-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788862382, "last_seen": 1788862382, "transport": "t", "ja3_hash": "cbfa426adf3ab9fc23e5d7c5697d1dd7", "ja3_variant_count": 1, "ja3_variants": [ "cbfa426adf3ab9fc23e5d7c5697d1dd7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_e43695ee1125", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "e43695ee1125", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-10-27-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790418300, "last_seen": 1790418300, "transport": "t", "ja3_hash": "35927369d0e2f0d8ccc9a54a9649471a", "ja3_variant_count": 1, "ja3_variants": [ "35927369d0e2f0d8ccc9a54a9649471a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_e53c1e6e06d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "e53c1e6e06d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-45-51-13-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790203298, "last_seen": 1790203298, "transport": "t", "ja3_hash": "7e44a78efba70e34235e1d7f3c6feb5a", "ja3_variant_count": 1, "ja3_variants": [ "7e44a78efba70e34235e1d7f3c6feb5a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_e7544a7f295d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "e7544a7f295d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-65281-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790166993, "last_seen": 1790166993, "transport": "t", "ja3_hash": "5dfc5df21db54b847fa41bf19fb6ce97", "ja3_variant_count": 1, "ja3_variants": [ "5dfc5df21db54b847fa41bf19fb6ce97" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_e8a64de69299", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "e8a64de69299", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-23-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788846479, "last_seen": 1788846479, "transport": "t", "ja3_hash": "213cd7e7c5ad3a7fdf2b18dd50ab891e", "ja3_variant_count": 1, "ja3_variants": [ "213cd7e7c5ad3a7fdf2b18dd50ab891e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_e955a95ad90d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "e955a95ad90d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-51-10-23-17613,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788806950, "last_seen": 1788806950, "transport": "t", "ja3_hash": "4df3e9c0601a90b127d758e173043f2a", "ja3_variant_count": 1, "ja3_variants": [ "4df3e9c0601a90b127d758e173043f2a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_ec91a835a578", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "ec91a835a578", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-51-23-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790007292, "last_seen": 1790007292, "transport": "t", "ja3_hash": "688164b458051d3ee92e830eacc3571a", "ja3_variant_count": 1, "ja3_variants": [ "688164b458051d3ee92e830eacc3571a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_f2069b570608", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "f2069b570608", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-5-18-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791134320, "last_seen": 1791134320, "transport": "t", "ja3_hash": "95de954cbd7280527bd8c393a5d29795", "ja3_variant_count": 1, "ja3_variants": [ "95de954cbd7280527bd8c393a5d29795" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_f290a7462693", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "f290a7462693", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-5-35-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788766614, "last_seen": 1788766614, "transport": "t", "ja3_hash": "a2eba33a47f690276038c8eb2a94d06b", "ja3_variant_count": 1, "ja3_variants": [ "a2eba33a47f690276038c8eb2a94d06b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_f34caeb9730e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "f34caeb9730e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-27-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788964896, "last_seen": 1788964896, "transport": "t", "ja3_hash": "f9184c1f6d86c8985e1bc97e2fce0311", "ja3_variant_count": 1, "ja3_variants": [ "f9184c1f6d86c8985e1bc97e2fce0311" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_f45900534652", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "f45900534652", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-5-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790160933, "last_seen": 1790160933, "transport": "t", "ja3_hash": "c80d52c88dcad7b6662d10387b921078", "ja3_variant_count": 1, "ja3_variants": [ "c80d52c88dcad7b6662d10387b921078" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_fa41407d520a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "fa41407d520a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-27-11-51-65037,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788838669, "last_seen": 1790650627, "transport": "t", "ja3_hash": "fe9c233635eb450c082205decf2ec6a1", "ja3_variant_count": 2, "ja3_variants": [ "fe9c233635eb450c082205decf2ec6a1", "4894f5a39dfb61e075773ce9259b89e2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_fe8de4e405e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "fe8de4e405e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-18-27-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790660482, "last_seen": 1790660482, "transport": "t", "ja3_hash": "a6a36c20c3d7bc7acbd57bc4d68a850a", "ja3_variant_count": 1, "ja3_variants": [ "a6a36c20c3d7bc7acbd57bc4d68a850a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1506h1_8daaf6152771_5fd102aef670", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h1", "b": "8daaf6152771", "c": "5fd102aef670", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-51-10-5-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790979588, "last_seen": 1790979588, "transport": "t", "ja3_hash": "1fc5010c85a2103b3702f4e11e6dffe9", "ja3_variant_count": 1, "ja3_variants": [ "1fc5010c85a2103b3702f4e11e6dffe9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_00186e61df35", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "00186e61df35", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-65281-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789054595, "last_seen": 1789054595, "transport": "t", "ja3_hash": "4c6a895182ec387b4bfbff17113d32b4", "ja3_variant_count": 1, "ja3_variants": [ "4c6a895182ec387b4bfbff17113d32b4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_0066c35013da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "0066c35013da", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-18-11-17613-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790049222, "last_seen": 1790049222, "transport": "t", "ja3_hash": "42bb13c11591d1c663abee538c11b075", "ja3_variant_count": 1, "ja3_variants": [ "42bb13c11591d1c663abee538c11b075" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_0209467150dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "0209467150dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-51-16-65281-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791072339, "last_seen": 1791072339, "transport": "t", "ja3_hash": "7b2c4de7cf8d7d0f8331a6dbad5fd655", "ja3_variant_count": 1, "ja3_variants": [ "7b2c4de7cf8d7d0f8331a6dbad5fd655" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_03366366cc97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "03366366cc97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-45-51-27-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790220398, "last_seen": 1790220398, "transport": "t", "ja3_hash": "e557cbc9ebd06623265f9f0f82765e80", "ja3_variant_count": 1, "ja3_variants": [ "e557cbc9ebd06623265f9f0f82765e80" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_057fba5be35f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "057fba5be35f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-13-11-65281-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791162428, "last_seen": 1791162428, "transport": "t", "ja3_hash": "0b8e60aaf69a1bef789952b424c1fee9", "ja3_variant_count": 1, "ja3_variants": [ "0b8e60aaf69a1bef789952b424c1fee9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) QQ/9.9.36-53644 Chrome/144.0.7559.60 Electron/40.0.0 Safari/537.36 OS/win32,x64,10.0.22631,Windows ": 5 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_081dc4e13c55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "081dc4e13c55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-16-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788784245, "last_seen": 1788784245, "transport": "t", "ja3_hash": "9ad7aa195988004ae04004959bbf8041", "ja3_variant_count": 1, "ja3_variants": [ "9ad7aa195988004ae04004959bbf8041" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_0b70091c6e34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "0b70091c6e34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-35-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788724243, "last_seen": 1791151795, "transport": "t", "ja3_hash": "961e91f694f535ada89c132a2ffa52f9", "ja3_variant_count": 2, "ja3_variants": [ "961e91f694f535ada89c132a2ffa52f9", "0f2ebb0e3ad7921433445cd12b28021b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_0c4c096556ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "0c4c096556ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-51-16-17613-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788572610, "last_seen": 1788572610, "transport": "t", "ja3_hash": "94812c84ab7896e48c23344fd513dd16", "ja3_variant_count": 1, "ja3_variants": [ "94812c84ab7896e48c23344fd513dd16" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_1f31923350e8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "1f31923350e8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-35-13-51-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788909450, "last_seen": 1788909450, "transport": "t", "ja3_hash": "3f446e299ffc75842dfed2158fc6f962", "ja3_variant_count": 1, "ja3_variants": [ "3f446e299ffc75842dfed2158fc6f962" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_2494af8acac9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "2494af8acac9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-13-27-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790203299, "last_seen": 1790271380, "transport": "t", "ja3_hash": "3106fcb4700daeddeebd219d358c9168", "ja3_variant_count": 2, "ja3_variants": [ "3106fcb4700daeddeebd219d358c9168", "37467d9879b9a62da44431d862a1e9ac" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_25f618955bf0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "25f618955bf0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-51-35-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790221875, "last_seen": 1790221875, "transport": "t", "ja3_hash": "a81d45f00b44804ffbb0ef7851e506d4", "ja3_variant_count": 1, "ja3_variants": [ "a81d45f00b44804ffbb0ef7851e506d4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_2822a3e25155", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "2822a3e25155", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-16-17613-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790911485, "last_seen": 1790911485, "transport": "t", "ja3_hash": "ebe0d02eadfe903669f178217bf828ec", "ja3_variant_count": 1, "ja3_variants": [ "ebe0d02eadfe903669f178217bf828ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_2e02fbacea45", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "2e02fbacea45", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-51-65281-45-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790575053, "last_seen": 1790575053, "transport": "t", "ja3_hash": "72a6c9115de40f4e2342f24776bd26ef", "ja3_variant_count": 1, "ja3_variants": [ "72a6c9115de40f4e2342f24776bd26ef" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_331bb8534158", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "331bb8534158", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-11-27-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789796842, "last_seen": 1789796842, "transport": "t", "ja3_hash": "73df1b0cd61b77c6f5a984efae252df1", "ja3_variant_count": 1, "ja3_variants": [ "73df1b0cd61b77c6f5a984efae252df1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_3a950372d6bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "3a950372d6bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-13-27-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790835946, "last_seen": 1790835946, "transport": "t", "ja3_hash": "3e1e30f1d231c6de96e0f49579f65a0a", "ja3_variant_count": 1, "ja3_variants": [ "3e1e30f1d231c6de96e0f49579f65a0a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_42aeda5436d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "42aeda5436d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-65037-27-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790823168, "last_seen": 1790823168, "transport": "t", "ja3_hash": "93f89af7fb0b00026020753772919b00", "ja3_variant_count": 1, "ja3_variants": [ "93f89af7fb0b00026020753772919b00" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_4508a323c917", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "4508a323c917", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-65281-5-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790337214, "last_seen": 1790337214, "transport": "t", "ja3_hash": "afa61258c2d864b86dbb574eb301b822", "ja3_variant_count": 1, "ja3_variants": [ "afa61258c2d864b86dbb574eb301b822" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_4f5a0ae52cc8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "4f5a0ae52cc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-17613-16-27-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790144537, "last_seen": 1790144537, "transport": "t", "ja3_hash": "77d699be848c42551aeb2a09c9e6af7a", "ja3_variant_count": 1, "ja3_variants": [ "77d699be848c42551aeb2a09c9e6af7a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_51b329ab840a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "51b329ab840a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-11-51-17613-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791292040, "last_seen": 1791292040, "transport": "t", "ja3_hash": "398bed00c945b562ac42d651340617e4", "ja3_variant_count": 1, "ja3_variants": [ "398bed00c945b562ac42d651340617e4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 22 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_53ac864b937b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "53ac864b937b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-51-10-65281-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788724231, "last_seen": 1789680359, "transport": "t", "ja3_hash": "bbccae4889e2d874efee6d54bf419722", "ja3_variant_count": 2, "ja3_variants": [ "bbccae4889e2d874efee6d54bf419722", "2cc5dd92f78fe00db877036fdad980e3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_5a871b0643ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "5a871b0643ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-65037-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791278237, "last_seen": 1791278237, "transport": "t", "ja3_hash": "10a36736f879434a4c5550b035717f06", "ja3_variant_count": 1, "ja3_variants": [ "10a36736f879434a4c5550b035717f06" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_5c150a4d602a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "5c150a4d602a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-16-18-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790235027, "last_seen": 1790235027, "transport": "t", "ja3_hash": "b386f07632a16c37eb2588a048425cb8", "ja3_variant_count": 1, "ja3_variants": [ "b386f07632a16c37eb2588a048425cb8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_6556a548c122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "6556a548c122", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-13-16-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790773465, "last_seen": 1790773465, "transport": "t", "ja3_hash": "621e8f7875d642a7ee8d8f6e6cdeea70", "ja3_variant_count": 1, "ja3_variants": [ "621e8f7875d642a7ee8d8f6e6cdeea70" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_6ac11b8c312c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "6ac11b8c312c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-10-65037-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790783779, "last_seen": 1790783779, "transport": "t", "ja3_hash": "ac84b2b514b1dafcca5187c038901fcd", "ja3_variant_count": 1, "ja3_variants": [ "ac84b2b514b1dafcca5187c038901fcd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_6bd6a611738d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "6bd6a611738d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-23-17613-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790443309, "last_seen": 1790443309, "transport": "t", "ja3_hash": "94335095a455ab91e9d45285fd3a3db6", "ja3_variant_count": 1, "ja3_variants": [ "94335095a455ab91e9d45285fd3a3db6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_7220f788e2e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "7220f788e2e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-16-5-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790247209, "last_seen": 1790247209, "transport": "t", "ja3_hash": "1e79cbad1b3c052c287420bc70ce49bd", "ja3_variant_count": 1, "ja3_variants": [ "1e79cbad1b3c052c287420bc70ce49bd" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_78c597010496", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "78c597010496", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-16-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790085867, "last_seen": 1790085867, "transport": "t", "ja3_hash": "16202621483db7dfafa43ea8d43716ee", "ja3_variant_count": 1, "ja3_variants": [ "16202621483db7dfafa43ea8d43716ee" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_79f0b49f996b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "79f0b49f996b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-17613-16-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790611232, "last_seen": 1790611232, "transport": "t", "ja3_hash": "189f7d28f0f2489c7bea1bc3e99e0a7a", "ja3_variant_count": 1, "ja3_variants": [ "189f7d28f0f2489c7bea1bc3e99e0a7a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_8143e6aa6a78", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "8143e6aa6a78", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-18-27-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110301, "last_seen": 1791110301, "transport": "t", "ja3_hash": "6751bdf2b5ace296093b6cf543fd30f4", "ja3_variant_count": 1, "ja3_variants": [ "6751bdf2b5ace296093b6cf543fd30f4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_8ddcb5e74667", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "8ddcb5e74667", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-65037-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789796836, "last_seen": 1789796836, "transport": "t", "ja3_hash": "661e5fd30fffcaaab6c2a732430382b2", "ja3_variant_count": 1, "ja3_variants": [ "661e5fd30fffcaaab6c2a732430382b2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_9c8cff872569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "9c8cff872569", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-16-35-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790207411, "last_seen": 1790207411, "transport": "t", "ja3_hash": "a9f1495f30cdb382ea2e2a5d504b71de", "ja3_variant_count": 1, "ja3_variants": [ "a9f1495f30cdb382ea2e2a5d504b71de" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_a25973fa916a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "a25973fa916a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-13-11-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790258156, "last_seen": 1790258156, "transport": "t", "ja3_hash": "e7d665f30c666f65dfd9e942675850da", "ja3_variant_count": 1, "ja3_variants": [ "e7d665f30c666f65dfd9e942675850da" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_a34da209302a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "a34da209302a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-17613-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790841662, "last_seen": 1790841662, "transport": "t", "ja3_hash": "12dbb025828eeecb5649ce9d6e840033", "ja3_variant_count": 1, "ja3_variants": [ "12dbb025828eeecb5649ce9d6e840033" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_a414954f5d24", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "a414954f5d24", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-65037-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788799267, "last_seen": 1788799267, "transport": "t", "ja3_hash": "013b632bb9d68da1e465ae337d618fe9", "ja3_variant_count": 1, "ja3_variants": [ "013b632bb9d68da1e465ae337d618fe9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_a986fbca8175", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "a986fbca8175", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-10-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788608963, "last_seen": 1788608963, "transport": "t", "ja3_hash": "7cbc5ac688f361f37b94856cca769166", "ja3_variant_count": 1, "ja3_variants": [ "7cbc5ac688f361f37b94856cca769166" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_b2f2832a02be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "b2f2832a02be", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-10-65037-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789811976, "last_seen": 1789811976, "transport": "t", "ja3_hash": "8dcccbfe7b80d7dc033c72df03b77c68", "ja3_variant_count": 1, "ja3_variants": [ "8dcccbfe7b80d7dc033c72df03b77c68" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_b68bf6ea551c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "b68bf6ea551c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-35-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789691691, "last_seen": 1789691691, "transport": "t", "ja3_hash": "a478f9336e3c23aff0e95aa96c73fd4c", "ja3_variant_count": 1, "ja3_variants": [ "a478f9336e3c23aff0e95aa96c73fd4c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_b9eb5dfc0641", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "b9eb5dfc0641", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-16-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790216049, "last_seen": 1790216049, "transport": "t", "ja3_hash": "240265a9f3ab075bc04cfd723032d2f2", "ja3_variant_count": 1, "ja3_variants": [ "240265a9f3ab075bc04cfd723032d2f2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_bc5b84fd5782", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "bc5b84fd5782", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-27-18-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790241809, "last_seen": 1790241809, "transport": "t", "ja3_hash": "970f6ae201355ab0dfb2d6efbc03f81b", "ja3_variant_count": 1, "ja3_variants": [ "970f6ae201355ab0dfb2d6efbc03f81b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_bcd4bde94558", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "bcd4bde94558", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-16-35-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790850446, "last_seen": 1790850446, "transport": "t", "ja3_hash": "2668273f078470519343d42719f25d2d", "ja3_variant_count": 1, "ja3_variants": [ "2668273f078470519343d42719f25d2d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_c8afddb0bd35", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "c8afddb0bd35", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-16-17613-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789116832, "last_seen": 1789116832, "transport": "t", "ja3_hash": "be86b8426dc69dd5e437e5131a2408cc", "ja3_variant_count": 1, "ja3_variants": [ "be86b8426dc69dd5e437e5131a2408cc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_cfb0a2c91ae8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "cfb0a2c91ae8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-65037-11-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789203223, "last_seen": 1789203223, "transport": "t", "ja3_hash": "90c246dc45d367ac1bff86a5280d5fc3", "ja3_variant_count": 1, "ja3_variants": [ "90c246dc45d367ac1bff86a5280d5fc3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_d2211503319f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "d2211503319f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-5-16-23-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790876458, "last_seen": 1790876458, "transport": "t", "ja3_hash": "ec4e9f3b98c9a29137589d78bbc84a1f", "ja3_variant_count": 1, "ja3_variants": [ "ec4e9f3b98c9a29137589d78bbc84a1f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_d792aaa440c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "d792aaa440c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-5-23-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788726935, "last_seen": 1788726935, "transport": "t", "ja3_hash": "f396e8d566ad92aa111a67f91b707ecb", "ja3_variant_count": 1, "ja3_variants": [ "f396e8d566ad92aa111a67f91b707ecb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 7 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_da4cf3e0d4b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "da4cf3e0d4b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-51-13-5-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791228109, "last_seen": 1791228109, "transport": "t", "ja3_hash": "805a86bf282ddba3a5dd5e57139075d9", "ja3_variant_count": 1, "ja3_variants": [ "805a86bf282ddba3a5dd5e57139075d9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_dbcb50ef33df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "dbcb50ef33df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-18-23-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790641701, "last_seen": 1790641701, "transport": "t", "ja3_hash": "4002a5ba49b34194056838a75d0a783c", "ja3_variant_count": 1, "ja3_variants": [ "4002a5ba49b34194056838a75d0a783c" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_de18137bce8e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "de18137bce8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-10-35-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790562627, "last_seen": 1790562627, "transport": "t", "ja3_hash": "4905542bc56e998292edf7c470f9021f", "ja3_variant_count": 1, "ja3_variants": [ "4905542bc56e998292edf7c470f9021f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_dea0aacd5083", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "dea0aacd5083", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-51764-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789649706, "last_seen": 1789649706, "transport": "t", "ja3_hash": "dfce6ebdfcde4a1db6586398ee075dc2", "ja3_variant_count": 1, "ja3_variants": [ "dfce6ebdfcde4a1db6586398ee075dc2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 90 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_e0b7aceef8cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "e0b7aceef8cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-10-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788784907, "last_seen": 1788784907, "transport": "t", "ja3_hash": "4731cfc7756ec9ed20cf743b1ac78cee", "ja3_variant_count": 1, "ja3_variants": [ "4731cfc7756ec9ed20cf743b1ac78cee" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_e8a21e801aa3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "e8a21e801aa3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-65037-23-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790265111, "last_seen": 1790265111, "transport": "t", "ja3_hash": "f1d3cc3fd48119eafae07bebc5d4d68c", "ja3_variant_count": 1, "ja3_variants": [ "f1d3cc3fd48119eafae07bebc5d4d68c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_ec076620db4c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "ec076620db4c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-51764-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791027216, "last_seen": 1791027216, "transport": "t", "ja3_hash": "3ca3102d4e34c3f7c9a94e60e09682ae", "ja3_variant_count": 1, "ja3_variants": [ "3ca3102d4e34c3f7c9a94e60e09682ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_f25171cd2f08", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "f25171cd2f08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-51-16-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790123938, "last_seen": 1790123938, "transport": "t", "ja3_hash": "705f743701f324c1d7fbc6889db73f4f", "ja3_variant_count": 1, "ja3_variants": [ "705f743701f324c1d7fbc6889db73f4f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_fadabebf0399", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "fadabebf0399", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,16-10-17613-51-18-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789842139, "last_seen": 1789842139, "transport": "t", "ja3_hash": "e47b9073c44e661a8f61a52033318e3e", "ja3_variant_count": 1, "ja3_variants": [ "e47b9073c44e661a8f61a52033318e3e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_fc5370c5fdbe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "fc5370c5fdbe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-16-13-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789775619, "last_seen": 1789775619, "transport": "t", "ja3_hash": "036fa3de3dcbdc7725bb8eb1d16a79f2", "ja3_variant_count": 1, "ja3_variants": [ "036fa3de3dcbdc7725bb8eb1d16a79f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_020e6e1366bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "020e6e1366bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-45-10-35-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790366376, "last_seen": 1790366376, "transport": "t", "ja3_hash": "2f7d7ea0a72970f88481653cd7feac1f", "ja3_variant_count": 1, "ja3_variants": [ "2f7d7ea0a72970f88481653cd7feac1f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_036a8ff22aba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "036a8ff22aba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-51-11-27-10-13-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789819757, "last_seen": 1789819757, "transport": "t", "ja3_hash": "464240afb05bcfb7d3361fd831708862", "ja3_variant_count": 1, "ja3_variants": [ "464240afb05bcfb7d3361fd831708862" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_0ac22f1b4b9d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "0ac22f1b4b9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-5-51-17613-27-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790675927, "last_seen": 1790675927, "transport": "t", "ja3_hash": "513c232498c144e371c0f61ffdab52e6", "ja3_variant_count": 1, "ja3_variants": [ "513c232498c144e371c0f61ffdab52e6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_0edb7fcc6290", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "0edb7fcc6290", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-18-35-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788785587, "last_seen": 1788785587, "transport": "t", "ja3_hash": "0046f6f29b16c4c469cf82b7a3185915", "ja3_variant_count": 1, "ja3_variants": [ "0046f6f29b16c4c469cf82b7a3185915" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_128e2c87093b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "128e2c87093b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-51764-23-35-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790313362, "last_seen": 1790313362, "transport": "t", "ja3_hash": "3661a78d84dd96895b5f9188b26857a3", "ja3_variant_count": 1, "ja3_variants": [ "3661a78d84dd96895b5f9188b26857a3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_199ed3c26c87", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "199ed3c26c87", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-27-23-13-18-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209082, "last_seen": 1790209082, "transport": "t", "ja3_hash": "2f729cd05abd9217bf8d7b7f7e57aed2", "ja3_variant_count": 1, "ja3_variants": [ "2f729cd05abd9217bf8d7b7f7e57aed2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_22cc16cbe339", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "22cc16cbe339", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-11-65281-27-13-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791019400, "last_seen": 1791019400, "transport": "t", "ja3_hash": "b0fd743676c6d6ec46a2b2a56233f0f0", "ja3_variant_count": 1, "ja3_variants": [ "b0fd743676c6d6ec46a2b2a56233f0f0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 13 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_27ced08b5386", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "27ced08b5386", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-5-51764-23-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790596044, "last_seen": 1790596044, "transport": "t", "ja3_hash": "4eaf38b45478032fbe87bdcf6e283256", "ja3_variant_count": 1, "ja3_variants": [ "4eaf38b45478032fbe87bdcf6e283256" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_28b321bedafd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "28b321bedafd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-45-23-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788765359, "last_seen": 1788765359, "transport": "t", "ja3_hash": "712399a125ebfb8d204079f53152f6a5", "ja3_variant_count": 1, "ja3_variants": [ "712399a125ebfb8d204079f53152f6a5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_2903bfee3012", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "2903bfee3012", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-5-18-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790457835, "last_seen": 1790493204, "transport": "t", "ja3_hash": "8de48031cee1ebb90624bd0db0368fed", "ja3_variant_count": 2, "ja3_variants": [ "8de48031cee1ebb90624bd0db0368fed", "c40204216ce9bf08c6fa5f4221a8a3df" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_2d16a1220881", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "2d16a1220881", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-27-17613-51-13-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110040, "last_seen": 1791110040, "transport": "t", "ja3_hash": "278faa053a59b0689de8e6ca5eaa6a3c", "ja3_variant_count": 1, "ja3_variants": [ "278faa053a59b0689de8e6ca5eaa6a3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_2d45c8d34e23", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "2d45c8d34e23", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-11-45-18-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790689753, "last_seen": 1790689753, "transport": "t", "ja3_hash": "c75a1c8b623de969f212572e4fa111d7", "ja3_variant_count": 1, "ja3_variants": [ "c75a1c8b623de969f212572e4fa111d7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_397c428cb505", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "397c428cb505", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-51-35-18-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791130552, "last_seen": 1791130552, "transport": "t", "ja3_hash": "30ca610a234b0126953135c0c279eec0", "ja3_variant_count": 1, "ja3_variants": [ "30ca610a234b0126953135c0c279eec0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_3df504e4d546", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "3df504e4d546", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-27-5-35-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790766266, "last_seen": 1790766266, "transport": "t", "ja3_hash": "55535f03193816a8b1339b5ad9b79c38", "ja3_variant_count": 1, "ja3_variants": [ "55535f03193816a8b1339b5ad9b79c38" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_47f7baccea0f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "47f7baccea0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-18-10-13-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790651987, "last_seen": 1790651987, "transport": "t", "ja3_hash": "a43208b869b141755f52eb28b0657b2b", "ja3_variant_count": 1, "ja3_variants": [ "a43208b869b141755f52eb28b0657b2b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 6 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_4c441e9e9f28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "4c441e9e9f28", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-17613-35-51-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788853073, "last_seen": 1788853073, "transport": "t", "ja3_hash": "290ea28b635cb7b5362e11160742675d", "ja3_variant_count": 1, "ja3_variants": [ "290ea28b635cb7b5362e11160742675d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_4fad3162d32f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "4fad3162d32f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-65281-35-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790450171, "last_seen": 1790450171, "transport": "t", "ja3_hash": "626dc157686a25f95fc93ca7525d94ac", "ja3_variant_count": 1, "ja3_variants": [ "626dc157686a25f95fc93ca7525d94ac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_52c07d54b541", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "52c07d54b541", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-65037-5-65281-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790350056, "last_seen": 1790350056, "transport": "t", "ja3_hash": "c8c9f35c5085af5d085db02cb7afb58a", "ja3_variant_count": 1, "ja3_variants": [ "c8c9f35c5085af5d085db02cb7afb58a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 6 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_552a9019b956", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "552a9019b956", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-65037-11-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789687180, "last_seen": 1789687180, "transport": "t", "ja3_hash": "e39f9fa2ecc126c38a85aad31fe6a81d", "ja3_variant_count": 1, "ja3_variants": [ "e39f9fa2ecc126c38a85aad31fe6a81d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_5a1c82a80bf1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "5a1c82a80bf1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,18-65037-23-10-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788533336, "last_seen": 1789656796, "transport": "t", "ja3_hash": "5e0ac285ca0bd67a06674daeedb9bff7", "ja3_variant_count": 2, "ja3_variants": [ "5e0ac285ca0bd67a06674daeedb9bff7", "1323f0180711ad90dc65222683985180" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_5ca4dcc0e74a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "5ca4dcc0e74a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-18-65281-51-5-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788878029, "last_seen": 1788878029, "transport": "t", "ja3_hash": "21a898b40a1823cac82531b3f3d4db08", "ja3_variant_count": 1, "ja3_variants": [ "21a898b40a1823cac82531b3f3d4db08" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_5f9ea12cc295", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "5f9ea12cc295", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-11-27-13-45-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790340046, "last_seen": 1790340046, "transport": "t", "ja3_hash": "7a66e531b02eba668260053ef57217a2", "ja3_variant_count": 1, "ja3_variants": [ "7a66e531b02eba668260053ef57217a2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_6084bb0a2d37", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "6084bb0a2d37", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-10-65037-17613-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711524, "last_seen": 1788711524, "transport": "t", "ja3_hash": "9f087a7066dbcce951827e81c971df3c", "ja3_variant_count": 1, "ja3_variants": [ "9f087a7066dbcce951827e81c971df3c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_67c5423fa59d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "67c5423fa59d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-10-27-23-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790823969, "last_seen": 1790823969, "transport": "t", "ja3_hash": "14bc029f32e108bf77f1407963aa9081", "ja3_variant_count": 1, "ja3_variants": [ "14bc029f32e108bf77f1407963aa9081" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_69be72453f5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "69be72453f5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-23-5-18-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790810587, "last_seen": 1790810587, "transport": "t", "ja3_hash": "c354787811111641345b07c0401d544d", "ja3_variant_count": 1, "ja3_variants": [ "c354787811111641345b07c0401d544d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_6e9dadad1f9a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "6e9dadad1f9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-51-5-45-11-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789166729, "last_seen": 1789166729, "transport": "t", "ja3_hash": "001f06f5c751dabe8a83d8b13737e694", "ja3_variant_count": 1, "ja3_variants": [ "001f06f5c751dabe8a83d8b13737e694" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_6fe346eb8790", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "6fe346eb8790", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-13-10-65037-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788768142, "last_seen": 1788768142, "transport": "t", "ja3_hash": "fbd290b31f6e3e25e7ce9d2f1d41b643", "ja3_variant_count": 1, "ja3_variants": [ "fbd290b31f6e3e25e7ce9d2f1d41b643" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_73af9fa9a45a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "73af9fa9a45a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-23-11-27-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790847794, "last_seen": 1790847794, "transport": "t", "ja3_hash": "f9b3f956d591ce1aac95230de581cfcc", "ja3_variant_count": 1, "ja3_variants": [ "f9b3f956d591ce1aac95230de581cfcc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_75c651642535", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "75c651642535", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-51-45-35-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789415505, "last_seen": 1789415505, "transport": "t", "ja3_hash": "5ae82f0862ae7962a6f960534c7dfb97", "ja3_variant_count": 1, "ja3_variants": [ "5ae82f0862ae7962a6f960534c7dfb97" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 15 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_778952d459fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "778952d459fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-65281-11-17613-27-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724241, "last_seen": 1788724241, "transport": "t", "ja3_hash": "0ff96951b65a92d3a5b600ddf8123510", "ja3_variant_count": 1, "ja3_variants": [ "0ff96951b65a92d3a5b600ddf8123510" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_7957b55e0697", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "7957b55e0697", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-18-10-17613-45-35,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790208537, "last_seen": 1790208537, "transport": "t", "ja3_hash": "b55e246a87a6696bc835305581aa7275", "ja3_variant_count": 1, "ja3_variants": [ "b55e246a87a6696bc835305581aa7275" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_7c70b3c88301", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "7c70b3c88301", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-35-45-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790114610, "last_seen": 1790114610, "transport": "t", "ja3_hash": "9ec30362910117534fabaf9386b84a95", "ja3_variant_count": 1, "ja3_variants": [ "9ec30362910117534fabaf9386b84a95" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 20 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_7ef62ae2b2e3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "7ef62ae2b2e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-65281-45-5-23-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788849166, "last_seen": 1788849166, "transport": "t", "ja3_hash": "d3f384fd6cc3dad3ecdc504f12960350", "ja3_variant_count": 1, "ja3_variants": [ "d3f384fd6cc3dad3ecdc504f12960350" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_81664736d960", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "81664736d960", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-51-11-23-27-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788880659, "last_seen": 1788880659, "transport": "t", "ja3_hash": "6f8a0d47fc44aaeb1378f8b55e228dde", "ja3_variant_count": 1, "ja3_variants": [ "6f8a0d47fc44aaeb1378f8b55e228dde" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_8566ab5c5e59", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "8566ab5c5e59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-13-51-5-35-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788532051, "last_seen": 1788532051, "transport": "t", "ja3_hash": "339bb87479a316d62f80174c84e7a599", "ja3_variant_count": 1, "ja3_variants": [ "339bb87479a316d62f80174c84e7a599" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_89804b17caa1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "89804b17caa1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-51-13-27-5-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110160, "last_seen": 1791110160, "transport": "t", "ja3_hash": "e8c3095b8fdacf2802bd645067bd26ae", "ja3_variant_count": 1, "ja3_variants": [ "e8c3095b8fdacf2802bd645067bd26ae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_8b6c085404e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "8b6c085404e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-27-10-51-13-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791208451, "last_seen": 1791208451, "transport": "t", "ja3_hash": "e55b5c58092667d88608fb40974c1e93", "ja3_variant_count": 1, "ja3_variants": [ "e55b5c58092667d88608fb40974c1e93" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_9a65e22ffe92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "9a65e22ffe92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-10-65037-23-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790535267, "last_seen": 1790535267, "transport": "t", "ja3_hash": "d4b55fceb0c556048c319f5f566b239c", "ja3_variant_count": 1, "ja3_variants": [ "d4b55fceb0c556048c319f5f566b239c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_9ad5928603b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "9ad5928603b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-13-23-17613-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789931633, "last_seen": 1789931633, "transport": "t", "ja3_hash": "c494d738d9bcc1ea073daf5dd720169e", "ja3_variant_count": 1, "ja3_variants": [ "c494d738d9bcc1ea073daf5dd720169e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_9b446870f2e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "9b446870f2e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-51764-51-13-65281-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790948072, "last_seen": 1790948072, "transport": "t", "ja3_hash": "f093927bf981b465506a8c97e146a2c7", "ja3_variant_count": 1, "ja3_variants": [ "f093927bf981b465506a8c97e146a2c7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_a23b94368855", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "a23b94368855", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-10-45-51-17613-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789090465, "last_seen": 1789090465, "transport": "t", "ja3_hash": "32a891f17072db3446a7b461bd23b5e4", "ja3_variant_count": 1, "ja3_variants": [ "32a891f17072db3446a7b461bd23b5e4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 235 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_ab7ade6a2521", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "ab7ade6a2521", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-27-65281-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788961391, "last_seen": 1788961391, "transport": "t", "ja3_hash": "c4ea38787b4d101c337edc2bd97096fe", "ja3_variant_count": 1, "ja3_variants": [ "c4ea38787b4d101c337edc2bd97096fe" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_afd31b3d9c4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "afd31b3d9c4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-17613-10-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788776662, "last_seen": 1788776662, "transport": "t", "ja3_hash": "2e28b2d4fcd51e506425388df64ac016", "ja3_variant_count": 1, "ja3_variants": [ "2e28b2d4fcd51e506425388df64ac016" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_b10ad6f929dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "b10ad6f929dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-65281-23-5-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790153981, "last_seen": 1790153981, "transport": "t", "ja3_hash": "3ed411c1c359c49751adac92994f777d", "ja3_variant_count": 1, "ja3_variants": [ "3ed411c1c359c49751adac92994f777d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_b21921c3af5d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "b21921c3af5d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-13-23-5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790245592, "last_seen": 1790245592, "transport": "t", "ja3_hash": "a91cd7626bf2f5e927dd6bf5f6f0943a", "ja3_variant_count": 1, "ja3_variants": [ "a91cd7626bf2f5e927dd6bf5f6f0943a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_bc4cf4be557c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "bc4cf4be557c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-51-17613-18-65281-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789535771, "last_seen": 1789535771, "transport": "t", "ja3_hash": "25c1e93193d00142fe96a3ff66eeb361", "ja3_variant_count": 1, "ja3_variants": [ "25c1e93193d00142fe96a3ff66eeb361" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_bdf4bf8fecd9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "bdf4bf8fecd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-18-45-35-65281-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791266474, "last_seen": 1791266474, "transport": "t", "ja3_hash": "e80af500075af4d2b8ecf875756736a7", "ja3_variant_count": 1, "ja3_variants": [ "e80af500075af4d2b8ecf875756736a7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_bf8953d4246c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "bf8953d4246c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-11-17613-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790850630, "last_seen": 1790850630, "transport": "t", "ja3_hash": "90249f79cd8f12f574bf214b8dfbb98e", "ja3_variant_count": 1, "ja3_variants": [ "90249f79cd8f12f574bf214b8dfbb98e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_c0985cb1cbed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "c0985cb1cbed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-35-5-17613-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790682280, "last_seen": 1790682280, "transport": "t", "ja3_hash": "c8e23f15bf2338b0bb571e2836569828", "ja3_variant_count": 1, "ja3_variants": [ "c8e23f15bf2338b0bb571e2836569828" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_c3ea69647895", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "c3ea69647895", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-18-11-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789023386, "last_seen": 1789023386, "transport": "t", "ja3_hash": "205f1d03a1ea4ec79bfb9bd08712a7d2", "ja3_variant_count": 1, "ja3_variants": [ "205f1d03a1ea4ec79bfb9bd08712a7d2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_c9352f88db8b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "c9352f88db8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-27-65281-17613-45-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789749995, "last_seen": 1789749995, "transport": "t", "ja3_hash": "7e8b771436acab9e3c7ab79fc30fa68d", "ja3_variant_count": 1, "ja3_variants": [ "7e8b771436acab9e3c7ab79fc30fa68d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cbd2c6f4220a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cbd2c6f4220a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-5-11-13-51-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789628309, "last_seen": 1789628309, "transport": "t", "ja3_hash": "d72d6f9bceef6843018c60b6c9356d2b", "ja3_variant_count": 1, "ja3_variants": [ "d72d6f9bceef6843018c60b6c9356d2b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cc0cbd86d94b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cc0cbd86d94b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-35-65281-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241988, "last_seen": 1790241988, "transport": "t", "ja3_hash": "9ebf9502573ccc3d194ad1b52362e055", "ja3_variant_count": 1, "ja3_variants": [ "9ebf9502573ccc3d194ad1b52362e055" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cd2a87adc4a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cd2a87adc4a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-45-65281-17613-51-23,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789693570, "last_seen": 1789693570, "transport": "t", "ja3_hash": "78183f409775aea4d9b49847fd6529e9", "ja3_variant_count": 1, "ja3_variants": [ "78183f409775aea4d9b49847fd6529e9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cf1f46ec8df9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cf1f46ec8df9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-35-65281-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789692929, "last_seen": 1789692929, "transport": "t", "ja3_hash": "b55094b481744ddff4ffebd44ff629c6", "ja3_variant_count": 1, "ja3_variants": [ "b55094b481744ddff4ffebd44ff629c6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_d54440fc3b59", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "d54440fc3b59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-51764-65281-17613-51-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077025, "last_seen": 1791077025, "transport": "t", "ja3_hash": "a679d96c91aa2898a97fc68ac4a838f0", "ja3_variant_count": 1, "ja3_variants": [ "a679d96c91aa2898a97fc68ac4a838f0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_d6321ebdb574", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "d6321ebdb574", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-23-17613-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788520161, "last_seen": 1788520161, "transport": "t", "ja3_hash": "807e3cad1383b12fb3a7c0ca5e8615d7", "ja3_variant_count": 1, "ja3_variants": [ "807e3cad1383b12fb3a7c0ca5e8615d7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_da8aa6b8db85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "da8aa6b8db85", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-51-5-45-10-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730654, "last_seen": 1789730654, "transport": "t", "ja3_hash": "a0eebc88502d555001ba7d95125a8a1e", "ja3_variant_count": 1, "ja3_variants": [ "a0eebc88502d555001ba7d95125a8a1e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_e107ad770601", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "e107ad770601", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-10-35-5-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790773537, "last_seen": 1790773537, "transport": "t", "ja3_hash": "7916026d82e8c2730649b00c5fda71ac", "ja3_variant_count": 1, "ja3_variants": [ "7916026d82e8c2730649b00c5fda71ac" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_e31ca331abc3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "e31ca331abc3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-35-23-17613-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790936996, "last_seen": 1790936996, "transport": "t", "ja3_hash": "70cbca341729438fee269b1a0e361257", "ja3_variant_count": 1, "ja3_variants": [ "70cbca341729438fee269b1a0e361257" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_eecc02183d51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "eecc02183d51", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-35-18-27-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788821242, "last_seen": 1788821242, "transport": "t", "ja3_hash": "8b2544cad8b9c8cb5b1494f912fd177f", "ja3_variant_count": 1, "ja3_variants": [ "8b2544cad8b9c8cb5b1494f912fd177f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_ef86c62441df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "ef86c62441df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-10-65281-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791158578, "last_seen": 1791158578, "transport": "t", "ja3_hash": "b6c883ec286789b0bdc661b0b2508026", "ja3_variant_count": 1, "ja3_variants": [ "b6c883ec286789b0bdc661b0b2508026" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f38134513b5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f38134513b5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-11-18-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790941935, "last_seen": 1790941935, "transport": "t", "ja3_hash": "b9dabfb36953822b0ca5a84fa1c1db6a", "ja3_variant_count": 1, "ja3_variants": [ "b9dabfb36953822b0ca5a84fa1c1db6a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f48d137797ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f48d137797ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-51-27-10-5-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835102, "last_seen": 1788835102, "transport": "t", "ja3_hash": "8ac54fb11425bc872f3ffa0f5e9ca8cc", "ja3_variant_count": 1, "ja3_variants": [ "8ac54fb11425bc872f3ffa0f5e9ca8cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f55c1c7eec8e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f55c1c7eec8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-10-13-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790216309, "last_seen": 1790216309, "transport": "t", "ja3_hash": "e6796a4f320e3a23d3757ca8daccbebc", "ja3_variant_count": 1, "ja3_variants": [ "e6796a4f320e3a23d3757ca8daccbebc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f619fb1d1be5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f619fb1d1be5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-65037-35-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788550300, "last_seen": 1788550300, "transport": "t", "ja3_hash": "f3cf8dd93f3eba48159ebc69ee40e700", "ja3_variant_count": 1, "ja3_variants": [ "f3cf8dd93f3eba48159ebc69ee40e700" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_fb128520d885", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "fb128520d885", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-11-45-5-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789061769, "last_seen": 1789061769, "transport": "t", "ja3_hash": "09058169df2be2d02fdc07dd77458020", "ja3_variant_count": 1, "ja3_variants": [ "09058169df2be2d02fdc07dd77458020" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_feb0230de1da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "feb0230de1da", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-5-18-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789447988, "last_seen": 1789447988, "transport": "t", "ja3_hash": "54421b4ff3eeefa2e628e172acb3ef32", "ja3_variant_count": 1, "ja3_variants": [ "54421b4ff3eeefa2e628e172acb3ef32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_ffdcb2a7ab20", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "ffdcb2a7ab20", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-51-18-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787814805, "last_seen": 1789258517, "transport": "t", "ja3_hash": "a6abf09e64582b7f05d4c4249d314814", "ja3_variant_count": 1, "ja3_variants": [ "a6abf09e64582b7f05d4c4249d314814" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3362.39 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.2899.75 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2353.150 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1507h1_8daaf6152771_0d151c494193", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h1", "b": "8daaf6152771", "c": "0d151c494193", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-11-5-65281-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790992919, "last_seen": 1790992919, "transport": "t", "ja3_hash": "52c18c335c8fb8348440d0aafb3a5908", "ja3_variant_count": 1, "ja3_variants": [ "52c18c335c8fb8348440d0aafb3a5908" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h1_8daaf6152771_5b3c73f8ea1a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h1", "b": "8daaf6152771", "c": "5b3c73f8ea1a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-65037-65281-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790652601, "last_seen": 1790652601, "transport": "t", "ja3_hash": "6f4ba2b0713969a1d4ef37dffe4ac9d6", "ja3_variant_count": 1, "ja3_variants": [ "6f4ba2b0713969a1d4ef37dffe4ac9d6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h1_8daaf6152771_7eb1d6f6ebfd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h1", "b": "8daaf6152771", "c": "7eb1d6f6ebfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-23-45-5-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790530995, "last_seen": 1790530995, "transport": "t", "ja3_hash": "9893363665cc6b7fd5a75fa81074219c", "ja3_variant_count": 1, "ja3_variants": [ "9893363665cc6b7fd5a75fa81074219c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h1_8daaf6152771_856c8a9701ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h1", "b": "8daaf6152771", "c": "856c8a9701ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-5-13-11-65037-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790528279, "last_seen": 1790528279, "transport": "t", "ja3_hash": "05b42e84206bc1e171947c7cd569df53", "ja3_variant_count": 1, "ja3_variants": [ "05b42e84206bc1e171947c7cd569df53" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h1_8daaf6152771_9872b32f53d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h1", "b": "8daaf6152771", "c": "9872b32f53d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-51-23-16-35-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790522561, "last_seen": 1790522561, "transport": "t", "ja3_hash": "171fb108846448f58438eaa36bd062b6", "ja3_variant_count": 1, "ja3_variants": [ "171fb108846448f58438eaa36bd062b6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h1_8daaf6152771_ce9b8c792555", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h1", "b": "8daaf6152771", "c": "ce9b8c792555", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-65037-16-5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790539942, "last_seen": 1790539942, "transport": "t", "ja3_hash": "bdef4f4aefbe8f309261ab3a2f76dd2d", "ja3_variant_count": 1, "ja3_variants": [ "bdef4f4aefbe8f309261ab3a2f76dd2d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_02ad8bbf020e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "02ad8bbf020e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-17613-5-51-35-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789266415, "last_seen": 1789266415, "transport": "t", "ja3_hash": "7c10676a5d2f2b790281ab178ee8bc82", "ja3_variant_count": 1, "ja3_variants": [ "7c10676a5d2f2b790281ab178ee8bc82" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 41 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_0aa8ab51aa3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "0aa8ab51aa3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-51-23-27-16-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791175613, "last_seen": 1791175613, "transport": "t", "ja3_hash": "49a247205a20372572ce033891c3b49e", "ja3_variant_count": 1, "ja3_variants": [ "49a247205a20372572ce033891c3b49e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_0d151c494193", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "0d151c494193", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-5-35-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788762909, "last_seen": 1788762909, "transport": "t", "ja3_hash": "1b54d9291b67da7aba4fca1df8eb0e9c", "ja3_variant_count": 1, "ja3_variants": [ "1b54d9291b67da7aba4fca1df8eb0e9c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_19ac84bbef28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "19ac84bbef28", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-35-17613-23-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790799225, "last_seen": 1790799225, "transport": "t", "ja3_hash": "1b01454e79dc18601215f7318a131592", "ja3_variant_count": 1, "ja3_variants": [ "1b01454e79dc18601215f7318a131592" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_281fed1d364b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "281fed1d364b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-51764-65281-13-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669082, "last_seen": 1789669082, "transport": "t", "ja3_hash": "3dfbdb5660527ad0704545fdb63e7a23", "ja3_variant_count": 1, "ja3_variants": [ "3dfbdb5660527ad0704545fdb63e7a23" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_2ad590ebf4bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "2ad590ebf4bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-16-23-35-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790231713, "last_seen": 1790231713, "transport": "t", "ja3_hash": "4e1c969178637921a31659815e507926", "ja3_variant_count": 1, "ja3_variants": [ "4e1c969178637921a31659815e507926" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_2d8db8f547c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "2d8db8f547c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-17613-65281-35-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791075753, "last_seen": 1791075753, "transport": "t", "ja3_hash": "d5860273776802bccbf750a4ccd39a33", "ja3_variant_count": 1, "ja3_variants": [ "d5860273776802bccbf750a4ccd39a33" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 161 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_30950a91b0e8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "30950a91b0e8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-18-10-51764-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077854, "last_seen": 1791077854, "transport": "t", "ja3_hash": "09d96411d9b44924ca812b725fdaaeeb", "ja3_variant_count": 1, "ja3_variants": [ "09d96411d9b44924ca812b725fdaaeeb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_3557ee4eadbc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "3557ee4eadbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-13-51764-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791241612, "last_seen": 1791241612, "transport": "t", "ja3_hash": "fb99d33c25ed09b0a8ab6db189942b11", "ja3_variant_count": 1, "ja3_variants": [ "fb99d33c25ed09b0a8ab6db189942b11" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_3a9b64715041", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "3a9b64715041", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-51-45-35-16-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788810492, "last_seen": 1788810492, "transport": "t", "ja3_hash": "ea87bfadd5bc5d26a5304e6f1d497bfa", "ja3_variant_count": 1, "ja3_variants": [ "ea87bfadd5bc5d26a5304e6f1d497bfa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_3abc013fb057", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "3abc013fb057", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-16-65281-13-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789974742, "last_seen": 1789974742, "transport": "t", "ja3_hash": "86a8e3b13df1502dda590939d3bc4cea", "ja3_variant_count": 1, "ja3_variants": [ "86a8e3b13df1502dda590939d3bc4cea" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_3c13cab17ea3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "3c13cab17ea3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-65281-11-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790106403, "last_seen": 1790106403, "transport": "t", "ja3_hash": "cd8abb84e2c9add9db72ab0bb23d1db9", "ja3_variant_count": 1, "ja3_variants": [ "cd8abb84e2c9add9db72ab0bb23d1db9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_44be0dae89c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "44be0dae89c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-11-16-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790729634, "last_seen": 1790729634, "transport": "t", "ja3_hash": "6a2d4071130ac523b4a5b01dbc2508cb", "ja3_variant_count": 1, "ja3_variants": [ "6a2d4071130ac523b4a5b01dbc2508cb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_4c469debd594", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "4c469debd594", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-51-65281-11-13-23,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791183441, "last_seen": 1791183441, "transport": "t", "ja3_hash": "895e4f2d146a7b46be95b0b3f23b95ba", "ja3_variant_count": 1, "ja3_variants": [ "895e4f2d146a7b46be95b0b3f23b95ba" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_4f52b1ea7b3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "4f52b1ea7b3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-51-35-16-45-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790439852, "last_seen": 1790439852, "transport": "t", "ja3_hash": "e18229e638882044ce82be1dc78fb67d", "ja3_variant_count": 1, "ja3_variants": [ "e18229e638882044ce82be1dc78fb67d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_5d2067c8cfe1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "5d2067c8cfe1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-13-16-11-18-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790443300, "last_seen": 1790443300, "transport": "t", "ja3_hash": "84166afe58b8de11f68965e4af82436e", "ja3_variant_count": 1, "ja3_variants": [ "84166afe58b8de11f68965e4af82436e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_61b183a1ad3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "61b183a1ad3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-65037-17613-27-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791155522, "last_seen": 1791155522, "transport": "t", "ja3_hash": "3c42cdc2c27c91026114fd72355e34f1", "ja3_variant_count": 1, "ja3_variants": [ "3c42cdc2c27c91026114fd72355e34f1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_67fe05bff9d3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "67fe05bff9d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-35-16-17613-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790982868, "last_seen": 1790982868, "transport": "t", "ja3_hash": "0bb8072d2f70a2e920e0b6a6afb26aef", "ja3_variant_count": 1, "ja3_variants": [ "0bb8072d2f70a2e920e0b6a6afb26aef" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_73dc573d0c98", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "73dc573d0c98", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-45-51-27-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791304372, "last_seen": 1791304372, "transport": "t", "ja3_hash": "480da6ef372df2373957ebaa7241ff4e", "ja3_variant_count": 1, "ja3_variants": [ "480da6ef372df2373957ebaa7241ff4e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_786c5b742b47", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "786c5b742b47", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-5-27-65281-16-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790780660, "last_seen": 1790780660, "transport": "t", "ja3_hash": "ec974975eaa5f0562ce75b9b166596f3", "ja3_variant_count": 1, "ja3_variants": [ "ec974975eaa5f0562ce75b9b166596f3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_7d101b5a7a08", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "7d101b5a7a08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-17613-45-51-5-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791017742, "last_seen": 1791017742, "transport": "t", "ja3_hash": "202cada8d1a329b8cc2f6d92f3181bf7", "ja3_variant_count": 1, "ja3_variants": [ "202cada8d1a329b8cc2f6d92f3181bf7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_7f0289fdd07c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "7f0289fdd07c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-35-17613-5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791035382, "last_seen": 1791035382, "transport": "t", "ja3_hash": "9b2f93a16b70e5c4cf48e86f0461447d", "ja3_variant_count": 1, "ja3_variants": [ "9b2f93a16b70e5c4cf48e86f0461447d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_8364a341da4a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "8364a341da4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-27-65281-16-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790238136, "last_seen": 1790238136, "transport": "t", "ja3_hash": "1af871905b66a7026e97710466fc37e3", "ja3_variant_count": 1, "ja3_variants": [ "1af871905b66a7026e97710466fc37e3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_8b84e4d8fc40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "8b84e4d8fc40", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-11-51764-16-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789128998, "last_seen": 1789128998, "transport": "t", "ja3_hash": "894ebab05ade3b216a0eb2d860c51108", "ja3_variant_count": 1, "ja3_variants": [ "894ebab05ade3b216a0eb2d860c51108" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_8c57c51eadb1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "8c57c51eadb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-35-51-27-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788721834, "last_seen": 1788721834, "transport": "t", "ja3_hash": "12b114d43e48547088b7d533bc56efbc", "ja3_variant_count": 1, "ja3_variants": [ "12b114d43e48547088b7d533bc56efbc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_92d2bf00c747", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "92d2bf00c747", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-5-51-16-65281-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790215087, "last_seen": 1790215087, "transport": "t", "ja3_hash": "2f44f306b9129cc43a0a044afc439e7b", "ja3_variant_count": 1, "ja3_variants": [ "2f44f306b9129cc43a0a044afc439e7b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_9a2a57663eac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "9a2a57663eac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-10-13-65037-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790262366, "last_seen": 1790262366, "transport": "t", "ja3_hash": "5a3446a0f7b9fdfbc69ab219007467f6", "ja3_variant_count": 1, "ja3_variants": [ "5a3446a0f7b9fdfbc69ab219007467f6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_a225629f59a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "a225629f59a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-65281-65037-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790432429, "last_seen": 1790432429, "transport": "t", "ja3_hash": "e63536148f9850538374749ea658263d", "ja3_variant_count": 1, "ja3_variants": [ "e63536148f9850538374749ea658263d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_a31c4125a9ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "a31c4125a9ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-10-17613-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789926609, "last_seen": 1789926609, "transport": "t", "ja3_hash": "c06e13952dd800d725581b411ebf4017", "ja3_variant_count": 1, "ja3_variants": [ "c06e13952dd800d725581b411ebf4017" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_a5ced76ba67c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "a5ced76ba67c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-51764-11-10-16-23-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791280733, "last_seen": 1791280733, "transport": "t", "ja3_hash": "ce9a810ad777f8b62f0267e2ff7321c8", "ja3_variant_count": 1, "ja3_variants": [ "ce9a810ad777f8b62f0267e2ff7321c8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_a9dd299eee22", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "a9dd299eee22", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-10-35-16-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791037177, "last_seen": 1791037177, "transport": "t", "ja3_hash": "0437df7b29a421ec21908a209f457532", "ja3_variant_count": 1, "ja3_variants": [ "0437df7b29a421ec21908a209f457532" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_bc76bc06761a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "bc76bc06761a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-65281-13-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789669080, "last_seen": 1789669080, "transport": "t", "ja3_hash": "f2d62a745fc7677255c3647128f632b0", "ja3_variant_count": 1, "ja3_variants": [ "f2d62a745fc7677255c3647128f632b0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_c48c74d61a39", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "c48c74d61a39", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-5-51-18-13-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790778322, "last_seen": 1790778322, "transport": "t", "ja3_hash": "ad977c0f5a0b25a1ab118090633eb399", "ja3_variant_count": 1, "ja3_variants": [ "ad977c0f5a0b25a1ab118090633eb399" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_c7eb1d7adc8c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "c7eb1d7adc8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-16-11-18-10-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790728768, "last_seen": 1790728768, "transport": "t", "ja3_hash": "2a9699e4379e99e850ce734b38d30d6e", "ja3_variant_count": 1, "ja3_variants": [ "2a9699e4379e99e850ce734b38d30d6e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36 aweme_230400 JsSdk/1": 11 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_ca0f4e274093", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "ca0f4e274093", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-16-27-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790162678, "last_seen": 1790162678, "transport": "t", "ja3_hash": "3033c6bc8fe3f22a75b61b6d1c28d1a8", "ja3_variant_count": 1, "ja3_variants": [ "3033c6bc8fe3f22a75b61b6d1c28d1a8" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_cb2d85ab9393", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "cb2d85ab9393", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-45-5-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790081471, "last_seen": 1790081471, "transport": "t", "ja3_hash": "a4aac844a895b47674043b78050b3c46", "ja3_variant_count": 1, "ja3_variants": [ "a4aac844a895b47674043b78050b3c46" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_ce86b2f0c1d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "ce86b2f0c1d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-11-35-16-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790170446, "last_seen": 1790170446, "transport": "t", "ja3_hash": "c3efb91d0be86831b3a58fe69eebb676", "ja3_variant_count": 1, "ja3_variants": [ "c3efb91d0be86831b3a58fe69eebb676" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_d01311bf427c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "d01311bf427c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-5-51-16-17613-23,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788796053, "last_seen": 1788796053, "transport": "t", "ja3_hash": "d041b3348e8f11c5c3d5e384d97d8bb3", "ja3_variant_count": 1, "ja3_variants": [ "d041b3348e8f11c5c3d5e384d97d8bb3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_d2c8d4e147ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "d2c8d4e147ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-27-16-5-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791050323, "last_seen": 1791050323, "transport": "t", "ja3_hash": "f7bda31d973862f8e76763844dcffbba", "ja3_variant_count": 1, "ja3_variants": [ "f7bda31d973862f8e76763844dcffbba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_d67874884b0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "d67874884b0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-10-23-17613-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790247425, "last_seen": 1790247425, "transport": "t", "ja3_hash": "3aaa0c31370a48845b943e9d2b78e1da", "ja3_variant_count": 1, "ja3_variants": [ "3aaa0c31370a48845b943e9d2b78e1da" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_da9bb42293a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "da9bb42293a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-16-45-17613-51-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791153796, "last_seen": 1791153796, "transport": "t", "ja3_hash": "0089ee8b684d82ad75dbb43a3f9a744a", "ja3_variant_count": 1, "ja3_variants": [ "0089ee8b684d82ad75dbb43a3f9a744a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_e0ae1bf39523", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "e0ae1bf39523", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-13-27-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788780077, "last_seen": 1788780077, "transport": "t", "ja3_hash": "6219a66a3a5088766b4d0d2196a374fc", "ja3_variant_count": 1, "ja3_variants": [ "6219a66a3a5088766b4d0d2196a374fc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_e6ad7ac6402a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "e6ad7ac6402a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-45-16-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788795778, "last_seen": 1788795778, "transport": "t", "ja3_hash": "2fc0ef9c9f371cb64326dbe7e72375c6", "ja3_variant_count": 1, "ja3_variants": [ "2fc0ef9c9f371cb64326dbe7e72375c6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_e71eefb30136", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "e71eefb30136", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-27-16-13-51-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789396339, "last_seen": 1789396339, "transport": "t", "ja3_hash": "92a8f4c989e5383b0ed20aabdae754a9", "ja3_variant_count": 1, "ja3_variants": [ "92a8f4c989e5383b0ed20aabdae754a9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_e9ad4d0ece07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "e9ad4d0ece07", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-13-5-35-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790228800, "last_seen": 1790228800, "transport": "t", "ja3_hash": "9c8382686c810b5fdee4c8ea74566844", "ja3_variant_count": 1, "ja3_variants": [ "9c8382686c810b5fdee4c8ea74566844" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_eb5417d873a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "eb5417d873a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-16-51-17613-10-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791190171, "last_seen": 1791190171, "transport": "t", "ja3_hash": "c902111216f2dc971616d6f992097cd5", "ja3_variant_count": 1, "ja3_variants": [ "c902111216f2dc971616d6f992097cd5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_ebdbc74c6144", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "ebdbc74c6144", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-65281-65037-27-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789869195, "last_seen": 1789869195, "transport": "t", "ja3_hash": "a72790b31ebc22a06c8f0c9156d5c7a1", "ja3_variant_count": 1, "ja3_variants": [ "a72790b31ebc22a06c8f0c9156d5c7a1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_efde748025a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "efde748025a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-13-45-17513-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790414518, "last_seen": 1790414518, "transport": "t", "ja3_hash": "97efdd69b19f15c645ab36a9d38bac81", "ja3_variant_count": 1, "ja3_variants": [ "97efdd69b19f15c645ab36a9d38bac81" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_f46149038df3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "f46149038df3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-16-13-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790214773, "last_seen": 1790214773, "transport": "t", "ja3_hash": "db6d37b5ab2d450311078e3b60606d65", "ja3_variant_count": 1, "ja3_variants": [ "db6d37b5ab2d450311078e3b60606d65" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_024ce97d4f23", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "024ce97d4f23", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-5-35-65281-23-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791269598, "last_seen": 1791269598, "transport": "t", "ja3_hash": "a41930fd8a09a3af92a02f414d3f3d53", "ja3_variant_count": 1, "ja3_variants": [ "a41930fd8a09a3af92a02f414d3f3d53" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 7 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_07ab803c8ed9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "07ab803c8ed9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-17613-65281-35-13-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788527460, "last_seen": 1788527460, "transport": "t", "ja3_hash": "a0acd118399f523be06ef62e7ac793e0", "ja3_variant_count": 1, "ja3_variants": [ "a0acd118399f523be06ef62e7ac793e0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_09844d95d602", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "09844d95d602", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-23-27-45-65037-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791299125, "last_seen": 1791299125, "transport": "t", "ja3_hash": "aa6dd21f4a81e6f22a14be2b5cb9b00c", "ja3_variant_count": 1, "ja3_variants": [ "aa6dd21f4a81e6f22a14be2b5cb9b00c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_0a10a84c6b38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "0a10a84c6b38", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-27-35-10-45-23-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789896248, "last_seen": 1789896248, "transport": "t", "ja3_hash": "ed043c352233745bff28cdae64d0a436", "ja3_variant_count": 1, "ja3_variants": [ "ed043c352233745bff28cdae64d0a436" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_0eb81820a212", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "0eb81820a212", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-45-13-65037-23-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790282597, "last_seen": 1790282597, "transport": "t", "ja3_hash": "76166126d613c821706da80f929a4668", "ja3_variant_count": 1, "ja3_variants": [ "76166126d613c821706da80f929a4668" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_133bcc6529de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "133bcc6529de", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-13-35-18-5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789682261, "last_seen": 1789682261, "transport": "t", "ja3_hash": "4d4ab30fe8df2c50461e5471955c13ed", "ja3_variant_count": 1, "ja3_variants": [ "4d4ab30fe8df2c50461e5471955c13ed" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_2c67da78830a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "2c67da78830a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-65281-13-10-27-23-35,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788889488, "last_seen": 1788889488, "transport": "t", "ja3_hash": "f04760c092d98ce155fa22fe67b6fc5e", "ja3_variant_count": 1, "ja3_variants": [ "f04760c092d98ce155fa22fe67b6fc5e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_30f56f37d2a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "30f56f37d2a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-51-10-27-65281-17613-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788779918, "last_seen": 1788779918, "transport": "t", "ja3_hash": "9df205ebf33b632753c7f13ee63cb68d", "ja3_variant_count": 1, "ja3_variants": [ "9df205ebf33b632753c7f13ee63cb68d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_5173106bc242", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "5173106bc242", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-51-13-65281-10-11-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789451371, "last_seen": 1789451371, "transport": "t", "ja3_hash": "ea62a0f053fd3d41b03785de73f6b19b", "ja3_variant_count": 1, "ja3_variants": [ "ea62a0f053fd3d41b03785de73f6b19b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 43 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_64e4283bbf57", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "64e4283bbf57", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-35-51-17613-10-5-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790218373, "last_seen": 1790218373, "transport": "t", "ja3_hash": "11d7b7f577fc372ef05ca1d7a3e9fba6", "ja3_variant_count": 1, "ja3_variants": [ "11d7b7f577fc372ef05ca1d7a3e9fba6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_671e593bfbd7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "671e593bfbd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-23-17613-10-35-51-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790212088, "last_seen": 1790212088, "transport": "t", "ja3_hash": "a0212441936fc19a5a7005e3bf3f6c29", "ja3_variant_count": 1, "ja3_variants": [ "a0212441936fc19a5a7005e3bf3f6c29" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_677fdf0ac35f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "677fdf0ac35f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-13-27-65037-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789351028, "last_seen": 1789351028, "transport": "t", "ja3_hash": "a11e3b10cb10312fc449d73e1e6ef218", "ja3_variant_count": 1, "ja3_variants": [ "a11e3b10cb10312fc449d73e1e6ef218" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_67f5be1568f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "67f5be1568f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-65037-51764-23-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791032346, "last_seen": 1791032346, "transport": "t", "ja3_hash": "8579a0166b029345dc732afb68a9bda7", "ja3_variant_count": 1, "ja3_variants": [ "8579a0166b029345dc732afb68a9bda7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_6953a51813a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "6953a51813a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-23-27-65037-65281-10-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790995555, "last_seen": 1790995555, "transport": "t", "ja3_hash": "e82f77d3012dc4b4cf4d45efdf0b254a", "ja3_variant_count": 1, "ja3_variants": [ "e82f77d3012dc4b4cf4d45efdf0b254a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_69d30f07a8a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "69d30f07a8a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-10-35-27-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788871581, "last_seen": 1788871581, "transport": "t", "ja3_hash": "7dd840efbf562c7056a61e7d129fbb51", "ja3_variant_count": 1, "ja3_variants": [ "7dd840efbf562c7056a61e7d129fbb51" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_6b482c1d5e1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "6b482c1d5e1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-27-23-18-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789624948, "last_seen": 1789624948, "transport": "t", "ja3_hash": "272afb3b9732ca1461dbe3eec69bce77", "ja3_variant_count": 1, "ja3_variants": [ "272afb3b9732ca1461dbe3eec69bce77" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_706d3b98a2e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "706d3b98a2e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-10-17613-11-65281-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789904943, "last_seen": 1789904943, "transport": "t", "ja3_hash": "b7ca38bade27c41355fc59e27633ea3e", "ja3_variant_count": 1, "ja3_variants": [ "b7ca38bade27c41355fc59e27633ea3e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_708fb24f2ed5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "708fb24f2ed5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-65037-17613-27-13-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790582588, "last_seen": 1790582588, "transport": "t", "ja3_hash": "216a73d5b54f144cfef4d43abb9c3849", "ja3_variant_count": 1, "ja3_variants": [ "216a73d5b54f144cfef4d43abb9c3849" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_75271450355b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "75271450355b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-45-23-11-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791226030, "last_seen": 1791226030, "transport": "t", "ja3_hash": "90f3c10a943c111b7cf914fff6b57f40", "ja3_variant_count": 1, "ja3_variants": [ "90f3c10a943c111b7cf914fff6b57f40" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_7e7b656ac246", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "7e7b656ac246", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-65037-18-23-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790649389, "last_seen": 1790649389, "transport": "t", "ja3_hash": "7325b73989645b28901977aa28c97307", "ja3_variant_count": 1, "ja3_variants": [ "7325b73989645b28901977aa28c97307" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_7f06c6afa010", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "7f06c6afa010", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-35-65281-18-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789329941, "last_seen": 1789329941, "transport": "t", "ja3_hash": "5410544598c603bdbc3304abd67954a5", "ja3_variant_count": 1, "ja3_variants": [ "5410544598c603bdbc3304abd67954a5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_7f45d013597f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "7f45d013597f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-51-13-18-35-65281-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791109498, "last_seen": 1791109498, "transport": "t", "ja3_hash": "b2b3b5ebae559472599824029648b8df", "ja3_variant_count": 1, "ja3_variants": [ "b2b3b5ebae559472599824029648b8df" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_80434ae2e164", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "80434ae2e164", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-65037-17613-27-45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791269877, "last_seen": 1791269877, "transport": "t", "ja3_hash": "4312be5ca658046e64cf29eefc5fae5c", "ja3_variant_count": 1, "ja3_variants": [ "4312be5ca658046e64cf29eefc5fae5c" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_8088a2f65a36", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "8088a2f65a36", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-5-45-27-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790176722, "last_seen": 1790176722, "transport": "t", "ja3_hash": "db20474c05b85b0a2725bf7395f44c3c", "ja3_variant_count": 1, "ja3_variants": [ "db20474c05b85b0a2725bf7395f44c3c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_83c448b9062f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "83c448b9062f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-17613-5-35-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789091743, "last_seen": 1789091743, "transport": "t", "ja3_hash": "d90e5081eca976e561986c793b77ad76", "ja3_variant_count": 1, "ja3_variants": [ "d90e5081eca976e561986c793b77ad76" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_8e7d22ec80e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "8e7d22ec80e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-10-45-51-5-35-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788739502, "last_seen": 1788739502, "transport": "t", "ja3_hash": "419ddad00db14e5b5cf9d32f5a418fcd", "ja3_variant_count": 1, "ja3_variants": [ "419ddad00db14e5b5cf9d32f5a418fcd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_9c45872a86fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "9c45872a86fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-10-45-13-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788756748, "last_seen": 1788756748, "transport": "t", "ja3_hash": "94cc14d99647032f475218f4c2a43d28", "ja3_variant_count": 1, "ja3_variants": [ "94cc14d99647032f475218f4c2a43d28" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_9ce3660d8fa3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "9ce3660d8fa3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-27-13-65037-10-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789628342, "last_seen": 1789628342, "transport": "t", "ja3_hash": "9508ec9dbdd630440f6efe1700751d46", "ja3_variant_count": 1, "ja3_variants": [ "9508ec9dbdd630440f6efe1700751d46" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_a01c3bccff73", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "a01c3bccff73", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-35-17613-5-11-23-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790964363, "last_seen": 1790964363, "transport": "t", "ja3_hash": "39abb7f567d317c4988e2c9b62771933", "ja3_variant_count": 1, "ja3_variants": [ "39abb7f567d317c4988e2c9b62771933" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_a5cd29e3c35b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "a5cd29e3c35b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-45-11-23-35-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790200180, "last_seen": 1790200180, "transport": "t", "ja3_hash": "2025c519c9fe15457c194fdece5ea790", "ja3_variant_count": 1, "ja3_variants": [ "2025c519c9fe15457c194fdece5ea790" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_ac078c30b556", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "ac078c30b556", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-23-11-5-18-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791135751, "last_seen": 1791135751, "transport": "t", "ja3_hash": "06b4f9ab75d1adfe66fdc9cbabf5c6d0", "ja3_variant_count": 1, "ja3_variants": [ "06b4f9ab75d1adfe66fdc9cbabf5c6d0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_aeb2d981b34e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "aeb2d981b34e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-5-10-13-45-35-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790247243, "last_seen": 1790247243, "transport": "t", "ja3_hash": "24a3aef46d72a191cba805c250c964a5", "ja3_variant_count": 1, "ja3_variants": [ "24a3aef46d72a191cba805c250c964a5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_aeb9b8afb0f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "aeb9b8afb0f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-10-5-65281-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788846161, "last_seen": 1788846161, "transport": "t", "ja3_hash": "1b8496117271e3795a57a3f0e223a9d3", "ja3_variant_count": 1, "ja3_variants": [ "1b8496117271e3795a57a3f0e223a9d3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_b110d530c50b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "b110d530c50b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-23-51-11-13-27-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789646945, "last_seen": 1789646945, "transport": "t", "ja3_hash": "e353213c7c4f790cfea69eae9fc0d9c2", "ja3_variant_count": 1, "ja3_variants": [ "e353213c7c4f790cfea69eae9fc0d9c2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_b9559a6cf5d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "b9559a6cf5d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-45-10-18-23-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788491914, "last_seen": 1788491914, "transport": "t", "ja3_hash": "0356024c1067fac94904ca57cace39c1", "ja3_variant_count": 1, "ja3_variants": [ "0356024c1067fac94904ca57cace39c1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_b9f96a79d492", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "b9f96a79d492", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-65037-18-13-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790050129, "last_seen": 1790050129, "transport": "t", "ja3_hash": "9b313134022102139f8a97ac15ee6dbc", "ja3_variant_count": 1, "ja3_variants": [ "9b313134022102139f8a97ac15ee6dbc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_bef7825184cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "bef7825184cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-17613-35-10-65281-27-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791109494, "last_seen": 1791109494, "transport": "t", "ja3_hash": "82b09b576d0fee1563758e6fb3e3e24a", "ja3_variant_count": 1, "ja3_variants": [ "82b09b576d0fee1563758e6fb3e3e24a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_cd090eca95b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "cd090eca95b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65037-17613-45-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788790043, "last_seen": 1788790043, "transport": "t", "ja3_hash": "bfa4bc2388d0a7f4ba69395decc1524f", "ja3_variant_count": 1, "ja3_variants": [ "bfa4bc2388d0a7f4ba69395decc1524f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_d9bab1704474", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "d9bab1704474", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-51-18-13-45-5-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790256334, "last_seen": 1790256334, "transport": "t", "ja3_hash": "041fdc33d2ea385b46603d2214235eb3", "ja3_variant_count": 1, "ja3_variants": [ "041fdc33d2ea385b46603d2214235eb3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_e16ddb194cd8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "e16ddb194cd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-51-35-17613-13-23-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790216309, "last_seen": 1790216309, "transport": "t", "ja3_hash": "1e2f6976988034eab48a642477b0bfe0", "ja3_variant_count": 1, "ja3_variants": [ "1e2f6976988034eab48a642477b0bfe0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_eb82f37aa77d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "eb82f37aa77d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-45-65037-10-27-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790781621, "last_seen": 1790781621, "transport": "t", "ja3_hash": "8b7375161532d8b78fe327748357474a", "ja3_variant_count": 1, "ja3_variants": [ "8b7375161532d8b78fe327748357474a" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_ece1498c5679", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "ece1498c5679", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-11-35-23-65281-51-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790338626, "last_seen": 1790338626, "transport": "t", "ja3_hash": "c0fdcaf71f7f06f2306ebc5656bf7de3", "ja3_variant_count": 1, "ja3_variants": [ "c0fdcaf71f7f06f2306ebc5656bf7de3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f1a2b02be521", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f1a2b02be521", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-35-5-11-65037-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790174990, "last_seen": 1790174990, "transport": "t", "ja3_hash": "53cd316abaedd7c4b0dc9f813acc2782", "ja3_variant_count": 1, "ja3_variants": [ "53cd316abaedd7c4b0dc9f813acc2782" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f3340ab47248", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f3340ab47248", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-35-18-27-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788786670, "last_seen": 1788786670, "transport": "t", "ja3_hash": "48a9cf7809bd44069a8cad14b4722783", "ja3_variant_count": 1, "ja3_variants": [ "48a9cf7809bd44069a8cad14b4722783" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f396268b464d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f396268b464d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-65281-10-13-18-65037-17513,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790941799, "last_seen": 1790941799, "transport": "t", "ja3_hash": "ed5ae53155395822815606e78fc7a660", "ja3_variant_count": 1, "ja3_variants": [ "ed5ae53155395822815606e78fc7a660" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f5f857e8663d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f5f857e8663d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-45-51764-23-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790905735, "last_seen": 1790905735, "transport": "t", "ja3_hash": "f5ec515fad2d596abce78d38d8f25518", "ja3_variant_count": 1, "ja3_variants": [ "f5ec515fad2d596abce78d38d8f25518" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f90b00670ffd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f90b00670ffd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-23-35-18-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789929460, "last_seen": 1789929460, "transport": "t", "ja3_hash": "700963b2256daddee1a2c7411cabc8b9", "ja3_variant_count": 1, "ja3_variants": [ "700963b2256daddee1a2c7411cabc8b9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f986e3b1ed3f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f986e3b1ed3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-5-18-23-10-45-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790088806, "last_seen": 1790088806, "transport": "t", "ja3_hash": "4d10bc7df81c8c1294a1f4b11548ee78", "ja3_variant_count": 1, "ja3_variants": [ "4d10bc7df81c8c1294a1f4b11548ee78" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_fbc4d021fa82", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "fbc4d021fa82", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17513-35-18-10-65037-51-13,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791102832, "last_seen": 1791102832, "transport": "t", "ja3_hash": "6523e7fc7bc4d08287855298ea2db59b", "ja3_variant_count": 1, "ja3_variants": [ "6523e7fc7bc4d08287855298ea2db59b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h1_8daaf6152771_7ecb2beb5b4f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h1", "b": "8daaf6152771", "c": "7ecb2beb5b4f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-16-11-5-65281-18-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790669721, "last_seen": 1790669721, "transport": "t", "ja3_hash": "544ff792940da8e2bd6b2b02ebdf981e", "ja3_variant_count": 1, "ja3_variants": [ "544ff792940da8e2bd6b2b02ebdf981e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h1_8daaf6152771_7ecb64f4f7d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h1", "b": "8daaf6152771", "c": "7ecb64f4f7d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-35-11-65281-16-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790524613, "last_seen": 1790524613, "transport": "t", "ja3_hash": "c7bd275d1663329801523c6424bbb31d", "ja3_variant_count": 1, "ja3_variants": [ "c7bd275d1663329801523c6424bbb31d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_04bcb2f3e685", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "04bcb2f3e685", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-5-17613-10-23-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790163667, "last_seen": 1790163667, "transport": "t", "ja3_hash": "f320ba050a40a0908c288cde240b9fa4", "ja3_variant_count": 1, "ja3_variants": [ "f320ba050a40a0908c288cde240b9fa4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_126c7c5c9c62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "126c7c5c9c62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-16-17613-13-45-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791088471, "last_seen": 1791088471, "transport": "t", "ja3_hash": "d618e2f855d61e53e4a7e7eb5838e6a7", "ja3_variant_count": 1, "ja3_variants": [ "d618e2f855d61e53e4a7e7eb5838e6a7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_143ddaebf963", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "143ddaebf963", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-18-13-65037-16-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790568344, "last_seen": 1790568344, "transport": "t", "ja3_hash": "7df0f3077b6e5fb71ba0e5ee01b27d53", "ja3_variant_count": 1, "ja3_variants": [ "7df0f3077b6e5fb71ba0e5ee01b27d53" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_1bc7361e04ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "1bc7361e04ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-10-35-16-13-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202413, "last_seen": 1790202413, "transport": "t", "ja3_hash": "57af4c3297d0b2ab0690c4e2e761633b", "ja3_variant_count": 1, "ja3_variants": [ "57af4c3297d0b2ab0690c4e2e761633b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_1e48e5575d80", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "1e48e5575d80", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-65037-17613-35-45-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790548998, "last_seen": 1790548998, "transport": "t", "ja3_hash": "69226e295fb79ca4f10be10a68ba48d6", "ja3_variant_count": 1, "ja3_variants": [ "69226e295fb79ca4f10be10a68ba48d6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_23abee4aabec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "23abee4aabec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-5-16-27-51-17613-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790176720, "last_seen": 1790176720, "transport": "t", "ja3_hash": "db51a51afa54e51968e3c6ea3acf57c9", "ja3_variant_count": 1, "ja3_variants": [ "db51a51afa54e51968e3c6ea3acf57c9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_24eb3d11256c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "24eb3d11256c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-16-51-17613-65281-5-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788502427, "last_seen": 1788502427, "transport": "t", "ja3_hash": "0d7bf0e5aea7c5e99659ca9d73a0c269", "ja3_variant_count": 1, "ja3_variants": [ "0d7bf0e5aea7c5e99659ca9d73a0c269" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_2649eb0acbe1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "2649eb0acbe1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-23-5-13-35-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790890739, "last_seen": 1790890739, "transport": "t", "ja3_hash": "0dcd21996e3f2976fd9e91a32e011450", "ja3_variant_count": 1, "ja3_variants": [ "0dcd21996e3f2976fd9e91a32e011450" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_271f70bbf722", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "271f70bbf722", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-51764-16-10-17613-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791121245, "last_seen": 1791121245, "transport": "t", "ja3_hash": "ddd17561a2714be3edaf322b96e02c28", "ja3_variant_count": 1, "ja3_variants": [ "ddd17561a2714be3edaf322b96e02c28" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_279f5913459c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "279f5913459c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-13-27-16-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790212915, "last_seen": 1790212915, "transport": "t", "ja3_hash": "6b88aff39c62509351d439b07cdd1e94", "ja3_variant_count": 1, "ja3_variants": [ "6b88aff39c62509351d439b07cdd1e94" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_2f2664752426", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "2f2664752426", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-10-23-65037-16-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790927503, "last_seen": 1790927503, "transport": "t", "ja3_hash": "27f8a49236cd7d4d377850366b4d379a", "ja3_variant_count": 1, "ja3_variants": [ "27f8a49236cd7d4d377850366b4d379a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3560c91d12bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3560c91d12bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-23-16-45-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791234244, "last_seen": 1791234244, "transport": "t", "ja3_hash": "bfc5c70f55267264baae6bdecbd8e25d", "ja3_variant_count": 1, "ja3_variants": [ "bfc5c70f55267264baae6bdecbd8e25d" ], "user_agents": { "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3a7fa3bc7b16", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3a7fa3bc7b16", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-13-65037-35-27-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790768360, "last_seen": 1790768360, "transport": "t", "ja3_hash": "0b27f7b9483c065260e8a818b0333b9e", "ja3_variant_count": 1, "ja3_variants": [ "0b27f7b9483c065260e8a818b0333b9e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3d588962c6ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3d588962c6ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-51-45-16-5-17613-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790219898, "last_seen": 1790219898, "transport": "t", "ja3_hash": "1d9beee7e61c9f5cb5f5c39fd09b1704", "ja3_variant_count": 1, "ja3_variants": [ "1d9beee7e61c9f5cb5f5c39fd09b1704" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3f62b57dbd54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3f62b57dbd54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-10-11-51764-13-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791100458, "last_seen": 1791100458, "transport": "t", "ja3_hash": "4be499654ad339f691ba41dfc3a28dc0", "ja3_variant_count": 1, "ja3_variants": [ "4be499654ad339f691ba41dfc3a28dc0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_46036ffc5cf2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "46036ffc5cf2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-35-65037-45-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791312057, "last_seen": 1791312057, "transport": "t", "ja3_hash": "69cdb30be55e279fc296a7040ba9b42c", "ja3_variant_count": 1, "ja3_variants": [ "69cdb30be55e279fc296a7040ba9b42c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_4d2df2ff6b2e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "4d2df2ff6b2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-45-65037-16-5-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789457608, "last_seen": 1789457608, "transport": "t", "ja3_hash": "d346da9ef11347482f44b17047a9250a", "ja3_variant_count": 1, "ja3_variants": [ "d346da9ef11347482f44b17047a9250a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_5b4aee8cafca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "5b4aee8cafca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-11-18-27-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790736466, "last_seen": 1790736466, "transport": "t", "ja3_hash": "37513dd9c06522f8f8486da5e1af65c6", "ja3_variant_count": 1, "ja3_variants": [ "37513dd9c06522f8f8486da5e1af65c6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_63d7f5ca23a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "63d7f5ca23a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-11-18-65281-27-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789156225, "last_seen": 1789156225, "transport": "t", "ja3_hash": "8c58857b6d93ed87b4b3341728d610e9", "ja3_variant_count": 1, "ja3_variants": [ "8c58857b6d93ed87b4b3341728d610e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 17 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_66583419752f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "66583419752f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-51-5-17513-27-65037-23,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791141900, "last_seen": 1791141900, "transport": "t", "ja3_hash": "7862ccd2c23cc0731cc0f7a3ecd6e836", "ja3_variant_count": 1, "ja3_variants": [ "7862ccd2c23cc0731cc0f7a3ecd6e836" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_6ab2b086263d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "6ab2b086263d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-17613-10-35-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790185827, "last_seen": 1791042852, "transport": "t", "ja3_hash": "68158e745f4e27f3f315650481c8ee65", "ja3_variant_count": 2, "ja3_variants": [ "68158e745f4e27f3f315650481c8ee65", "7a1130a65150309dd50c3a093e14f9cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_6c2d007a0e68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "6c2d007a0e68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-65037-65281-13-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791032692, "last_seen": 1791032692, "transport": "t", "ja3_hash": "a918136dd7fb452065848307577be7ab", "ja3_variant_count": 1, "ja3_variants": [ "a918136dd7fb452065848307577be7ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_6c491c3f7784", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "6c491c3f7784", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-10-65037-5-35-51-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790949769, "last_seen": 1790949769, "transport": "t", "ja3_hash": "88033986b7d2f95341e22e8856b55596", "ja3_variant_count": 1, "ja3_variants": [ "88033986b7d2f95341e22e8856b55596" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_708a697806b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "708a697806b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-45-16-27-17613-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789908021, "last_seen": 1789908021, "transport": "t", "ja3_hash": "afba61ca49760e80fb6b6f75bb70b8bc", "ja3_variant_count": 1, "ja3_variants": [ "afba61ca49760e80fb6b6f75bb70b8bc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_74e7974f05a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "74e7974f05a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-17613-10-65037-16-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790949418, "last_seen": 1790949418, "transport": "t", "ja3_hash": "418cd296e4d09a9d668f9029fb8b47fd", "ja3_variant_count": 1, "ja3_variants": [ "418cd296e4d09a9d668f9029fb8b47fd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_7755c85a546e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "7755c85a546e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-13-23-10-16-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788963193, "last_seen": 1788963193, "transport": "t", "ja3_hash": "d1ee1792019e5561361ff57b2e388f22", "ja3_variant_count": 1, "ja3_variants": [ "d1ee1792019e5561361ff57b2e388f22" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_8935e323e617", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "8935e323e617", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-10-65281-23-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789889217, "last_seen": 1789889217, "transport": "t", "ja3_hash": "0d237e38c5ba709b861f49eec4f58c3b", "ja3_variant_count": 1, "ja3_variants": [ "0d237e38c5ba709b861f49eec4f58c3b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_89a9257c738b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "89a9257c738b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-18-45-17613-16-51-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789740968, "last_seen": 1789740968, "transport": "t", "ja3_hash": "afd23485ae9e5d36fe50dcff75247784", "ja3_variant_count": 1, "ja3_variants": [ "afd23485ae9e5d36fe50dcff75247784" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_92cfd8477fba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "92cfd8477fba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-18-10-13-35-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656734, "last_seen": 1789656734, "transport": "t", "ja3_hash": "bfbb47f792c9d0fa2c0b6b0dc01a8c6e", "ja3_variant_count": 1, "ja3_variants": [ "bfbb47f792c9d0fa2c0b6b0dc01a8c6e" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_99d64b3dad25", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "99d64b3dad25", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-10-13-65037-16-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790961963, "last_seen": 1790961963, "transport": "t", "ja3_hash": "071a89e9f6f41fe2016762b612cb63a7", "ja3_variant_count": 1, "ja3_variants": [ "071a89e9f6f41fe2016762b612cb63a7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_b083ee9079c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "b083ee9079c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-11-27-13-65037-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790690391, "last_seen": 1790690391, "transport": "t", "ja3_hash": "d50cdf40540af93a607ffbb5dbfc4abe", "ja3_variant_count": 1, "ja3_variants": [ "d50cdf40540af93a607ffbb5dbfc4abe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_b6044374eb43", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "b6044374eb43", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-27-5-23-10-16-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202378, "last_seen": 1790202378, "transport": "t", "ja3_hash": "5764ddc781c91fdd179f498b4de364bd", "ja3_variant_count": 1, "ja3_variants": [ "5764ddc781c91fdd179f498b4de364bd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_ba6f0a2bfb9b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "ba6f0a2bfb9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-51-18-11-23-13-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789455142, "last_seen": 1789455142, "transport": "t", "ja3_hash": "25a8df4957e62951fcd6dc0c91d5dcf9", "ja3_variant_count": 1, "ja3_variants": [ "25a8df4957e62951fcd6dc0c91d5dcf9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 259 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_bb4c9a94ea3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "bb4c9a94ea3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-18-65037-45-17613-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788825891, "last_seen": 1788825891, "transport": "t", "ja3_hash": "4ece2164ebbbc1689824bc0f2330de94", "ja3_variant_count": 1, "ja3_variants": [ "4ece2164ebbbc1689824bc0f2330de94" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_bc15a4bd39c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "bc15a4bd39c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-18-65281-13-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789051251, "last_seen": 1789051251, "transport": "t", "ja3_hash": "5f34243efde85b3e201028a8e08c31b2", "ja3_variant_count": 1, "ja3_variants": [ "5f34243efde85b3e201028a8e08c31b2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_be476786f68e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "be476786f68e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-16-23-27-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790659348, "last_seen": 1790659348, "transport": "t", "ja3_hash": "ad68ec509cc6d3e0c9850f6cc4cdd8c2", "ja3_variant_count": 1, "ja3_variants": [ "ad68ec509cc6d3e0c9850f6cc4cdd8c2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_c50744041d0c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "c50744041d0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-23-51764-16-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788573741, "last_seen": 1788573741, "transport": "t", "ja3_hash": "33f87219fc3ff33819b51de249af7091", "ja3_variant_count": 1, "ja3_variants": [ "33f87219fc3ff33819b51de249af7091" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_c6d19f5eb9eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "c6d19f5eb9eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-13-35-65037-16-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789017973, "last_seen": 1789017973, "transport": "t", "ja3_hash": "bb9fc49a3c5ae822d347247405738598", "ja3_variant_count": 1, "ja3_variants": [ "bb9fc49a3c5ae822d347247405738598" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_d119b85f8bb1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "d119b85f8bb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-23-13-5-65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790230528, "last_seen": 1790230528, "transport": "t", "ja3_hash": "55c40f81867debeb97a3fa60f750f4af", "ja3_variant_count": 1, "ja3_variants": [ "55c40f81867debeb97a3fa60f750f4af" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_db70df9f4ea0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "db70df9f4ea0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-16-10-11-27-65281-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789979299, "last_seen": 1789979299, "transport": "t", "ja3_hash": "ce2d7070516b49c727ec03c36694d044", "ja3_variant_count": 1, "ja3_variants": [ "ce2d7070516b49c727ec03c36694d044" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_db78796cbad8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "db78796cbad8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-10-35-65037-17613-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790190294, "last_seen": 1790190294, "transport": "t", "ja3_hash": "a63d45af28afad5c9a1294a061cc4c9a", "ja3_variant_count": 1, "ja3_variants": [ "a63d45af28afad5c9a1294a061cc4c9a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_ddda08bf4bf0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "ddda08bf4bf0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51764-5-35-65281-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790880058, "last_seen": 1790880058, "transport": "t", "ja3_hash": "7aabdff0673e281472c187a76f132acb", "ja3_variant_count": 1, "ja3_variants": [ "7aabdff0673e281472c187a76f132acb" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e09742009b5a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e09742009b5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-35-18-51-65281-45-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508427, "last_seen": 1788508427, "transport": "t", "ja3_hash": "628c9508bce1b02e57dd9bb5360570ad", "ja3_variant_count": 1, "ja3_variants": [ "628c9508bce1b02e57dd9bb5360570ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e17254ee5df5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e17254ee5df5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-27-51764-17613-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789470321, "last_seen": 1789470321, "transport": "t", "ja3_hash": "a3887506c748ed0fc376212256418848", "ja3_variant_count": 1, "ja3_variants": [ "a3887506c748ed0fc376212256418848" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e349697808ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e349697808ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-17613-10-65281-16-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790154503, "last_seen": 1790291890, "transport": "t", "ja3_hash": "8edda5dd6f2d17688afc45533651506a", "ja3_variant_count": 2, "ja3_variants": [ "8edda5dd6f2d17688afc45533651506a", "0d9efb65199d12b327e69f9a38fdcea2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e82f445cb9ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e82f445cb9ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-35-16-18-65281-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789926979, "last_seen": 1789926979, "transport": "t", "ja3_hash": "066b2f57eccdb8318fff5bca17604a98", "ja3_variant_count": 1, "ja3_variants": [ "066b2f57eccdb8318fff5bca17604a98" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e852850f7c53", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e852850f7c53", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-23-35-16-18-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788962980, "last_seen": 1788962980, "transport": "t", "ja3_hash": "bbc41490d3b79889f8c35193928258e2", "ja3_variant_count": 1, "ja3_variants": [ "bbc41490d3b79889f8c35193928258e2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e90396f287c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e90396f287c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65281-18-16-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790196879, "last_seen": 1790196879, "transport": "t", "ja3_hash": "94cd32fbbf1181309cd1934f530c77ac", "ja3_variant_count": 1, "ja3_variants": [ "94cd32fbbf1181309cd1934f530c77ac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 14 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e9ecdefbbbe1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e9ecdefbbbe1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-65281-10-35-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790730558, "last_seen": 1790730558, "transport": "t", "ja3_hash": "6fb0d5ad4e59cc1569f878e7215b2502", "ja3_variant_count": 1, "ja3_variants": [ "6fb0d5ad4e59cc1569f878e7215b2502" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_eb88fc84c10b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "eb88fc84c10b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-11-16-65281-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788989619, "last_seen": 1788989619, "transport": "t", "ja3_hash": "c4e90202b136d3fd4df22654ff4a5384", "ja3_variant_count": 1, "ja3_variants": [ "c4e90202b136d3fd4df22654ff4a5384" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_efb7a856b3a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "efb7a856b3a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-13-11-35-65037-23-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106864, "last_seen": 1791106864, "transport": "t", "ja3_hash": "975a0d8f842cb75f6468702ea6568e4a", "ja3_variant_count": 1, "ja3_variants": [ "975a0d8f842cb75f6468702ea6568e4a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_f00339236ebf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "f00339236ebf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-23-13-35-51-16-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790154298, "last_seen": 1790154298, "transport": "t", "ja3_hash": "763a80e7b288db052a214ad5c7c12a8a", "ja3_variant_count": 1, "ja3_variants": [ "763a80e7b288db052a214ad5c7c12a8a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_02706a1fc3bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "02706a1fc3bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-5-51-35-65281-27-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689448, "last_seen": 1789689448, "transport": "t", "ja3_hash": "83cb191cee0bb3575257a54c8ded4bee", "ja3_variant_count": 1, "ja3_variants": [ "83cb191cee0bb3575257a54c8ded4bee" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_13428114bb96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "13428114bb96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-35-17613-18-65281-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788628548, "last_seen": 1788628548, "transport": "t", "ja3_hash": "2bc816e06eb552aa58458ab7e64e14dd", "ja3_variant_count": 1, "ja3_variants": [ "2bc816e06eb552aa58458ab7e64e14dd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_1ad7fd5a8478", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "1ad7fd5a8478", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-5-35-27-13-18-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789630976, "last_seen": 1789630976, "transport": "t", "ja3_hash": "27751136dd1919acffe2b975d761b7fc", "ja3_variant_count": 1, "ja3_variants": [ "27751136dd1919acffe2b975d761b7fc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_1ae0e2c1ab22", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "1ae0e2c1ab22", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-51-18-23-17613-10-27-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790327592, "last_seen": 1790327592, "transport": "t", "ja3_hash": "c30ea4a6878e53a7144cd1ba526e1de3", "ja3_variant_count": 1, "ja3_variants": [ "c30ea4a6878e53a7144cd1ba526e1de3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_224d34a5bd55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "224d34a5bd55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-65281-11-27-18-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789636391, "last_seen": 1789636391, "transport": "t", "ja3_hash": "5a48748bc5294432c9eefa999aed7b4a", "ja3_variant_count": 1, "ja3_variants": [ "5a48748bc5294432c9eefa999aed7b4a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_2ca8ceeca6ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "2ca8ceeca6ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-35-51-18-27-10-5-23,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110216, "last_seen": 1791110216, "transport": "t", "ja3_hash": "eef628b15678c1cf629fa05be9ef15a7", "ja3_variant_count": 1, "ja3_variants": [ "eef628b15678c1cf629fa05be9ef15a7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_3a2d1f110eea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "3a2d1f110eea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51764-51-13-35-27-5-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790822637, "last_seen": 1790822637, "transport": "t", "ja3_hash": "f30bea89520f5356dce74bf6e36c43e5", "ja3_variant_count": 1, "ja3_variants": [ "f30bea89520f5356dce74bf6e36c43e5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_3d314259149c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "3d314259149c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-27-23-18-11-45-13-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788841881, "last_seen": 1788841881, "transport": "t", "ja3_hash": "fae340d351103dd755df715f0aad08df", "ja3_variant_count": 1, "ja3_variants": [ "fae340d351103dd755df715f0aad08df" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_3f7dca5792fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "3f7dca5792fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-18-45-10-11-35-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790252246, "last_seen": 1790252246, "transport": "t", "ja3_hash": "764f26a2ae3ce4d50c2c392a280b69d9", "ja3_variant_count": 1, "ja3_variants": [ "764f26a2ae3ce4d50c2c392a280b69d9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_43795e057ad1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "43795e057ad1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-5-51-11-10-35-17613-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790727981, "last_seen": 1790727981, "transport": "t", "ja3_hash": "4b5c840b3a5882b501926cccaa1834d2", "ja3_variant_count": 1, "ja3_variants": [ "4b5c840b3a5882b501926cccaa1834d2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_43e95f82404d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "43e95f82404d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-23-35-11-27-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789217880, "last_seen": 1789217880, "transport": "t", "ja3_hash": "e46568799be65a83293fd070cd2f08e5", "ja3_variant_count": 1, "ja3_variants": [ "e46568799be65a83293fd070cd2f08e5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_45527fb373aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "45527fb373aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-23-27-11-65281-10-17613-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027519, "last_seen": 1789027519, "transport": "t", "ja3_hash": "c145ec2d9c4fec91c1e9b72c265033d2", "ja3_variant_count": 1, "ja3_variants": [ "c145ec2d9c4fec91c1e9b72c265033d2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_4bfd8e820e7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "4bfd8e820e7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-45-65037-17613-5-23-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789963676, "last_seen": 1789963676, "transport": "t", "ja3_hash": "7d0ee1e5c80907a36b7afba975b75dea", "ja3_variant_count": 1, "ja3_variants": [ "7d0ee1e5c80907a36b7afba975b75dea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_54d289be344e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "54d289be344e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-17613-65281-18-51-13-45-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788826499, "last_seen": 1788826499, "transport": "t", "ja3_hash": "1a919f2cbce36d865ccf7653c85a330b", "ja3_variant_count": 1, "ja3_variants": [ "1a919f2cbce36d865ccf7653c85a330b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_5ebf94746501", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "5ebf94746501", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-17613-18-35-5-23-13-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788738998, "last_seen": 1788738998, "transport": "t", "ja3_hash": "66d7b9de82b4f0526e54842348d7e700", "ja3_variant_count": 1, "ja3_variants": [ "66d7b9de82b4f0526e54842348d7e700" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_7298bdaaabd7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "7298bdaaabd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-13-11-51-5-65037-35-17513,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791140793, "last_seen": 1791140793, "transport": "t", "ja3_hash": "c3198991767043d03bfcdb4d0f3a4a9b", "ja3_variant_count": 1, "ja3_variants": [ "c3198991767043d03bfcdb4d0f3a4a9b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_74982164794e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "74982164794e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-5-65281-35-65037-18-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789008531, "last_seen": 1789008531, "transport": "t", "ja3_hash": "f2fd6bd83ad773d69e952b589745b92b", "ja3_variant_count": 1, "ja3_variants": [ "f2fd6bd83ad773d69e952b589745b92b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_7fb2951890b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "7fb2951890b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-27-45-35-11-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790922476, "last_seen": 1790922476, "transport": "t", "ja3_hash": "0370f08be94dc0cd4cc32e076a05ab1f", "ja3_variant_count": 1, "ja3_variants": [ "0370f08be94dc0cd4cc32e076a05ab1f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_85ede9c2786f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "85ede9c2786f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-18-51-5-45-11-17613-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788467374, "last_seen": 1788467374, "transport": "t", "ja3_hash": "4b046c00c19ad47f7201718d4fd43ca4", "ja3_variant_count": 1, "ja3_variants": [ "4b046c00c19ad47f7201718d4fd43ca4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 33 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_865ac0f3fbcc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "865ac0f3fbcc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-13-10-51-65281-23-5-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790563534, "last_seen": 1790563534, "transport": "t", "ja3_hash": "1669e429a18a07a3050f787055fea2e7", "ja3_variant_count": 1, "ja3_variants": [ "1669e429a18a07a3050f787055fea2e7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_8d2dd8f356d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "8d2dd8f356d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-18-17613-35-65281-13-45-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791153795, "last_seen": 1791153795, "transport": "t", "ja3_hash": "a1c83e6fd95c019b4bd3d11101ed8ce6", "ja3_variant_count": 1, "ja3_variants": [ "a1c83e6fd95c019b4bd3d11101ed8ce6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_90161e6e878f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "90161e6e878f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-45-13-10-35-51-18-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790657935, "last_seen": 1790657935, "transport": "t", "ja3_hash": "89c80dee662b2f12f3443c9a6ecb51b2", "ja3_variant_count": 1, "ja3_variants": [ "89c80dee662b2f12f3443c9a6ecb51b2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_958c95e93962", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "958c95e93962", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-51-11-13-65281-45-35-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790222130, "last_seen": 1790222130, "transport": "t", "ja3_hash": "b3ffcb3fc68600bb5503f115337a58ee", "ja3_variant_count": 1, "ja3_variants": [ "b3ffcb3fc68600bb5503f115337a58ee" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_a236a3e43c99", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "a236a3e43c99", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-17613-27-65281-65037-45-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789027288, "last_seen": 1789027288, "transport": "t", "ja3_hash": "b4ad9ffb0d25fe2dce7b03f1791c037b", "ja3_variant_count": 1, "ja3_variants": [ "b4ad9ffb0d25fe2dce7b03f1791c037b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_a3c42e699f67", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "a3c42e699f67", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-10-11-27-45-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789418249, "last_seen": 1789418249, "transport": "t", "ja3_hash": "26284d809aa9dc2d7ddc48cf80870577", "ja3_variant_count": 1, "ja3_variants": [ "26284d809aa9dc2d7ddc48cf80870577" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 9 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_a8b4dfc4b8be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "a8b4dfc4b8be", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-11-35-27-51-13-18-17613,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791032371, "last_seen": 1791032371, "transport": "t", "ja3_hash": "e08b3515d05200533e28e0faa7d8d9bb", "ja3_variant_count": 1, "ja3_variants": [ "e08b3515d05200533e28e0faa7d8d9bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_a8d251cf0c2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "a8d251cf0c2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-11-10-27-23-17613-45-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788888915, "last_seen": 1788888915, "transport": "t", "ja3_hash": "cb235069cd4688ef38314d428942fc48", "ja3_variant_count": 1, "ja3_variants": [ "cb235069cd4688ef38314d428942fc48" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_b021163a18f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "b021163a18f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-5-65281-23-27-13-17613-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788460139, "last_seen": 1788460139, "transport": "t", "ja3_hash": "9f21cc8ed6ba926daabce8629978dd4b", "ja3_variant_count": 1, "ja3_variants": [ "9f21cc8ed6ba926daabce8629978dd4b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_c32e09ac7678", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "c32e09ac7678", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-45-65037-5-35-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791088488, "last_seen": 1791088488, "transport": "t", "ja3_hash": "161fbca737aac68d640a520bb7a22c66", "ja3_variant_count": 1, "ja3_variants": [ "161fbca737aac68d640a520bb7a22c66" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_d12988bb14f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "d12988bb14f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-23-65281-11-45-10-35-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789488136, "last_seen": 1789488136, "transport": "t", "ja3_hash": "b95b5b44ea2d33fed875b001c62f871e", "ja3_variant_count": 1, "ja3_variants": [ "b95b5b44ea2d33fed875b001c62f871e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_d9c43d5bdda3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "d9c43d5bdda3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-51-5-11-23-10-65281-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790219979, "last_seen": 1790570108, "transport": "t", "ja3_hash": "bc8deb076cc4848d42d6a47952943808", "ja3_variant_count": 2, "ja3_variants": [ "bc8deb076cc4848d42d6a47952943808", "354e115006cc2c4403813c1ad75c93bd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_e584045b194f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "e584045b194f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-35-5-23-10-17613-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790932305, "last_seen": 1790932305, "transport": "t", "ja3_hash": "084e9a2ad86386ba1376034041e9f87b", "ja3_variant_count": 1, "ja3_variants": [ "084e9a2ad86386ba1376034041e9f87b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_e9137b20c438", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "e9137b20c438", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-51764-51-18-35-23-65281-5,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077842, "last_seen": 1791077842, "transport": "t", "ja3_hash": "3bf2fa5b1dbdb25c06831f5510b6f3e6", "ja3_variant_count": 1, "ja3_variants": [ "3bf2fa5b1dbdb25c06831f5510b6f3e6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_eca731314731", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "eca731314731", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-13-65281-45-10-65037-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790274659, "last_seen": 1790274659, "transport": "t", "ja3_hash": "4167023b0750144f3d7e5de7ac99dff0", "ja3_variant_count": 1, "ja3_variants": [ "4167023b0750144f3d7e5de7ac99dff0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_eecc845b2467", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "eecc845b2467", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-11-13-18-51-23-65281-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788826932, "last_seen": 1788826932, "transport": "t", "ja3_hash": "3c1f856f595831b5ae08aad19bdbf536", "ja3_variant_count": 1, "ja3_variants": [ "3c1f856f595831b5ae08aad19bdbf536" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h1_8daaf6152771_278308f11b70", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h1", "b": "8daaf6152771", "c": "278308f11b70", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-16-5-27-45-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790989585, "last_seen": 1790989585, "transport": "t", "ja3_hash": "57ed0ed8b74de3a7ed7253ef5b2a01fb", "ja3_variant_count": 1, "ja3_variants": [ "57ed0ed8b74de3a7ed7253ef5b2a01fb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h1_8daaf6152771_97286b3f6f5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h1", "b": "8daaf6152771", "c": "97286b3f6f5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-11-23-65281-10-18-13-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790651156, "last_seen": 1790651156, "transport": "t", "ja3_hash": "b0e1e8d1d9bf365ba25cc6035ff69367", "ja3_variant_count": 1, "ja3_variants": [ "b0e1e8d1d9bf365ba25cc6035ff69367" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h1_8daaf6152771_9a45daa4c7a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h1", "b": "8daaf6152771", "c": "9a45daa4c7a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-13-45-27-5-65037-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790522959, "last_seen": 1790522959, "transport": "t", "ja3_hash": "b95e6bb4f3178c6aececc74db26b1e14", "ja3_variant_count": 1, "ja3_variants": [ "b95e6bb4f3178c6aececc74db26b1e14" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h1_8daaf6152771_9ebb0b94e800", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h1", "b": "8daaf6152771", "c": "9ebb0b94e800", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-27-10-23-45-18-35-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790985849, "last_seen": 1790985849, "transport": "t", "ja3_hash": "df2eef452d19386871701590c0274d57", "ja3_variant_count": 1, "ja3_variants": [ "df2eef452d19386871701590c0274d57" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h1_8daaf6152771_ca6dd1ddc9db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h1", "b": "8daaf6152771", "c": "ca6dd1ddc9db", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-65281-5-16-10-65037-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790553676, "last_seen": 1790553676, "transport": "t", "ja3_hash": "62b352aecdb9ecf970c79e5067c1ab4a", "ja3_variant_count": 1, "ja3_variants": [ "62b352aecdb9ecf970c79e5067c1ab4a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h1_8daaf6152771_cb3dea40f80e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h1", "b": "8daaf6152771", "c": "cb3dea40f80e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-45-65281-10-27-18-35-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790559869, "last_seen": 1790559869, "transport": "t", "ja3_hash": "1fe1f9d6a56182a8e9c079f6951962bc", "ja3_variant_count": 1, "ja3_variants": [ "1fe1f9d6a56182a8e9c079f6951962bc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h1_8daaf6152771_d590d037bcb9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h1", "b": "8daaf6152771", "c": "d590d037bcb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-18-65037-13-27-65281-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790522906, "last_seen": 1790522906, "transport": "t", "ja3_hash": "cbab0949235b225d6a9f8ca9e7b93dc2", "ja3_variant_count": 1, "ja3_variants": [ "cbab0949235b225d6a9f8ca9e7b93dc2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_043149d10792", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "043149d10792", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-65281-27-5-13-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789691717, "last_seen": 1789691717, "transport": "t", "ja3_hash": "f08729e5c09e7dd2c002a77940b82f44", "ja3_variant_count": 1, "ja3_variants": [ "f08729e5c09e7dd2c002a77940b82f44" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_0713f0201a37", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "0713f0201a37", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-45-10-65037-35-23-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789482721, "last_seen": 1789482721, "transport": "t", "ja3_hash": "c5b86150d8e43be309330b8216d356f9", "ja3_variant_count": 1, "ja3_variants": [ "c5b86150d8e43be309330b8216d356f9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_0f5818e97338", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "0f5818e97338", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-5-18-17613-51764-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790777246, "last_seen": 1790777246, "transport": "t", "ja3_hash": "14aae96cce48662cbcf035e798fd066e", "ja3_variant_count": 1, "ja3_variants": [ "14aae96cce48662cbcf035e798fd066e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_116f2f17f50e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "116f2f17f50e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-5-16-51-17613-27-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790731238, "last_seen": 1790731238, "transport": "t", "ja3_hash": "242717650e95f4ec9e2f7fe46adedb2a", "ja3_variant_count": 1, "ja3_variants": [ "242717650e95f4ec9e2f7fe46adedb2a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_1c164b969c77", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "1c164b969c77", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-17613-5-18-65037-16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790001616, "last_seen": 1790001616, "transport": "t", "ja3_hash": "0fa93f4372980c90d228c5e808809acf", "ja3_variant_count": 1, "ja3_variants": [ "0fa93f4372980c90d228c5e808809acf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_2070061c9b5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "2070061c9b5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-5-65281-10-16-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789899208, "last_seen": 1789899208, "transport": "t", "ja3_hash": "3a308ec41c97d204b59db923387abcf4", "ja3_variant_count": 1, "ja3_variants": [ "3a308ec41c97d204b59db923387abcf4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_267ae019230d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "267ae019230d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-51-11-65281-45-16-17513-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788609803, "last_seen": 1788609803, "transport": "t", "ja3_hash": "f4e6d7847e24442666db2dffcbbfce23", "ja3_variant_count": 1, "ja3_variants": [ "f4e6d7847e24442666db2dffcbbfce23" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_2758bf5cf4c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "2758bf5cf4c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-13-23-45-10-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789692899, "last_seen": 1789692899, "transport": "t", "ja3_hash": "18ae7d216ee488f2bdebbebe4508c51a", "ja3_variant_count": 1, "ja3_variants": [ "18ae7d216ee488f2bdebbebe4508c51a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_34c521998e9f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "34c521998e9f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-23-18-27-13-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790303923, "last_seen": 1790303923, "transport": "t", "ja3_hash": "e029e1ef6e97f1c6e58024e43a16763a", "ja3_variant_count": 1, "ja3_variants": [ "e029e1ef6e97f1c6e58024e43a16763a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 60 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_34d0b950012e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "34d0b950012e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-13-16-65037-45-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790457882, "last_seen": 1790457882, "transport": "t", "ja3_hash": "69a8e388a4d54a0e1d90b83b86dd32b2", "ja3_variant_count": 1, "ja3_variants": [ "69a8e388a4d54a0e1d90b83b86dd32b2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_3a6e99d6bdfb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "3a6e99d6bdfb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-45-11-51764-13-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790782671, "last_seen": 1790782671, "transport": "t", "ja3_hash": "80cc7ea3ca49a6ed13e647fee25e797d", "ja3_variant_count": 1, "ja3_variants": [ "80cc7ea3ca49a6ed13e647fee25e797d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_3cf5ebef9d4f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "3cf5ebef9d4f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-16-18-27-35-65281-51-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790531410, "last_seen": 1790531410, "transport": "t", "ja3_hash": "1e7008294fbb39ba455f68689585519d", "ja3_variant_count": 1, "ja3_variants": [ "1e7008294fbb39ba455f68689585519d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_3ed23afe0d4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "3ed23afe0d4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-51-27-18-23-35-10-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789687631, "last_seen": 1789687631, "transport": "t", "ja3_hash": "3d53b2cce2d1cd98d89c09168d666594", "ja3_variant_count": 1, "ja3_variants": [ "3d53b2cce2d1cd98d89c09168d666594" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_53a296f3b271", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "53a296f3b271", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-17613-35-23-11-13-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790019502, "last_seen": 1790019502, "transport": "t", "ja3_hash": "42039e73c87b414e7ba0c9a42d46c8ab", "ja3_variant_count": 1, "ja3_variants": [ "42039e73c87b414e7ba0c9a42d46c8ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_6ac2b8892639", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "6ac2b8892639", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-23-18-10-16-35-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790618314, "last_seen": 1790618314, "transport": "t", "ja3_hash": "f669d2a1d3a9d9ddee4dd6a9047b9eb6", "ja3_variant_count": 1, "ja3_variants": [ "f669d2a1d3a9d9ddee4dd6a9047b9eb6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_6bf98bfc8885", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "6bf98bfc8885", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-18-65281-10-17613-27-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790088805, "last_seen": 1790088805, "transport": "t", "ja3_hash": "3655b34825011e4429e0be6d95e0062b", "ja3_variant_count": 1, "ja3_variants": [ "3655b34825011e4429e0be6d95e0062b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_746c3ac52586", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "746c3ac52586", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-18-16-10-35-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791288179, "last_seen": 1791288179, "transport": "t", "ja3_hash": "1acaef8c80ec4d3a50e81d93a5d20e16", "ja3_variant_count": 1, "ja3_variants": [ "1acaef8c80ec4d3a50e81d93a5d20e16" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_775507439a8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "775507439a8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-16-45-27-11-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790260465, "last_seen": 1790260465, "transport": "t", "ja3_hash": "21b6dbce9c4f54d694638a53c682eecc", "ja3_variant_count": 1, "ja3_variants": [ "21b6dbce9c4f54d694638a53c682eecc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_7a6afff35f3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "7a6afff35f3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-11-35-17613-65037-18-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790246275, "last_seen": 1790246275, "transport": "t", "ja3_hash": "796b8ee5f2929fd86d238a0e9fe39513", "ja3_variant_count": 1, "ja3_variants": [ "796b8ee5f2929fd86d238a0e9fe39513" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_7dd926585955", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "7dd926585955", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-16-17613-11-35-65037-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788573735, "last_seen": 1788573735, "transport": "t", "ja3_hash": "b29f9f144ac641fd571efa5a0947e506", "ja3_variant_count": 1, "ja3_variants": [ "b29f9f144ac641fd571efa5a0947e506" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_7f3fcbd3c745", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "7f3fcbd3c745", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-65037-45-23-16-11-35-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790957223, "last_seen": 1790957223, "transport": "t", "ja3_hash": "68b8a08c883bd6b7c9e0cf3f55338cc9", "ja3_variant_count": 1, "ja3_variants": [ "68b8a08c883bd6b7c9e0cf3f55338cc9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_81c086a07df0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "81c086a07df0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-5-45-18-17513-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790513110, "last_seen": 1790513110, "transport": "t", "ja3_hash": "e14109a67cd1111848d7f5c9fa7708f2", "ja3_variant_count": 1, "ja3_variants": [ "e14109a67cd1111848d7f5c9fa7708f2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_81e7cbc761f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "81e7cbc761f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-35-13-45-18-5-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789768982, "last_seen": 1789768982, "transport": "t", "ja3_hash": "1f1c004dd1914ef8398d8eedf52be3e8", "ja3_variant_count": 1, "ja3_variants": [ "1f1c004dd1914ef8398d8eedf52be3e8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_ac7a5afb8c9b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "ac7a5afb8c9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-18-5-11-23-27-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790532756, "last_seen": 1790532756, "transport": "t", "ja3_hash": "0c02d7efb19a81add9b7436526b923e8", "ja3_variant_count": 1, "ja3_variants": [ "0c02d7efb19a81add9b7436526b923e8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_b125ead79f21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "b125ead79f21", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-13-16-35-17613-27-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789086299, "last_seen": 1790561742, "transport": "t", "ja3_hash": "9ce26ee442e420b484791def8ab0d737", "ja3_variant_count": 2, "ja3_variants": [ "9ce26ee442e420b484791def8ab0d737", "4a42bba41314a444ace65ae38f837dd3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12i1509h2_8daaf6152771_b668ed65f794", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "b668ed65f794", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-13-11-27-10-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789116553, "last_seen": 1789116553, "transport": "t", "ja3_hash": "3ef8f9c7b4e4219142b94c79277556f4", "ja3_variant_count": 1, "ja3_variants": [ "3ef8f9c7b4e4219142b94c79277556f4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_c2e0e01eb4e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "c2e0e01eb4e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-17613-45-16-51-35-65281-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790979358, "last_seen": 1790979358, "transport": "t", "ja3_hash": "aeae1bf8b7606d83b3c5366a4cfd6207", "ja3_variant_count": 1, "ja3_variants": [ "aeae1bf8b7606d83b3c5366a4cfd6207" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_c85a0286aad9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "c85a0286aad9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-23-17613-18-16-5-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789752458, "last_seen": 1789752458, "transport": "t", "ja3_hash": "fb8a01af6eda1f6687475d2b07145e65", "ja3_variant_count": 1, "ja3_variants": [ "fb8a01af6eda1f6687475d2b07145e65" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_d1037c3b5598", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "d1037c3b5598", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-35-65037-11-45-16-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791135414, "last_seen": 1791135414, "transport": "t", "ja3_hash": "c55550bc814be19ba8187cacb968b1de", "ja3_variant_count": 1, "ja3_variants": [ "c55550bc814be19ba8187cacb968b1de" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_d3e0c730082d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "d3e0c730082d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-35-65037-5-18-16-10-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791259124, "last_seen": 1791259124, "transport": "t", "ja3_hash": "0d3c7756c117f0f3ed17c5222bfdc537", "ja3_variant_count": 1, "ja3_variants": [ "0d3c7756c117f0f3ed17c5222bfdc537" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_d7300223b3d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "d7300223b3d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-45-18-51764-5-35-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790702438, "last_seen": 1790702438, "transport": "t", "ja3_hash": "743be1e3eff6141c83195e559a953163", "ja3_variant_count": 1, "ja3_variants": [ "743be1e3eff6141c83195e559a953163" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_d7e7da3d8ae6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "d7e7da3d8ae6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-10-16-65037-35-18-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788773737, "last_seen": 1789749892, "transport": "t", "ja3_hash": "e4240ec6cc4cc020197bfee74fd5b37b", "ja3_variant_count": 2, "ja3_variants": [ "e4240ec6cc4cc020197bfee74fd5b37b", "80e6ed681ec7df727cafaad72b1679b0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_d8475a19aff0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "d8475a19aff0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-65037-16-51764-10-35-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791112534, "last_seen": 1791112534, "transport": "t", "ja3_hash": "ba5e21d7f1ff96f755ef564aed5278ae", "ja3_variant_count": 1, "ja3_variants": [ "ba5e21d7f1ff96f755ef564aed5278ae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 32 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_e79371749d93", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "e79371749d93", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-13-18-27-65281-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730707, "last_seen": 1789730707, "transport": "t", "ja3_hash": "6e9d46d33aa8a085fa5c31b6da0bcae8", "ja3_variant_count": 1, "ja3_variants": [ "6e9d46d33aa8a085fa5c31b6da0bcae8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_e981d188a2e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "e981d188a2e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-65037-17613-45-16-65281-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789769758, "last_seen": 1789769758, "transport": "t", "ja3_hash": "f033533832b61905fe7225e5e474dba2", "ja3_variant_count": 1, "ja3_variants": [ "f033533832b61905fe7225e5e474dba2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_ee14f429060f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "ee14f429060f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-13-16-11-18-45-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790223667, "last_seen": 1790223667, "transport": "t", "ja3_hash": "a4f1d124cb0b6fed511c08be50d6dfcf", "ja3_variant_count": 1, "ja3_variants": [ "a4f1d124cb0b6fed511c08be50d6dfcf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_f385d413060f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "f385d413060f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-18-23-11-45-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789677741, "last_seen": 1789677741, "transport": "t", "ja3_hash": "42a7adc44071fa372ad9f88cef83d8ec", "ja3_variant_count": 1, "ja3_variants": [ "42a7adc44071fa372ad9f88cef83d8ec" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 21 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_fccdfb8687e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "fccdfb8687e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-65281-35-10-45-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791253677, "last_seen": 1791253677, "transport": "t", "ja3_hash": "07c0399fc523afa402728ee8a1fa6e67", "ja3_variant_count": 1, "ja3_variants": [ "07c0399fc523afa402728ee8a1fa6e67" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 7 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_ffd5b39346fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "ffd5b39346fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-27-51764-11-18-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790236352, "last_seen": 1790236352, "transport": "t", "ja3_hash": "eee36af01aab170b2953f7c9d97d5cb3", "ja3_variant_count": 1, "ja3_variants": [ "eee36af01aab170b2953f7c9d97d5cb3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_ffdfbf7a750e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "ffdfbf7a750e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-18-16-51-11-51764-17613-23,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789936899, "last_seen": 1789936899, "transport": "t", "ja3_hash": "0c6a36a93c6a1a5603fb949cbf978d32", "ja3_variant_count": 1, "ja3_variants": [ "0c6a36a93c6a1a5603fb949cbf978d32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_2f1cb7d8778d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "2f1cb7d8778d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-23-5-10-65037-65281-17513-51-18,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791258925, "last_seen": 1791258925, "transport": "t", "ja3_hash": "7665ff5dbc0ad517c725f31bd1c4cdc5", "ja3_variant_count": 1, "ja3_variants": [ "7665ff5dbc0ad517c725f31bd1c4cdc5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_3e4a09fb27fb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "3e4a09fb27fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-51764-10-45-27-23-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790138452, "last_seen": 1790138452, "transport": "t", "ja3_hash": "d79c7e4f74b49aafd13b8de75fad3d57", "ja3_variant_count": 1, "ja3_variants": [ "d79c7e4f74b49aafd13b8de75fad3d57" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_42bd3d7520e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "42bd3d7520e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-23-11-5-45-65281-65037-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790545215, "last_seen": 1790545215, "transport": "t", "ja3_hash": "346927cee7e7d7810811fdd8033fa078", "ja3_variant_count": 1, "ja3_variants": [ "346927cee7e7d7810811fdd8033fa078" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_46ee8fae0d91", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "46ee8fae0d91", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-65281-11-45-5-10-18-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790773473, "last_seen": 1790773473, "transport": "t", "ja3_hash": "bee9adc1b98890dbc6464ea0a2e2d905", "ja3_variant_count": 1, "ja3_variants": [ "bee9adc1b98890dbc6464ea0a2e2d905" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Vivaldi/7.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_4b41e2769a14", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "4b41e2769a14", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-10-17613-23-27-13-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789849735, "last_seen": 1789849735, "transport": "t", "ja3_hash": "b0406c31de2fbc575cbd5092fdeee4a3", "ja3_variant_count": 1, "ja3_variants": [ "b0406c31de2fbc575cbd5092fdeee4a3" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/136.0 Mobile/15E148 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_4e49c9a066bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "4e49c9a066bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-13-5-18-10-65037-27-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790675936, "last_seen": 1790675936, "transport": "t", "ja3_hash": "497fa039fd2b49795c012c438604cdd2", "ja3_variant_count": 1, "ja3_variants": [ "497fa039fd2b49795c012c438604cdd2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_517d525ec158", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "517d525ec158", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-27-65281-45-17613-10-18-11-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790025291, "last_seen": 1790025291, "transport": "t", "ja3_hash": "5486d5af6eb5eb1508a5ae873d7cb16e", "ja3_variant_count": 1, "ja3_variants": [ "5486d5af6eb5eb1508a5ae873d7cb16e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_550415d7c6f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "550415d7c6f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-65037-27-17613-65281-13-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789012923, "last_seen": 1790907948, "transport": "t", "ja3_hash": "300711c85a0497f1543dbef4d0153cf3", "ja3_variant_count": 2, "ja3_variants": [ "300711c85a0497f1543dbef4d0153cf3", "6a7b7aaedc0d1cf646c0bc1746de1b68" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_5af25557be9b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "5af25557be9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-17613-23-11-65037-5-13-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789687703, "last_seen": 1791276173, "transport": "t", "ja3_hash": "89d38165f53b2419d879543d29fcc55e", "ja3_variant_count": 2, "ja3_variants": [ "89d38165f53b2419d879543d29fcc55e", "6f9a4014bc5336d7969b7ed714b51c65" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_77c14fbc4d5b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "77c14fbc4d5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-45-18-17513-5-35-10-51-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791155761, "last_seen": 1791155761, "transport": "t", "ja3_hash": "215ad09329da93786a1c798c287445f3", "ja3_variant_count": 1, "ja3_variants": [ "215ad09329da93786a1c798c287445f3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_8f205d926981", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "8f205d926981", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-18-17613-23-5-10-65281-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789000012, "last_seen": 1789000012, "transport": "t", "ja3_hash": "faaa098aa30e5039b20538fbf6bae78e", "ja3_variant_count": 1, "ja3_variants": [ "faaa098aa30e5039b20538fbf6bae78e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_94d701a4dfb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "94d701a4dfb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-10-11-51-17613-18-65281-23-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790650477, "last_seen": 1790650477, "transport": "t", "ja3_hash": "4f473e319f5cec71f33eac2aa2bb3838", "ja3_variant_count": 1, "ja3_variants": [ "4f473e319f5cec71f33eac2aa2bb3838" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_af5eb781b539", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "af5eb781b539", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-11-51-23-45-5-18-65281-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790177082, "last_seen": 1790177082, "transport": "t", "ja3_hash": "eca438c70bbcab3172ec1554a304cfcd", "ja3_variant_count": 1, "ja3_variants": [ "eca438c70bbcab3172ec1554a304cfcd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_03e89b1bfde9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "03e89b1bfde9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-65037-35-10-11-13-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789482812, "last_seen": 1789482812, "transport": "t", "ja3_hash": "5b3a9f06bb4854f040249ef7d5926319", "ja3_variant_count": 1, "ja3_variants": [ "5b3a9f06bb4854f040249ef7d5926319" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_0a2cc8e82a13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "0a2cc8e82a13", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-18-10-27-16-65037-13-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790007307, "last_seen": 1790007307, "transport": "t", "ja3_hash": "d094569876b2aa26950c8d15d68254e1", "ja3_variant_count": 1, "ja3_variants": [ "d094569876b2aa26950c8d15d68254e1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_0e27bb750d3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "0e27bb750d3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-18-5-17613-16-45-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790729681, "last_seen": 1790729681, "transport": "t", "ja3_hash": "2e08e38af2b515e3238ce4ca2a5d5642", "ja3_variant_count": 1, "ja3_variants": [ "2e08e38af2b515e3238ce4ca2a5d5642" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_11e0ccab34b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "11e0ccab34b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-65281-13-35-5-18-17613-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790217483, "last_seen": 1790217483, "transport": "t", "ja3_hash": "d4692d81e4d22e3ce8dc593e37bcb014", "ja3_variant_count": 1, "ja3_variants": [ "d4692d81e4d22e3ce8dc593e37bcb014" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_1524f91e48e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "1524f91e48e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-5-11-16-13-45-17613-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788704472, "last_seen": 1788704472, "transport": "t", "ja3_hash": "902102ed9c6c91caf1a2028229a2cda5", "ja3_variant_count": 1, "ja3_variants": [ "902102ed9c6c91caf1a2028229a2cda5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_2076b116f6f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "2076b116f6f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-16-65037-45-18-23-10-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790977178, "last_seen": 1790977178, "transport": "t", "ja3_hash": "1cfd0f001d3f275ae1a1d9108baba35e", "ja3_variant_count": 1, "ja3_variants": [ "1cfd0f001d3f275ae1a1d9108baba35e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 64 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_2121e196900d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "2121e196900d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-16-51-45-23-27-5-11-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789985140, "last_seen": 1790650319, "transport": "t", "ja3_hash": "a3ff1db468a5eefd4b1665bd1f0f87c4", "ja3_variant_count": 2, "ja3_variants": [ "a3ff1db468a5eefd4b1665bd1f0f87c4", "e9c0adbab551178197879e198ee240fa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_2206e2163ff6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "2206e2163ff6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-51-65281-5-18-35-17513-45-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790751371, "last_seen": 1790751371, "transport": "t", "ja3_hash": "2caa80cb56a9466c0a24ef839f111f8e", "ja3_variant_count": 1, "ja3_variants": [ "2caa80cb56a9466c0a24ef839f111f8e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_2620f9fc64c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "2620f9fc64c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-23-5-45-18-11-13-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790007335, "last_seen": 1790007335, "transport": "t", "ja3_hash": "807f68cfe355ee2ecc7f6a424ad25d64", "ja3_variant_count": 1, "ja3_variants": [ "807f68cfe355ee2ecc7f6a424ad25d64" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; SM-G991B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/25.0 Chrome/121.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_26d27a2b44d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "26d27a2b44d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-27-35-51-45-17613-16-18-65281,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788458886, "last_seen": 1788458886, "transport": "t", "ja3_hash": "462782f872f8e5efed573c7e7cb5f5fa", "ja3_variant_count": 1, "ja3_variants": [ "462782f872f8e5efed573c7e7cb5f5fa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_31c5538355e8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "31c5538355e8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-65281-5-27-18-65037-11-51-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789309279, "last_seen": 1791109561, "transport": "t", "ja3_hash": "8633ea553fca9412b3867f70fc31ec99", "ja3_variant_count": 2, "ja3_variants": [ "8633ea553fca9412b3867f70fc31ec99", "930c570f4d41876c6fa9e27455855897" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 69 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_36ee61eab9ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "36ee61eab9ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-16-13-17613-65037-45-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789889287, "last_seen": 1789889287, "transport": "t", "ja3_hash": "daae51aab3c52bec1d467cb0d3720144", "ja3_variant_count": 1, "ja3_variants": [ "daae51aab3c52bec1d467cb0d3720144" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_37fac9eb5762", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "37fac9eb5762", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65281-5-23-18-65037-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789811851, "last_seen": 1789811851, "transport": "t", "ja3_hash": "47e2ce8d5952f03daadd195629634a9e", "ja3_variant_count": 1, "ja3_variants": [ "47e2ce8d5952f03daadd195629634a9e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_384c21662840", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "384c21662840", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-13-65281-27-10-18-16-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790621060, "last_seen": 1790621060, "transport": "t", "ja3_hash": "dbc6cee50c147f51cf5093de4ca3a7bb", "ja3_variant_count": 1, "ja3_variants": [ "dbc6cee50c147f51cf5093de4ca3a7bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_3a1d7dd03ee2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "3a1d7dd03ee2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-65037-10-16-13-17613-35-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790669021, "last_seen": 1790669021, "transport": "t", "ja3_hash": "bf0c5c21faafef500c8e33c7111332be", "ja3_variant_count": 1, "ja3_variants": [ "bf0c5c21faafef500c8e33c7111332be" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_4389e0a20b60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "4389e0a20b60", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-23-18-65037-17613-16-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790773606, "last_seen": 1790773606, "transport": "t", "ja3_hash": "5c5e6c3f92fd4e52d834de18a7c7f833", "ja3_variant_count": 1, "ja3_variants": [ "5c5e6c3f92fd4e52d834de18a7c7f833" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_47c13b046d31", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "47c13b046d31", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-13-45-10-16-65281-35-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790551641, "last_seen": 1790551641, "transport": "t", "ja3_hash": "ce6d81ad21f6e45d1f7c5549a62adab7", "ja3_variant_count": 1, "ja3_variants": [ "ce6d81ad21f6e45d1f7c5549a62adab7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_5427d4cfde9c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "5427d4cfde9c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-23-17613-16-65281-65037-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790239285, "last_seen": 1790239285, "transport": "t", "ja3_hash": "0e0d58e1b3686a4e0b56e7739593201c", "ja3_variant_count": 1, "ja3_variants": [ "0e0d58e1b3686a4e0b56e7739593201c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_6d5c674f3f1b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "6d5c674f3f1b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-13-27-45-17613-16-51764-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789732994, "last_seen": 1789732994, "transport": "t", "ja3_hash": "9e566f103cf5ae7b8cc6112aeb8d7f69", "ja3_variant_count": 1, "ja3_variants": [ "9e566f103cf5ae7b8cc6112aeb8d7f69" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_9440e2f5beaa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "9440e2f5beaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-16-13-11-5-23-27-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723991, "last_seen": 1788723991, "transport": "t", "ja3_hash": "6ec51869818733b42f78b19fbbea87f8", "ja3_variant_count": 1, "ja3_variants": [ "6ec51869818733b42f78b19fbbea87f8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_a1cde03dc164", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "a1cde03dc164", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-65037-27-65281-45-18-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789025917, "last_seen": 1789025917, "transport": "t", "ja3_hash": "1d0c7ef64f4d03b2f2a2ce464e41f3b1", "ja3_variant_count": 1, "ja3_variants": [ "1d0c7ef64f4d03b2f2a2ce464e41f3b1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_a8c29262942a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "a8c29262942a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-5-65281-18-16-35-17613-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790240944, "last_seen": 1790240944, "transport": "t", "ja3_hash": "c7947967344c54b4cee6137712422dc9", "ja3_variant_count": 1, "ja3_variants": [ "c7947967344c54b4cee6137712422dc9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_acf877699d82", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "acf877699d82", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-23-17613-11-10-16-45-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790111083, "last_seen": 1790111083, "transport": "t", "ja3_hash": "b30fa0270214b51216f5ef3d058e2e9d", "ja3_variant_count": 1, "ja3_variants": [ "b30fa0270214b51216f5ef3d058e2e9d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_af6c2fe9f78f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "af6c2fe9f78f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-16-27-17613-13-23-51764-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789731594, "last_seen": 1789731594, "transport": "t", "ja3_hash": "47161fd30dae8c2ee6b642d447738bee", "ja3_variant_count": 1, "ja3_variants": [ "47161fd30dae8c2ee6b642d447738bee" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_c118ff6a9da0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "c118ff6a9da0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-10-27-16-13-65281-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788747167, "last_seen": 1788747167, "transport": "t", "ja3_hash": "ff752606be90302a5970f86bdcfa68e0", "ja3_variant_count": 1, "ja3_variants": [ "ff752606be90302a5970f86bdcfa68e0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_d0e985491ad0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "d0e985491ad0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-45-5-16-13-35-17613-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790692774, "last_seen": 1790692774, "transport": "t", "ja3_hash": "55e440ea012c53974c884d1f90909a05", "ja3_variant_count": 1, "ja3_variants": [ "55e440ea012c53974c884d1f90909a05" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_d25578c35628", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "d25578c35628", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-23-13-65281-11-27-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789457567, "last_seen": 1789457567, "transport": "t", "ja3_hash": "085c1fb5a20c067ad016d405dd1dfff6", "ja3_variant_count": 1, "ja3_variants": [ "085c1fb5a20c067ad016d405dd1dfff6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_d6b76ea82213", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "d6b76ea82213", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-45-18-65037-5-10-65281-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790773376, "last_seen": 1790773376, "transport": "t", "ja3_hash": "d260789461307d269cefccd973a031f9", "ja3_variant_count": 1, "ja3_variants": [ "d260789461307d269cefccd973a031f9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_d908cd492165", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "d908cd492165", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-13-27-65281-45-16-18-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790713738, "last_seen": 1790713738, "transport": "t", "ja3_hash": "2fea3a28a13bb1828302b9366becbf55", "ja3_variant_count": 1, "ja3_variants": [ "2fea3a28a13bb1828302b9366becbf55" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.5 Mobile/15A372 Safari/604.1": 9 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_dd6f794bfbe7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "dd6f794bfbe7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-35-16-5-18-45-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789967045, "last_seen": 1789967045, "transport": "t", "ja3_hash": "da35c835a8e5afd31143803a4ae6c5a1", "ja3_variant_count": 1, "ja3_variants": [ "da35c835a8e5afd31143803a4ae6c5a1" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/136.0 Mobile/15E148 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_e2ec9c2c4baa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "e2ec9c2c4baa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-45-18-65037-5-17613-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024395, "last_seen": 1789024395, "transport": "t", "ja3_hash": "973f9505b999d77aadd2fd01e018bc74", "ja3_variant_count": 1, "ja3_variants": [ "973f9505b999d77aadd2fd01e018bc74" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_f384abc1606a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "f384abc1606a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-11-17613-10-65037-13-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790348611, "last_seen": 1790348611, "transport": "t", "ja3_hash": "2439f80281cfc8bdbf50edb9a84c3651", "ja3_variant_count": 1, "ja3_variants": [ "2439f80281cfc8bdbf50edb9a84c3651" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1 }, "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_fea27915ef95", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "fea27915ef95", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-17613-10-5-65281-13-18-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789656763, "last_seen": 1789656763, "transport": "t", "ja3_hash": "294bb6ef7579181483885ca4554fb3da", "ja3_variant_count": 1, "ja3_variants": [ "294bb6ef7579181483885ca4554fb3da" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_38c9f1c754f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "38c9f1c754f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-23-45-17613-35-10-13-27-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790480527, "last_seen": 1790480527, "transport": "t", "ja3_hash": "1dd3e77a926dace0af01b728990b2bd8", "ja3_variant_count": 1, "ja3_variants": [ "1dd3e77a926dace0af01b728990b2bd8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_4f1cc7589a96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "4f1cc7589a96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-35-45-18-27-5-17613-23-11-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788796442, "last_seen": 1788796442, "transport": "t", "ja3_hash": "f0fed604ea3cb5b015ddfe1bdf5cc507", "ja3_variant_count": 1, "ja3_variants": [ "f0fed604ea3cb5b015ddfe1bdf5cc507" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_85094969e2d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "85094969e2d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-35-45-13-65281-23-18-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790186690, "last_seen": 1790186690, "transport": "t", "ja3_hash": "5418fa69518703cbff3d7adf7f3fc82d", "ja3_variant_count": 1, "ja3_variants": [ "5418fa69518703cbff3d7adf7f3fc82d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_d614e6c2ecc4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "d614e6c2ecc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-13-65281-45-35-10-5-23-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790734641, "last_seen": 1790734641, "transport": "t", "ja3_hash": "4911f52eadec9592247e60589caf0d3e", "ja3_variant_count": 1, "ja3_variants": [ "4911f52eadec9592247e60589caf0d3e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_e5539ac1f430", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "e5539ac1f430", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-23-13-5-10-17613-11-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791195821, "last_seen": 1791195821, "transport": "t", "ja3_hash": "cbb0309558bbf00f2f08fde4e42971b3", "ja3_variant_count": 1, "ja3_variants": [ "cbb0309558bbf00f2f08fde4e42971b3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 27 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_00dbfd64976b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "00dbfd64976b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-17613-23-18-16-35-65037-27-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790197014, "last_seen": 1791135413, "transport": "t", "ja3_hash": "021c92aa16aa7fd1cd24883f8ca6b70c", "ja3_variant_count": 2, "ja3_variants": [ "021c92aa16aa7fd1cd24883f8ca6b70c", "81e5e899d3214ffb27d857c017321f7c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_07765c3d4c4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "07765c3d4c4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-18-27-13-65037-16-35-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790282654, "last_seen": 1790282654, "transport": "t", "ja3_hash": "7318f5a5e3ab3363467d098f3de2f58b", "ja3_variant_count": 1, "ja3_variants": [ "7318f5a5e3ab3363467d098f3de2f58b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_14822febfd04", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "14822febfd04", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-35-65037-11-16-5-65281-18-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790532688, "last_seen": 1790532688, "transport": "t", "ja3_hash": "cffe56e6342c5e84bb05678dce1c1955", "ja3_variant_count": 1, "ja3_variants": [ "cffe56e6342c5e84bb05678dce1c1955" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_17f921873d2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "17f921873d2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-65281-45-35-27-65037-13-5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790239765, "last_seen": 1790239765, "transport": "t", "ja3_hash": "5cc830a9f48310f2e0c0ffdc5de4ede3", "ja3_variant_count": 1, "ja3_variants": [ "5cc830a9f48310f2e0c0ffdc5de4ede3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_1cc89febb40d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "1cc89febb40d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-35-23-10-17613-16-65281-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110118, "last_seen": 1791110118, "transport": "t", "ja3_hash": "4ac1220893ceb35e12cc710140ef315f", "ja3_variant_count": 1, "ja3_variants": [ "4ac1220893ceb35e12cc710140ef315f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_22948ec5b234", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "22948ec5b234", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-11-35-45-17613-23-16-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788758479, "last_seen": 1788758479, "transport": "t", "ja3_hash": "384a118875baba55b8640134285323db", "ja3_variant_count": 1, "ja3_variants": [ "384a118875baba55b8640134285323db" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_25748c910656", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "25748c910656", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-35-65281-11-18-10-27-17613-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789415690, "last_seen": 1789415690, "transport": "t", "ja3_hash": "45a762c21bb6ac01499286efed084fcc", "ja3_variant_count": 1, "ja3_variants": [ "45a762c21bb6ac01499286efed084fcc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 6 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_280a4cbe94ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "280a4cbe94ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-35-11-17613-65037-23-18-13-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790650375, "last_seen": 1790650375, "transport": "t", "ja3_hash": "dc9fa9720c873b41d3ecf2ed131f7b8a", "ja3_variant_count": 1, "ja3_variants": [ "dc9fa9720c873b41d3ecf2ed131f7b8a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_3e3822cf5adb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "3e3822cf5adb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-10-45-11-35-16-27-17613-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790730649, "last_seen": 1790730649, "transport": "t", "ja3_hash": "69ac44b586f96c7c974c4996e0ad0285", "ja3_variant_count": 1, "ja3_variants": [ "69ac44b586f96c7c974c4996e0ad0285" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_434cd0a315ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "434cd0a315ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-5-17613-45-27-18-65037-35-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790207623, "last_seen": 1790207623, "transport": "t", "ja3_hash": "aeade00047064a4a724259f7a835d359", "ja3_variant_count": 1, "ja3_variants": [ "aeade00047064a4a724259f7a835d359" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_4a9b62b4cef9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "4a9b62b4cef9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-16-45-18-27-65037-23-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790588567, "last_seen": 1790588567, "transport": "t", "ja3_hash": "3979f8bdca113fa0198eb928dbd8caed", "ja3_variant_count": 1, "ja3_variants": [ "3979f8bdca113fa0198eb928dbd8caed" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_528f19b359ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "528f19b359ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-17613-65037-45-27-16-18-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789679043, "last_seen": 1789679043, "transport": "t", "ja3_hash": "b8ed7d931a571f9de3a8cb60eba0ac72", "ja3_variant_count": 1, "ja3_variants": [ "b8ed7d931a571f9de3a8cb60eba0ac72" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_52a0a55d0b7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "52a0a55d0b7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-35-65037-27-17613-45-18-16-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790461715, "last_seen": 1791007060, "transport": "t", "ja3_hash": "df9d71e02a7be6a6b38ebf001e8e4889", "ja3_variant_count": 2, "ja3_variants": [ "df9d71e02a7be6a6b38ebf001e8e4889", "f1ced342cf33334838b80f1661567eee" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/136.0 Mobile/15E148 Safari/605.1.15": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 15 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_71b0840a9e18", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "71b0840a9e18", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-13-23-17513-16-11-51-18-65037-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791105722, "last_seen": 1791105722, "transport": "t", "ja3_hash": "473eab9bbad4e685811f9d0016543f38", "ja3_variant_count": 1, "ja3_variants": [ "473eab9bbad4e685811f9d0016543f38" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_78f2976dfef2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "78f2976dfef2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-23-10-35-5-16-65037-13-51-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790751095, "last_seen": 1790751095, "transport": "t", "ja3_hash": "03ede4290747a64eb63f6df45ce18e30", "ja3_variant_count": 1, "ja3_variants": [ "03ede4290747a64eb63f6df45ce18e30" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_7a80d5b9bebe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "7a80d5b9bebe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-65281-35-10-16-5-27-23-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791295429, "last_seen": 1791295429, "transport": "t", "ja3_hash": "50d86916f5cbf441d26696891f6a0913", "ja3_variant_count": 1, "ja3_variants": [ "50d86916f5cbf441d26696891f6a0913" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_7aa8ed5852c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "7aa8ed5852c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-35-18-13-16-23-65281-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791131412, "last_seen": 1791131412, "transport": "t", "ja3_hash": "870febcb14e8fca8b90a40ff08f354ff", "ja3_variant_count": 1, "ja3_variants": [ "870febcb14e8fca8b90a40ff08f354ff" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_8a65f0aa4289", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "8a65f0aa4289", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-23-51-65281-16-45-27-13-65037-5,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791287940, "last_seen": 1791287940, "transport": "t", "ja3_hash": "9bd97e518b7e207d038a7cae55b5bade", "ja3_variant_count": 1, "ja3_variants": [ "9bd97e518b7e207d038a7cae55b5bade" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_8aacfe6679f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "8aacfe6679f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-65281-18-27-16-5-10-17513-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 37, "first_seen": 1787560645, "last_seen": 1789671440, "transport": "t", "ja3_hash": "e5790367f39dcb56719567b5610a07b1", "ja3_variant_count": 1, "ja3_variants": [ "e5790367f39dcb56719567b5610a07b1" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3983.68 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.2908.6 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3067.24 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_8e81ddb882d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "8e81ddb882d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-11-13-16-35-5-23-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790532811, "last_seen": 1790532811, "transport": "t", "ja3_hash": "463a57f327e2474dcabaa2917e3f1f68", "ja3_variant_count": 1, "ja3_variants": [ "463a57f327e2474dcabaa2917e3f1f68" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_8ecb0990315c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "8ecb0990315c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-65037-10-35-17613-65281-16-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789866421, "last_seen": 1789866421, "transport": "t", "ja3_hash": "84d6ef0e8a74df73a5fbbd62369115c1", "ja3_variant_count": 1, "ja3_variants": [ "84d6ef0e8a74df73a5fbbd62369115c1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_92691750616b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "92691750616b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-23-17613-13-16-18-27-65037-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788926970, "last_seen": 1788926970, "transport": "t", "ja3_hash": "46b987a041925816f3e5a563b84f017f", "ja3_variant_count": 1, "ja3_variants": [ "46b987a041925816f3e5a563b84f017f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_94722a75ae7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "94722a75ae7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-45-65281-27-5-13-23-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241241, "last_seen": 1790241241, "transport": "t", "ja3_hash": "c6ef83b3ea450013e14413be2fca72b7", "ja3_variant_count": 1, "ja3_variants": [ "c6ef83b3ea450013e14413be2fca72b7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_9c098ff40cc6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "9c098ff40cc6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-11-65037-23-16-45-65281-17613-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789775626, "last_seen": 1789775626, "transport": "t", "ja3_hash": "80efd0a76d5096911684180321611dd4", "ja3_variant_count": 1, "ja3_variants": [ "80efd0a76d5096911684180321611dd4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_9fe00c6c4190", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "9fe00c6c4190", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-27-17613-65037-45-35-10-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790348647, "last_seen": 1790348647, "transport": "t", "ja3_hash": "3b76337db651a57db483ea2e32b8c9fe", "ja3_variant_count": 1, "ja3_variants": [ "3b76337db651a57db483ea2e32b8c9fe" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/136.0 Mobile/15E148 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_a3e629263230", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "a3e629263230", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-23-27-45-11-16-13-18-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790932289, "last_seen": 1790932289, "transport": "t", "ja3_hash": "74bddddd430e7462e46becf53bd5830d", "ja3_variant_count": 1, "ja3_variants": [ "74bddddd430e7462e46becf53bd5830d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_bf4c2e4446d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "bf4c2e4446d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-11-10-45-27-5-65037-23-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791107405, "last_seen": 1791107405, "transport": "t", "ja3_hash": "2b6504ef016f3d92e58f4297ab2d54f8", "ja3_variant_count": 1, "ja3_variants": [ "2b6504ef016f3d92e58f4297ab2d54f8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_c9c93c893a19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "c9c93c893a19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-65281-35-5-17513-18-10-45-16-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791258925, "last_seen": 1791258925, "transport": "t", "ja3_hash": "29176bbe1d9b713a810553281e84a7f9", "ja3_variant_count": 1, "ja3_variants": [ "29176bbe1d9b713a810553281e84a7f9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_ca676ff797de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "ca676ff797de", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-16-35-23-17613-10-11-65281-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789239264, "last_seen": 1789239264, "transport": "t", "ja3_hash": "a0a0fc3f1d29ffb54132320c61e795ae", "ja3_variant_count": 1, "ja3_variants": [ "a0a0fc3f1d29ffb54132320c61e795ae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_cb58d4aef711", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "cb58d4aef711", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-5-51764-13-45-65281-65037-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790856667, "last_seen": 1790856667, "transport": "t", "ja3_hash": "99714dbf8ede5c4fe9219c08e7a64274", "ja3_variant_count": 1, "ja3_variants": [ "99714dbf8ede5c4fe9219c08e7a64274" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_d4c347af123f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "d4c347af123f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-17613-11-65281-35-27-16-65037-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789692950, "last_seen": 1789692950, "transport": "t", "ja3_hash": "d187275ab4baa635a1c7742d6b4482b9", "ja3_variant_count": 1, "ja3_variants": [ "d187275ab4baa635a1c7742d6b4482b9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_ea4c16ac1474", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "ea4c16ac1474", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-65281-10-27-35-45-17613-65037-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789329980, "last_seen": 1789329980, "transport": "t", "ja3_hash": "457ffb6a9db0f7cbae8b445e4ca4c792", "ja3_variant_count": 1, "ja3_variants": [ "457ffb6a9db0f7cbae8b445e4ca4c792" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Vivaldi/7.1": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_eacc615dc39a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "eacc615dc39a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-10-16-13-35-23-65037-45-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790773512, "last_seen": 1790773512, "transport": "t", "ja3_hash": "cf36e71c9527e3b66980adbe3ff99a36", "ja3_variant_count": 1, "ja3_variants": [ "cf36e71c9527e3b66980adbe3ff99a36" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_eadbbc9d4577", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "eadbbc9d4577", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-65037-16-27-65281-35-13-45-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790231874, "last_seen": 1791013674, "transport": "t", "ja3_hash": "a8ee62990334fba8b6849b6fd3d82d50", "ja3_variant_count": 2, "ja3_variants": [ "a8ee62990334fba8b6849b6fd3d82d50", "061dbda8229192cc709051e35391fb1c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_f9f7e2b4a5b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "f9f7e2b4a5b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-27-16-13-5-18-10-65281-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789643458, "last_seen": 1789643458, "transport": "t", "ja3_hash": "a83507566b3231bc064c1a0606fe6db6", "ja3_variant_count": 1, "ja3_variants": [ "a83507566b3231bc064c1a0606fe6db6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_01dbc3a6ae3f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "01dbc3a6ae3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-35-45-17613-11-27-65281-65037-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789764186, "last_seen": 1789764186, "transport": "t", "ja3_hash": "680c05b15cf951d7e15d8fad8c1b259e", "ja3_variant_count": 1, "ja3_variants": [ "680c05b15cf951d7e15d8fad8c1b259e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_62e17c7f19a2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "62e17c7f19a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-13-11-10-65037-65281-27-35-5-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788764651, "last_seen": 1788764651, "transport": "t", "ja3_hash": "eb53235214416ba9c380f047b5c31780", "ja3_variant_count": 1, "ja3_variants": [ "eb53235214416ba9c380f047b5c31780" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_854841cf92fd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "854841cf92fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-17613-35-45-65037-27-18-23-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789682798, "last_seen": 1789682798, "transport": "t", "ja3_hash": "3e83d6d292c871cc3ba1cfaa673744f6", "ja3_variant_count": 1, "ja3_variants": [ "3e83d6d292c871cc3ba1cfaa673744f6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_b22d65064baf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "b22d65064baf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-13-23-11-5-35-18-45-65037-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790850543, "last_seen": 1790850543, "transport": "t", "ja3_hash": "6c3058c64c6782c843a3e1c4ab1f2d15", "ja3_variant_count": 1, "ja3_variants": [ "6c3058c64c6782c843a3e1c4ab1f2d15" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_d60dc1ef4431", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "d60dc1ef4431", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-10-18-11-27-65281-5-45-13-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789396318, "last_seen": 1789396318, "transport": "t", "ja3_hash": "f6b06df0cf4b86b628935a84429f9043", "ja3_variant_count": 1, "ja3_variants": [ "f6b06df0cf4b86b628935a84429f9043" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h1_8daaf6152771_7aa8ca5380d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h1", "b": "8daaf6152771", "c": "7aa8ca5380d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-45-65281-16-11-35-5-10-27-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791290279, "last_seen": 1791290279, "transport": "t", "ja3_hash": "9a467aa99f91bdea5f6c24d377a386a9", "ja3_variant_count": 1, "ja3_variants": [ "9a467aa99f91bdea5f6c24d377a386a9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_03bf43fdfbfd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "03bf43fdfbfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-35-23-27-13-65281-16-10-18-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788804866, "last_seen": 1788804866, "transport": "t", "ja3_hash": "c77262116bb6409b9a7b9df11d1defca", "ja3_variant_count": 1, "ja3_variants": [ "c77262116bb6409b9a7b9df11d1defca" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_0b0d726bf44d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "0b0d726bf44d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-65037-16-45-65281-11-5-18-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811254, "last_seen": 1788811254, "transport": "t", "ja3_hash": "2a799cd73b460c5fc53a165db0942faa", "ja3_variant_count": 1, "ja3_variants": [ "2a799cd73b460c5fc53a165db0942faa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_12cc5bb417dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "12cc5bb417dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-27-65281-17613-16-10-11-65037-35-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790941893, "last_seen": 1790941893, "transport": "t", "ja3_hash": "a32b266226e977e186cbdd0998397afc", "ja3_variant_count": 1, "ja3_variants": [ "a32b266226e977e186cbdd0998397afc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_152b75caf2db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "152b75caf2db", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-65281-11-13-35-65037-16-27-18-10-51-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791103444, "last_seen": 1791103444, "transport": "t", "ja3_hash": "3be8deb05d492d02780acb9a4d0cbac1", "ja3_variant_count": 1, "ja3_variants": [ "3be8deb05d492d02780acb9a4d0cbac1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_1d21b18b1ac6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "1d21b18b1ac6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-11-65037-23-17613-65281-27-13-16-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790773455, "last_seen": 1790773455, "transport": "t", "ja3_hash": "46fefc772d09d5d2a9dd9ee909cbc399", "ja3_variant_count": 1, "ja3_variants": [ "46fefc772d09d5d2a9dd9ee909cbc399" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_1e73e3036455", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "1e73e3036455", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-23-27-35-16-5-65037-18-13-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788449153, "last_seen": 1790123996, "transport": "t", "ja3_hash": "fb3f1f97e3663a400adf557e922543af", "ja3_variant_count": 2, "ja3_variants": [ "fb3f1f97e3663a400adf557e922543af", "0b2e67b20d1ecc3381251c3b55cb5ffa" ], "user_agents": { "Mozilla/5.0 (iPad; CPU OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_257a0692ca3b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "257a0692ca3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-65281-17513-5-11-13-45-51-65037-35-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790956909, "last_seen": 1790956909, "transport": "t", "ja3_hash": "3add1fcb9b1cb407c04200bb29548b3b", "ja3_variant_count": 1, "ja3_variants": [ "3add1fcb9b1cb407c04200bb29548b3b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_329aaf266ceb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "329aaf266ceb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-16-11-27-23-10-5-13-65281-18-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791291319, "last_seen": 1791291319, "transport": "t", "ja3_hash": "27615644bc9a038b836d4946716472cc", "ja3_variant_count": 1, "ja3_variants": [ "27615644bc9a038b836d4946716472cc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_4f9d68095669", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "4f9d68095669", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-16-45-11-65037-10-13-18-23-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790160097, "last_seen": 1790160097, "transport": "t", "ja3_hash": "03a673d74894919c72ec99105da80d11", "ja3_variant_count": 1, "ja3_variants": [ "03a673d74894919c72ec99105da80d11" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_7bb4b4485d4c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "7bb4b4485d4c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-11-17613-18-65037-10-27-35-45-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790778192, "last_seen": 1790778192, "transport": "t", "ja3_hash": "d21a7ccfbda980d884f3fb3443358dd7", "ja3_variant_count": 1, "ja3_variants": [ "d21a7ccfbda980d884f3fb3443358dd7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_a53a5d4d7278", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "a53a5d4d7278", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-65281-27-35-16-23-5-10-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790650448, "last_seen": 1790650448, "transport": "t", "ja3_hash": "8597920212e5a2fedc3b0468e6d733cf", "ja3_variant_count": 1, "ja3_variants": [ "8597920212e5a2fedc3b0468e6d733cf" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_d6da472fb599", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "d6da472fb599", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-65037-11-23-13-27-45-5-65281-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788798114, "last_seen": 1788798114, "transport": "t", "ja3_hash": "899ffa730811da5a0300b684b3b81eb2", "ja3_variant_count": 1, "ja3_variants": [ "899ffa730811da5a0300b684b3b81eb2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_e85c5f4ed474", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "e85c5f4ed474", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-11-51764-16-35-5-45-18-10-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508421, "last_seen": 1788508421, "transport": "t", "ja3_hash": "d394fcd983493ff21c7957c51d3e4381", "ja3_variant_count": 1, "ja3_variants": [ "d394fcd983493ff21c7957c51d3e4381" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_f75c99de40bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "f75c99de40bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-5-10-27-11-13-65037-23-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790195334, "last_seen": 1790195334, "transport": "t", "ja3_hash": "687cb0b1cdb2b3a65ffb39a592a89ad3", "ja3_variant_count": 1, "ja3_variants": [ "687cb0b1cdb2b3a65ffb39a592a89ad3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_fa2ec2b85fde", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "fa2ec2b85fde", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-17613-10-51764-5-35-16-27-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789680306, "last_seen": 1789680306, "transport": "t", "ja3_hash": "8328ba7a0c18658dc9c579a190fa2d46", "ja3_variant_count": 1, "ja3_variants": [ "8328ba7a0c18658dc9c579a190fa2d46" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_4a82b4670956", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "4a82b4670956", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-27-5-17513-35-51-11-18-13-16-65281-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791142185, "last_seen": 1791142185, "transport": "t", "ja3_hash": "3db0b553a49c34dcc98c5700c81cc6af", "ja3_variant_count": 1, "ja3_variants": [ "3db0b553a49c34dcc98c5700c81cc6af" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_5c09f425e4de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "5c09f425e4de", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-11-65037-23-10-18-16-13-45-5-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790181733, "last_seen": 1790181733, "transport": "t", "ja3_hash": "1657e8df7984b0bc02d9195acb848636", "ja3_variant_count": 1, "ja3_variants": [ "1657e8df7984b0bc02d9195acb848636" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 22 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_6ae379a09af0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "6ae379a09af0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-13-51764-45-10-17613-65037-27-35-18-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789572024, "last_seen": 1789572024, "transport": "t", "ja3_hash": "9a9df534b93536f631f8e46c5f888550", "ja3_variant_count": 1, "ja3_variants": [ "9a9df534b93536f631f8e46c5f888550" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_7255178fa4db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "7255178fa4db", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-5-10-16-65037-13-17613-23-45-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789020781, "last_seen": 1789020781, "transport": "t", "ja3_hash": "1f11604820803f0077cf2fc87c1309ad", "ja3_variant_count": 1, "ja3_variants": [ "1f11604820803f0077cf2fc87c1309ad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_7f1d323876a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "7f1d323876a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-51764-23-65037-16-11-35-27-18-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469868, "last_seen": 1789469868, "transport": "t", "ja3_hash": "4cf9b4604b37ed0d1b32d93668a7dedb", "ja3_variant_count": 1, "ja3_variants": [ "4cf9b4604b37ed0d1b32d93668a7dedb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_830913a64697", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "830913a64697", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-11-65281-35-65037-17513-13-27-18-45-51-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106704, "last_seen": 1791106704, "transport": "t", "ja3_hash": "8f06f5a10d9ba464ecfcb81a3ae0ffb1", "ja3_variant_count": 1, "ja3_variants": [ "8f06f5a10d9ba464ecfcb81a3ae0ffb1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_84957e518704", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "84957e518704", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-35-16-13-23-11-10-65281-51764-27-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789480492, "last_seen": 1789480492, "transport": "t", "ja3_hash": "d25f2d65e807a87413d781e7d0459061", "ja3_variant_count": 1, "ja3_variants": [ "d25f2d65e807a87413d781e7d0459061" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_946f3ad3b78f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "946f3ad3b78f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-13-5-11-35-18-23-45-27-16-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790224247, "last_seen": 1790224247, "transport": "t", "ja3_hash": "bd961393df4ac906b0c742077e66be6a", "ja3_variant_count": 1, "ja3_variants": [ "bd961393df4ac906b0c742077e66be6a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_9cc7e60b6689", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "9cc7e60b6689", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-65281-23-45-13-11-17613-10-5-65037-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789963688, "last_seen": 1789963688, "transport": "t", "ja3_hash": "06a6ad2f1442f48984802eecf42cfbd0", "ja3_variant_count": 1, "ja3_variants": [ "06a6ad2f1442f48984802eecf42cfbd0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_a12bacf70f2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "a12bacf70f2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-35-17613-65037-16-18-11-10-13-23-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791043076, "last_seen": 1791043076, "transport": "t", "ja3_hash": "a37763867f263fcac51e3d3493a75def", "ja3_variant_count": 1, "ja3_variants": [ "a37763867f263fcac51e3d3493a75def" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_b0ed875c12cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "b0ed875c12cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-5-17613-16-65281-10-65037-11-18-27-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790563070, "last_seen": 1790563070, "transport": "t", "ja3_hash": "2611d263d194996686d9da7885a9dc24", "ja3_variant_count": 1, "ja3_variants": [ "2611d263d194996686d9da7885a9dc24" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_b2f16b13a424", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "b2f16b13a424", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-10-65037-17613-65281-16-27-45-5-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791047704, "last_seen": 1791047704, "transport": "t", "ja3_hash": "f2c1ff04781fb822f68fc7cf2dc02c01", "ja3_variant_count": 1, "ja3_variants": [ "f2c1ff04781fb822f68fc7cf2dc02c01" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_d0d612240daa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "d0d612240daa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-65037-10-17613-27-11-5-23-16-45-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790327068, "last_seen": 1790736680, "transport": "t", "ja3_hash": "5ab70266e382a7c16327f037215c8bea", "ja3_variant_count": 2, "ja3_variants": [ "5ab70266e382a7c16327f037215c8bea", "6598d809ced1a02a2bbed1882e551e5b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1514h2_8daaf6152771_59f8b518a72b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1514h2", "b": "8daaf6152771", "c": "59f8b518a72b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51764-35-10-65281-16-11-23-13-45-18-17613-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790699371, "last_seen": 1790699371, "transport": "t", "ja3_hash": "ef40fe499b8325c62af6debc688a1c1f", "ja3_variant_count": 1, "ja3_variants": [ "ef40fe499b8325c62af6debc688a1c1f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12i1514h2_8daaf6152771_b4e5cfae9526", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1514h2", "b": "8daaf6152771", "c": "b4e5cfae9526", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-65281-10-11-5-16-65037-18-35-23-13-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789396382, "last_seen": 1790241025, "transport": "t", "ja3_hash": "2f2de4160f8b1eac9429c2e770bf2cbd", "ja3_variant_count": 3, "ja3_variants": [ "2f2de4160f8b1eac9429c2e770bf2cbd", "05b85d115ee811f842c7a26bdc6472d1", "a4d8b9f4897a00abe1a777453a2e090b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1515h2_8daaf6152771_772913465964", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1515h2", "b": "8daaf6152771", "c": "772913465964", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-35-18-10-65281-65037-16-23-45-17513-11-5-27-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790941820, "last_seen": 1790941820, "transport": "t", "ja3_hash": "8c8f38c25519d88f4aa4092ce86bea68", "ja3_variant_count": 1, "ja3_variants": [ "8c8f38c25519d88f4aa4092ce86bea68" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1610h2_86a278354501_8b8df723f15f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1610h2", "b": "86a278354501", "c": "8b8df723f15f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 16, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790771497, "last_seen": 1790771504, "transport": "t", "ja3_hash": "97171d1e6144cfd51c04ce1fb90ce47f", "ja3_variant_count": 1, "ja3_variants": [ "97171d1e6144cfd51c04ce1fb90ce47f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:150.0) Gecko/20100101 Firefox/150.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d000800_e3b0c44298fc_1095558c8845", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (1095558c8845) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d000800", "b": "e3b0c44298fc", "c": "1095558c8845", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 0, "extension_count": 8, "alpn": null } }, "ja3_string": "771,,10-0-13-43-51-45-35-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790316742, "last_seen": 1790316742, "transport": "t", "ja3_hash": "dd78a91b503f7a3b61bc1720c075cd9a", "ja3_variant_count": 1, "ja3_variants": [ "dd78a91b503f7a3b61bc1720c075cd9a" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d021000_3be9a9a201ba_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d021000", "b": "3be9a9a201ba", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4869-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825497, "last_seen": 1790703172, "transport": "t", "ja3_hash": "fceaef9317f33a5f61059dadabf8a93c", "ja3_variant_count": 1, "ja3_variants": [ "fceaef9317f33a5f61059dadabf8a93c" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d021000_9d5106e3f751_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d021000", "b": "9d5106e3f751", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825497, "last_seen": 1790703172, "transport": "t", "ja3_hash": "fb730716bc8e27a5d2ed322f75409ad9", "ja3_variant_count": 1, "ja3_variants": [ "fb730716bc8e27a5d2ed322f75409ad9" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d021000_bb76221c5b8c_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d021000", "b": "bb76221c5b8c", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4867-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825502, "last_seen": 1790703172, "transport": "t", "ja3_hash": "5ad23b5ebbfea380ba05fb724913dc54", "ja3_variant_count": 1, "ja3_variants": [ "5ad23b5ebbfea380ba05fb724913dc54" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d021000_d6df1d7c4cd5_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d021000", "b": "d6df1d7c4cd5", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4868-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825499, "last_seen": 1790703172, "transport": "t", "ja3_hash": "833ca94da0fc163d72020670d6d3163f", "ja3_variant_count": 1, "ja3_variants": [ "833ca94da0fc163d72020670d6d3163f" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d021000_ec078ce24869_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d021000", "b": "ec078ce24869", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703171, "transport": "t", "ja3_hash": "f1702a92147fe150aaafdcf6a9da1bb0", "ja3_variant_count": 1, "ja3_variants": [ "f1702a92147fe150aaafdcf6a9da1bb0" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d0313h2_55b375c5d22e_7f2aabb58f9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d0313h2", "b": "55b375c5d22e", "c": "7f2aabb58f9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866,0-23-65281-10-16-5-34-18-51-43-13-28-65037,29-23-24-25-256-257,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1790842592, "last_seen": 1790842595, "transport": "t", "ja3_hash": "9bf6b1f1646edcd17d80c831d176f357", "ja3_variant_count": 1, "ja3_variants": [ "9bf6b1f1646edcd17d80c831d176f357" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d041000_16476d049b0b_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d041000", "b": "16476d049b0b", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 203, "first_seen": 1787509858, "last_seen": 1791319587, "transport": "t", "ja3_hash": "a66e498c488aa0523759691248cdfb01", "ja3_variant_count": 2, "ja3_variants": [ "a66e498c488aa0523759691248cdfb01", "f146948b4a599d4d7ddf071b74696983" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0": 56 }, "ua_disagreement": false } }, { "hash": "t13d050500_13f69f63e3fe_1a196bf7ea71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (1a196bf7ea71) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d050500", "b": "13f69f63e3fe", "c": "1a196bf7ea71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 5, "alpn": null } }, "ja3_string": "771,198-199-4865-4868-4869,10-0-13-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789653764, "last_seen": 1790336041, "transport": "t", "ja3_hash": "fb6f2539f233d8b31618fd0beb7a4805", "ja3_variant_count": 1, "ja3_variants": [ "fb6f2539f233d8b31618fd0beb7a4805" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d061000_a150a9413979_17bacd9b6122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (17bacd9b6122) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d061000", "b": "a150a9413979", "c": "17bacd9b6122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4869-4868-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 67, "first_seen": 1787509864, "last_seen": 1791319588, "transport": "t", "ja3_hash": "eba4b4f1563f0c39edcb7f1c8c6b0ba5", "ja3_variant_count": 2, "ja3_variants": [ "eba4b4f1563f0c39edcb7f1c8c6b0ba5", "c24c5a4e0080be2e46230b8da7ed452a" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d061100_db2546af4a66_0fe28f4911d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (0fe28f4911d5) with 3 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d061100", "b": "db2546af4a66", "c": "0fe28f4911d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-156-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789354397, "last_seen": 1789618246, "transport": "t", "ja3_hash": "cbe5177af3a7aa151143afcac2238fe2", "ja3_variant_count": 1, "ja3_variants": [ "cbe5177af3a7aa151143afcac2238fe2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 3 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d070500_c2f3549b8eb7_1a196bf7ea71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d070500", "b": "c2f3549b8eb7", "c": "1a196bf7ea71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 334, "first_seen": 1789653170, "last_seen": 1790678671, "transport": "t", "ja3_hash": "befaec56d37047ec064813d7aa625d19", "ja3_variant_count": 3, "ja3_variants": [ "befaec56d37047ec064813d7aa625d19", "d182279e6f41087335aa75c9d114d6b7", "50e04f3c4722ebf608e403c99944152a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/59.0.3071.109 Chrome/59.0.3071.109 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d070600_c2f3549b8eb7_aa419bfe26ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d070600", "b": "c2f3549b8eb7", "c": "aa419bfe26ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 157, "first_seen": 1789653172, "last_seen": 1790678692, "transport": "t", "ja3_hash": "389a54c6aed5cb0c42e5e59e0b5d4aa5", "ja3_variant_count": 1, "ja3_variants": [ "389a54c6aed5cb0c42e5e59e0b5d4aa5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/59.0.3071.109 Chrome/59.0.3071.109 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d070700_c2f3549b8eb7_0cc533ff8bdf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d070700", "b": "c2f3549b8eb7", "c": "0cc533ff8bdf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-45-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 17, "first_seen": 1790233472, "last_seen": 1790316739, "transport": "t", "ja3_hash": "678ced1fd44e0bd3ff16f10cbdf728f2", "ja3_variant_count": 1, "ja3_variants": [ "678ced1fd44e0bd3ff16f10cbdf728f2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/59.0.3071.109 Chrome/59.0.3071.109 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d070800_c2f3549b8eb7_1095558c8845", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d070800", "b": "c2f3549b8eb7", "c": "1095558c8845", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-45-35-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 32, "first_seen": 1790234012, "last_seen": 1790316747, "transport": "t", "ja3_hash": "39e4cc744e5c8dfdb549bd7f522344a2", "ja3_variant_count": 1, "ja3_variants": [ "39e4cc744e5c8dfdb549bd7f522344a2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/59.0.3071.109 Chrome/59.0.3071.109 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t13d081100_48922242edce_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d081100", "b": "48922242edce", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 8, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1790920905, "last_seen": 1790967565, "transport": "t", "ja3_hash": "661608ff6990d665c9660ff8db6490d5", "ja3_variant_count": 1, "ja3_variants": [ "661608ff6990d665c9660ff8db6490d5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.91 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d081300_b8c177e1861e_6c16df1bb63e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d081300", "b": "b8c177e1861e", "c": "6c16df1bb63e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 8, "extension_count": 13, "alpn": null } }, "ja3_string": "771,49196-49195-49199-49200-49171-49172-4865-4866,0-5-10-11-17-23-35-13-43-45-50-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 45, "first_seen": 1787530133, "last_seen": 1791250690, "transport": "t", "ja3_hash": "c5c01378382959240d01ba60e0359ee3", "ja3_variant_count": 1, "ja3_variants": [ "c5c01378382959240d01ba60e0359ee3" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 45 }, "ua_disagreement": false } }, { "hash": "t13d081400_b8c177e1861e_dea00c3fd0b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d081400", "b": "b8c177e1861e", "c": "dea00c3fd0b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 8, "extension_count": 14, "alpn": null } }, "ja3_string": "771,49196-49195-49199-49200-49171-49172-4865-4866,0-5-10-11-17-23-35-13-43-45-50-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789375025, "last_seen": 1790582197, "transport": "t", "ja3_hash": "9e4312b81305a00e03fb22efc2b07a01", "ja3_variant_count": 1, "ja3_variants": [ "9e4312b81305a00e03fb22efc2b07a01" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d091100_f91f431d341e_6ecbdee5c734", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6ecbdee5c734) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d091100", "b": "f91f431d341e", "c": "6ecbdee5c734", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392,65281-0-11-10-35-22-23-13-43-45-51,4588-29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1791319585, "last_seen": 1791319586, "transport": "t", "ja3_hash": "92d53e5b9402ec3a4fdcdfc6b33a90d0", "ja3_variant_count": 3, "ja3_variants": [ "92d53e5b9402ec3a4fdcdfc6b33a90d0", "9e174d5d770d27c79712285d15c53933", "19e43a91e2ef3bbafcd4d7c928cd75cf" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d0914h2_f91f431d341e_8c454e6c488f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (8c454e6c488f) with 4 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d0914h2", "b": "f91f431d341e", "c": "8c454e6c488f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200,0-23-65281-10-11-16-5-34-18-51-43-13-28-65037,4588-29-23-24-25-256-257-514,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1791340259, "last_seen": 1791340312, "transport": "t", "ja3_hash": "ae62c20beef151ae7fcc96d9dd1a0e4e", "ja3_variant_count": 1, "ja3_variants": [ "ae62c20beef151ae7fcc96d9dd1a0e4e" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d0915h2_f91f431d341e_5ad411fbfabb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d0915h2", "b": "f91f431d341e", "c": "5ad411fbfabb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200,0-23-65281-10-11-16-5-34-18-51-43-13-28-27-65037,4588-29-23-24-25-256-257-514,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1791302803, "last_seen": 1791340311, "transport": "t", "ja3_hash": "a3075f9ad3375269b5225ee817b05970", "ja3_variant_count": 2, "ja3_variants": [ "a3075f9ad3375269b5225ee817b05970", "e270c8df11d52cd7ab2266d77709ab79" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 13 }, "ua_disagreement": false } }, { "hash": "t13d100500_61a7ad8aa9b6_2a1b1496f368", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d100500", "b": "61a7ad8aa9b6", "c": "2a1b1496f368", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-51-43-0-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790053680, "last_seen": 1790053680, "transport": "t", "ja3_hash": "43a90e28d0a280bcb5ff4db806389ddc", "ja3_variant_count": 1, "ja3_variants": [ "43a90e28d0a280bcb5ff4db806389ddc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1009h2_61a7ad8aa9b6_9b4e46b4ee50", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1009h2", "b": "61a7ad8aa9b6", "c": "9b4e46b4ee50", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-11-51-43-35-16-0-23-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791309506, "last_seen": 1791309506, "transport": "t", "ja3_hash": "ce01f36febcd41823fbba3127d9b6cce", "ja3_variant_count": 1, "ja3_variants": [ "ce01f36febcd41823fbba3127d9b6cce" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 (compatible; AionBot/1.0)": 1 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_9d6e289b7745", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "9d6e289b7745", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-11-10-13-23-5-0-51-45-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788885087, "last_seen": 1790234203, "transport": "t", "ja3_hash": "2924f5c0d0e1ed1d1bd2c3bdca289632", "ja3_variant_count": 1, "ja3_variants": [ "2924f5c0d0e1ed1d1bd2c3bdca289632" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 50 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_a226d6048b0f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "a226d6048b0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-5-11-23-13-51-10-35-0-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 26, "first_seen": 1790021463, "last_seen": 1790314275, "transport": "t", "ja3_hash": "026bf4d8b4f30d2ea8c6a4beae09cd9e", "ja3_variant_count": 26, "ja3_variants": [ "026bf4d8b4f30d2ea8c6a4beae09cd9e", "0da97d9acc01dc13299843e121d9acd6", "d72bbafb601ab8fc49ad7f13a718debc", "65ea6b50460ca752ab78108077ba3748", "e492e5d795fd9dc2c8567ec1ea8c6dca", "60c782ff41ea0a392c3a38d9f187000e", "439cfe5f70e8617c354e4edf7faf2403", "8de0dc4e8344793c9ce41576dbe77ace", "bc74e393e5d20efb696530d3da2fbb74", "b39adc1f9ee51275426847891d74ac9d", "d414867bbd79b2e349c22ff78cfd1b5d", "99f8c9d671a2fa88b84a72a409df1dcf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36": 26 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_d5d75a0face9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "d5d75a0face9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-5-10-43-11-13-51-0-23-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 268, "first_seen": 1788063545, "last_seen": 1791361214, "transport": "t", "ja3_hash": "b72ad960cb9d86059438605a5470cc61", "ja3_variant_count": 259, "ja3_variants": [ "b72ad960cb9d86059438605a5470cc61", "282e38ded4da6519eeb610385b2cab68", "cefaed4aaa440eaf4a2dddda8d3c45f6", "66c957006bf9c902f77b648855655b4b", "47f7db1b3b54adabfcdb82ff5e0b2fd5", "444af20dba6f899c2d69f25247494115", "ffc99e1d76a7d7126c40788438d3f6f1", "7b42b1f632bdc93804aec49b2dc2760d", "209d2e1745514660cf1b93f9ebbd566f", "3b0d8443fe0e4fda53a0f2319e77e5ea", "33b46c489b0c10a752f0844985f838aa", "f98ccdae6af6b8f94c66179c9d529c98" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 259, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 8 }, "ua_disagreement": true } }, { "hash": "t13d1010h2_561a47a994ce_b0ef02ef599f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1010h2", "b": "561a47a994ce", "c": "b0ef02ef599f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-49199-157-156-255,0-11-10-16-23-13-43-45-51-21,23-24-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 10, "first_seen": 1789368264, "last_seen": 1789912413, "transport": "t", "ja3_hash": "24f5420bdd20ac42df248ae08941bb07", "ja3_variant_count": 1, "ja3_variants": [ "24f5420bdd20ac42df248ae08941bb07" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 81 }, "ua_disagreement": false } }, { "hash": "t13d101100_01be160bb49b_2b2467513d7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101100", "b": "01be160bb49b", "c": "2b2467513d7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49200-49199-49192-49191-49196-49195-49188-49187,0-43-13-35-10-11-51-49-23-65281-45,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1788499615, "last_seen": 1791361051, "transport": "t", "ja3_hash": "cb128e3474b8e0f4d9f38cba74583436", "ja3_variant_count": 2, "ja3_variants": [ "cb128e3474b8e0f4d9f38cba74583436", "d03ce4f7179484d31e88946bd2f9e639" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5 skype-url-preview@microsoft.com": 49, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.36 Edg/79.0.309.43": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Edg/149.0.0.0": 1, "Mozilla/5.0 (Linux; Android 15; 24117RK2CC Build/AQ3A.240829.003) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.7390.124 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1011h1_61a7ad8aa9b6_07a85421bdea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h1", "b": "61a7ad8aa9b6", "c": "07a85421bdea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-23-5-35-10-51-0-16-45-13-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1790479797, "last_seen": 1791135816, "transport": "t", "ja3_hash": "75e54ca1e3c4407588c3d6c0d93443ff", "ja3_variant_count": 53, "ja3_variants": [ "75e54ca1e3c4407588c3d6c0d93443ff", "9fee6c14776625350c9b777d5c3df17e", "92b036d25e5325beca0068fa101bd569", "9a4d09c0f48fb2261f7ea7aed87dc5db", "f6863230d05613135591017facf98265", "21a77526699f267eba0f88b80fd8681f", "dd64448145e8de39969e413c743ded19", "11cba999eee46e7cd9e43c3d4a91ac7d", "822dedaa9f7de65084d050208483a227", "d86c7caf8ef12be012fe9360769d0380", "f30decffc6198eac7344df3db63a82c0", "ea4813e3c97918bb5d84b6f3be11e41f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186]": 48, "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (compatible; GitFinder/1.0)": 6, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.co": 1 }, "ua_disagreement": false } }, { "hash": "t13d1011h1_61a7ad8aa9b6_723f4692b966", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (723f4692b966) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1011h1", "b": "61a7ad8aa9b6", "c": "723f4692b966", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-45-0-10-5-13-51-23-16-43-41,29-23-24-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 289, "first_seen": 1790607168, "last_seen": 1791362699, "transport": "t", "ja3_hash": "3d7882ac0e67067cfb5a713e55e4c62c", "ja3_variant_count": 289, "ja3_variants": [ "3d7882ac0e67067cfb5a713e55e4c62c", "14ccaa890f727b0e688ff62c6c9b5981", "a76108e4de1b683d068869deda1caaeb", "14b3115ff71aa5861de7e751d37aca57", "921f4450a44395d0d7288fe1dee64f8a", "9249cbf288bf63dbb2b132cf6a9db994", "3938a79f8e21bc6b69695989d1167866", "a4f64e75b5e73120dd99fad499c73753", "e82e826233afcd2facfabecbddf60135", "9f6c8b8fb30e9700661389c89b195ca6", "9bd45476cfbe668123ec7bdbd624cdf6", "bf5d92acc6ebfbdee8a22007a60edf36" ], "user_agents": { "Software Security Research/1.0 (+https://finn.softsec.ruhr-uni-bochum.de)": 27, "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)": 261 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1011h1_61a7ad8aa9b6_861bc38b0be4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h1", "b": "61a7ad8aa9b6", "c": "861bc38b0be4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-23-13-35-0-11-45-16-10-51-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 32, "first_seen": 1790499368, "last_seen": 1791204968, "transport": "t", "ja3_hash": "105c5b2ec91861774b2d2737ee6596a3", "ja3_variant_count": 31, "ja3_variants": [ "105c5b2ec91861774b2d2737ee6596a3", "0a424b28bf73fffdac999c7c758dc204", "f90326f9f92df9e68da09a3e2d6a434f", "da76d2f0bc263de752029dc251f570fd", "872789dc8e08be1bd074dd869667282d", "b9818bd353a20f83981bd8cb43a685d8", "0b04ccc02054739e6b370c132a3b63f6", "452b3aeb62a22dca98dfd70c3355aee1", "b96b9326e074533c040dd61c63ab1b6a", "aad1328e6ac0f9bf0f3ec3dbfae7fcca", "cd5873c88f89055f4ca467ef3fbadf30", "5f1d1b5f3eae73376f2274061025983a" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; SEOJuice-SearchBot/1.0; +https://seojuice.io/bot": 59, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 7, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 1, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 5 }, "ua_disagreement": true } }, { "hash": "t13d1011h1_61a7ad8aa9b6_ae9f20769a5d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (ae9f20769a5d) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1011h1", "b": "61a7ad8aa9b6", "c": "ae9f20769a5d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-43-23-51-35-13-16-0-11-5-45,29-23-24-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 115, "first_seen": 1790606454, "last_seen": 1791362945, "transport": "t", "ja3_hash": "e55fc7fbb17a1192021f6e4524a77d93", "ja3_variant_count": 114, "ja3_variants": [ "e55fc7fbb17a1192021f6e4524a77d93", "da3adcf39603744be9ae6e9d21dd7a5b", "f496c69404b4a7361c33ac7dfe28770b", "93f3a56129f2fe7233df4bbd8509e92f", "60a03ba45afa3bb023606c6f9492fec9", "9e60bdd7f84d6f916f5eb57f6b4f2cf5", "527094a07506fd33ff37fba832c9b9a9", "44684f2f2eef9b2dc44354b1d7007480", "7da3e0fc3fc3bb870c43607617af7902", "70160c80e1b67f779f566a9d9c990dca", "b78bf0ae52665b607a135c32bff11a79", "901f9087805390034ad6ae0f9433e4b7" ], "user_agents": { "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)": 103, "Software Security Research/1.0 (+https://finn.softsec.ruhr-uni-bochum.de)": 7, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 1 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1011h2_61a7ad8aa9b6_07a85421bdea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "07a85421bdea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-35-10-11-13-0-45-43-51-5-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 51, "first_seen": 1788140502, "last_seen": 1791331253, "transport": "t", "ja3_hash": "767a42ee55b15c37e76d6d7bba3d730e", "ja3_variant_count": 46, "ja3_variants": [ "767a42ee55b15c37e76d6d7bba3d730e", "546f24426616aeaf811dfba0fc1e80c4", "4298c792a626438d46ab01ac5c6b8844", "1146ab1e2c0fb0dc93cd5fc77344d3aa", "911a3ea6e79a6fde807aee6ce59c3c34", "0a8f210827388ce09e7deca80bbdb0dc", "ada938e949df3780efd581145752a9a6", "b5a04a0b2d683bb3fa989c5d23477505", "d4fe983d051ce91ab469b25e664e2273", "7d2fd4f6631c1a5067044a4cbc3a4743", "4f85f0613f4485f0b8f1130bf0ab9e6c", "47e4f29b4c01fc8207043647aa47100f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 13; Infinix X688B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.48 Mobile Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6534.42 Safari/537.36": 9, "Mozilla/5.0 (iPhone; CPU iPhone OS 16_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.7 Mobile/15E148 Safari/604.1": 7, "Mozilla/5.0 (Linux; Android 14; RMX3842) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.44 Mobile Safari/537.36": 12, "Mozilla/5.0 (Linux; Android 13; Pixel 7a) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.82 Mobile Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15": 4, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6540.18 Safari/537.36": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.76 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edg/128.0.2790.25 Chrome/128.0.6540.22 Safari/537.36": 7, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1": 5, "Mozilla/5.0 (Linux; Android 10; vivo 1904) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.60 Mobile Safari/537.36": 4, "Mozilla/5.0 (Linux; U; Android 10; en-US; CPH2015) AppleWebKit/537.36 (KHTML, like Gecko) UCBrowser/13.5.8.1311 Mobile Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 12; Redmi Note 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.112 Mobile Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 19, "Mozilla/5.0 (Linux; Android 14; SM-A146P) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/25.0 Chrome/123.0.6312.120 Mobile Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.112 Safari/537.36 Brave/1.63.120": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.70 Safari/537.36 Vivaldi/6.7.3200.25": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0": 6, "Mozilla/5.0 (Linux; Android 11; RMX2195) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.210 Mobile Safari/537.36 OPR/75.2.3995.72468": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.141 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 14; Samsung SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.14 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 14; OnePlus 12) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.102 Mobile Safari/537.36": 8, "Mozilla/5.0 (Linux; Android 14; Xiaomi 14 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.33 Mobile Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.90 Safari/537.36": 3, "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0": 3, "Mozilla/5.0 (Linux; Android 11; moto g31) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.96 Mobile Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 12; TECNO CK6n) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.50 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 13; Nokia G42 5G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.41 Mobile Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 1, "Mozilla/5.0 (iPad; CPU OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": true } }, { "hash": "t13d1011h2_61a7ad8aa9b6_37eac399f7d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "37eac399f7d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-10-45-11-13-16-23-51-5-0-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 57, "first_seen": 1788480945, "last_seen": 1791297856, "transport": "t", "ja3_hash": "21a82d84b561112b87e5b44202854f83", "ja3_variant_count": 57, "ja3_variants": [ "21a82d84b561112b87e5b44202854f83", "9cf87c6d6536fba217af09ccf96ebe63", "ecbc860c72bed7eb416b237ba96529ee", "5d06bd1afd82c23845a76d1dcd3639bd", "9e0b50f73a2e397210bdeda91b1ee756", "d3877e560b452f765f50788d222fac2f", "d33b44668599ac6d189a0c6d14fa137b", "5716c979d8995c9746a7bbe1b717d070", "d5f94ac7afde1f9f0dd84469bf8524fa", "12c51fe41f63230ef0bfbfb00cbf762e", "c75d08f0cd515f2b2ec1aa9682fc770e", "14727e8ca969c84187a96ba95e29660b" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 44, "Mozilla/5.0 (compatible; Reflectionbot/1.0; +https://reflection.ai/bot)": 4 }, "ua_disagreement": false } }, { "hash": "t13d1011h2_61a7ad8aa9b6_4086b72c8bfb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (4086b72c8bfb) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "4086b72c8bfb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-49199-52393-52392-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 173, "first_seen": 1788300337, "last_seen": 1791044093, "transport": "t", "ja3_hash": "fda646b797263e0d2c243f19eb6a26ca", "ja3_variant_count": 1, "ja3_variants": [ "fda646b797263e0d2c243f19eb6a26ca" ], "user_agents": { "TerraCotta 0.2 https://www.github.com/ceramicTeam/CeramicTerracotta": 173 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1011h2_61a7ad8aa9b6_723f4692b966", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "723f4692b966", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-11-23-16-13-43-0-51-5-45-41,29-23-24-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790330550, "last_seen": 1791299464, "transport": "t", "ja3_hash": "74056d6fd0ae5b461ffd9cea912ed515", "ja3_variant_count": 2, "ja3_variants": [ "74056d6fd0ae5b461ffd9cea912ed515", "32fb7b8ca91c3dbbc4f88f44c45c1c1c" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1011h2_61a7ad8aa9b6_ae9f20769a5d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "ae9f20769a5d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-0-35-23-10-11-43-16-13-45-5,29-23-24-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1314, "first_seen": 1788445073, "last_seen": 1791363210, "transport": "t", "ja3_hash": "c7dc67da6b59e15fa63ff073f5f3969b", "ja3_variant_count": 1302, "ja3_variants": [ "c7dc67da6b59e15fa63ff073f5f3969b", "1d01111e4f42524ee24f87ad83f1bcf4", "52a32f8585115a0603e099f26c7d63e9", "b89f0578bb7eae8e7488d3f78b1e25a5", "f3aaf748a01eb600bf025c276de0fe36", "3f152235a5d7d4033d592b6f998bcd45", "5166cf76e707deec7e1e79aaaad151d9", "155c339c5e5c4529da87fb3a9bc0e6d4", "85b29b5096d50ac1197cc691e6d3482e", "301fe7c410372dfe186c0b5a0b3d8e7f", "1f81a4c54ef5b1aef9af20e2fd3cd573", "691662c2666f1d4db09fecdfac05493f" ], "user_agents": { "Mozilla/5.0 (compatible; Qwantbot/1.0; +https://help.qwant.com/bot/)": 201, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1048, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 19, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 (compatible; AionBot/1.0)": 126, "Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0": 12, "Software Security Research/1.0 (+https://finn.softsec.ruhr-uni-bochum.de)": 1, "repology-linkchecker/1 (+https://repology.org/docs/bots)": 6, "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 2, "umi/1.0 (+https://umi.dev/bot)": 1 }, "ua_disagreement": true } }, { "hash": "t13d1011h2_9a30925095c0_2f5041364463", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "9a30925095c0", "c": "2f5041364463", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-156-4865-4866-4867,0-11-65281-23-18-5-10-13-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 31, "first_seen": 1788055995, "last_seen": 1791350879, "transport": "t", "ja3_hash": "92e9f8e596cec05cf5471d8692db5019", "ja3_variant_count": 1, "ja3_variants": [ "92e9f8e596cec05cf5471d8692db5019" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d1011ht_61a7ad8aa9b6_07a85421bdea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "07a85421bdea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-43-35-10-11-16-51-5-23-0-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 752, "first_seen": 1787869333, "last_seen": 1791363233, "transport": "t", "ja3_hash": "3fe2d4327acbd53e8c3dc7847a2651f1", "ja3_variant_count": 328, "ja3_variants": [ "3fe2d4327acbd53e8c3dc7847a2651f1", "035649ed3561e2c3998b3e580a64358c", "d5e3d0d6aff302fac95936357bdd2582", "ba0a4f2333fddabd575339d843f66fb9", "d92a1d6ac470be364d74ec5bde6d691f", "f076f26b0a3e25e3e58005296c2246d1", "ab8cebde69dcfe1c4447f2b7cb327a5e", "aee6d89c2f6fab4759247a14bf5c7e5c", "62c2d9be997159a2212eb9b773157523", "a4f5aa10922b806f9715320d82e4eb84", "d5b9532e771ff9c8241bf3f092faadaa", "9beb32aa1d76bc8898ae8ab06ff37e50" ], "user_agents": { "crusader-worker/1.0": 81, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 236, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 174, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 326, "Mozilla/5.0 (compatible; GitFinder/1.0)": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.co": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 27, "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)": 39, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 9, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186]": 6, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 7, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; SEOJuice-SearchBot/1.0; +https://seojuice.io/bot": 12, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15": 1, "PQCrypta-Discovery-Agent/1.0.45": 16, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 (compatible; AionBot/1.0)": 6, "PQCrypta-Discovery-Agent/1.0.38": 7, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1011ht_61a7ad8aa9b6_723f4692b966", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (723f4692b966) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "723f4692b966", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-0-51-43-45-13-11-23-10-5-41,29-23-24-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790138260, "last_seen": 1791327958, "transport": "t", "ja3_hash": "a5b82e7b3aaf7e31256cf2799b3a594d", "ja3_variant_count": 1, "ja3_variants": [ "a5b82e7b3aaf7e31256cf2799b3a594d" ], "user_agents": { "Software Security Research/1.0 (+https://finn.softsec.ruhr-uni-bochum.de)": 1, "Software Security Research/1.0 (+https://reverse-proxies-measurements.softsec.ruhr-uni-bochum.de)": 1 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1011ht_61a7ad8aa9b6_81fd92bdef40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "81fd92bdef40", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-10-23-13-16-11-51-5-43-0-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788444456, "last_seen": 1791341117, "transport": "t", "ja3_hash": "ec9e7cfe1a506c7b5912a0c916c7971a", "ja3_variant_count": 1, "ja3_variants": [ "ec9e7cfe1a506c7b5912a0c916c7971a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d101200_01be160bb49b_d42405ff081a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (d42405ff081a) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d101200", "b": "01be160bb49b", "c": "d42405ff081a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-49200-49199-49192-49191-49196-49195-49188-49187,0-43-13-35-10-11-51-49-23-65281-45-41,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1789575259, "last_seen": 1790943036, "transport": "t", "ja3_hash": "c245d98215fa2fc5cd91e404811153a3", "ja3_variant_count": 1, "ja3_variants": [ "c245d98215fa2fc5cd91e404811153a3" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; WOW64) SkypeUriPreview Preview/0.5 skype-url-preview@microsoft.com": 10 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d101200_61a7ad8aa9b6_871b1b532347", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101200", "b": "61a7ad8aa9b6", "c": "871b1b532347", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-27-0-23-11-10-5-13-35-43-51-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790553195, "last_seen": 1790553208, "transport": "t", "ja3_hash": "871db81560e95408e2076943f70627f9", "ja3_variant_count": 3, "ja3_variants": [ "871db81560e95408e2076943f70627f9", "d3dbc5478a0200c790d08d3f1626ac9d", "c8a2c1b65955203418bf771765966fd8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1012h2_61a7ad8aa9b6_26b0faeb35ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1012h2", "b": "61a7ad8aa9b6", "c": "26b0faeb35ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-11-10-13-23-5-0-18-51-45-16-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1791053330, "last_seen": 1791053331, "transport": "t", "ja3_hash": "8bbd943d14de60c73f5f627d91caccb5", "ja3_variant_count": 1, "ja3_variants": [ "8bbd943d14de60c73f5f627d91caccb5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d111200_c5d436628c5c_258961422662", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d111200", "b": "c5d436628c5c", "c": "258961422662", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790427193, "last_seen": 1790427193, "transport": "t", "ja3_hash": "5cb9cf3ff82c0954c44ed8a0b0c8e2cc", "ja3_variant_count": 1, "ja3_variants": [ "5cb9cf3ff82c0954c44ed8a0b0c8e2cc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Edg/126.0.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1113h2_c5d436628c5c_6da051328960", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1113h2", "b": "c5d436628c5c", "c": "6da051328960", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789412703, "last_seen": 1790926294, "transport": "t", "ja3_hash": "4fd8c5e322a5d6cd14c8dd9842fb7a46", "ja3_variant_count": 1, "ja3_variants": [ "4fd8c5e322a5d6cd14c8dd9842fb7a46" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 226 }, "ua_disagreement": false } }, { "hash": "t13d111400_c5d436628c5c_94fdbf49c5a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d111400", "b": "c5d436628c5c", "c": "94fdbf49c5a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-22-23-13-43-45-51-27-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 27, "first_seen": 1789544779, "last_seen": 1791208116, "transport": "t", "ja3_hash": "72904ca78b64c594073f154004c89f6d", "ja3_variant_count": 1, "ja3_variants": [ "72904ca78b64c594073f154004c89f6d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 29 }, "ua_disagreement": false } }, { "hash": "t13d1114h2_5e2a75874763_a001c4a4f8d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1114h2", "b": "5e2a75874763", "c": "a001c4a4f8d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172,0-5-10-11-16-17-23-35-13-43-45-50-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 150, "first_seen": 1788928528, "last_seen": 1791343613, "transport": "t", "ja3_hash": "0a80f68631b6e8b4634dbc261e8ba60b", "ja3_variant_count": 2, "ja3_variants": [ "0a80f68631b6e8b4634dbc261e8ba60b", "2ca8118b4937369765242b3fbbc2afcf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 545, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1114h2_a4c8ab769d32_a001c4a4f8d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1114h2", "b": "a4c8ab769d32", "c": "a001c4a4f8d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-158,0-5-10-11-16-17-23-35-13-43-45-50-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788382238, "last_seen": 1790007619, "transport": "t", "ja3_hash": "648fd8e625132f2ea6cee9791f5e73c9", "ja3_variant_count": 1, "ja3_variants": [ "648fd8e625132f2ea6cee9791f5e73c9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d1114h2_c5d436628c5c_d69a85727d1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1114h2", "b": "c5d436628c5c", "c": "d69a85727d1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 54, "first_seen": 1789401813, "last_seen": 1791223583, "transport": "t", "ja3_hash": "fc6a00f80c3469f8b779058d9283c761", "ja3_variant_count": 1, "ja3_variants": [ "fc6a00f80c3469f8b779058d9283c761" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 249 }, "ua_disagreement": false } }, { "hash": "t13d1115h2_5e2a75874763_a49342b45e71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1115h2", "b": "5e2a75874763", "c": "a49342b45e71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172,0-5-10-11-16-17-23-35-13-43-45-50-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789317494, "last_seen": 1791094088, "transport": "t", "ja3_hash": "8dde3e838bd806be3dd49190073a7c28", "ja3_variant_count": 1, "ja3_variants": [ "8dde3e838bd806be3dd49190073a7c28" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 106 }, "ua_disagreement": false } }, { "hash": "t13d1115h2_a4c8ab769d32_a49342b45e71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1115h2", "b": "a4c8ab769d32", "c": "a49342b45e71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-158,0-5-10-11-16-17-23-35-13-43-45-50-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789668307, "last_seen": 1790007614, "transport": "t", "ja3_hash": "1f6a374561ef5fd10db280a55944cdd0", "ja3_variant_count": 1, "ja3_variants": [ "1f6a374561ef5fd10db280a55944cdd0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d120900_ed40b14a4398_b229174c0316", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d120900", "b": "ed40b14a4398", "c": "b229174c0316", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-158-159-255,0-11-10-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788463563, "last_seen": 1788463601, "transport": "t", "ja3_hash": "06b77f416ebe634dfdf366b05b0aa469", "ja3_variant_count": 1, "ja3_variants": [ "06b77f416ebe634dfdf366b05b0aa469" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d121100_a538d02d76d5_b2544a34d7f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d121100", "b": "a538d02d76d5", "c": "b2544a34d7f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191-255,0-11-10-35-5-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787558198, "last_seen": 1789179310, "transport": "t", "ja3_hash": "02d7359ba777278df8619c1fd64f71e1", "ja3_variant_count": 1, "ja3_variants": [ "02d7359ba777278df8619c1fd64f71e1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3, "/": 1, "Mozilla/5.0 (compatible; StackScopeBot/1.0; +https://stackscope.dev/bot)": 2 }, "ua_disagreement": false } }, { "hash": "t13d121200_a538d02d76d5_4a346d76d9b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d121200", "b": "a538d02d76d5", "c": "4a346d76d9b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191-255,0-11-10-35-5-22-23-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1790120860, "last_seen": 1790946787, "transport": "t", "ja3_hash": "6ba5ebcd44d8e8d8b1fca175de0cbc31", "ja3_variant_count": 1, "ja3_variants": [ "6ba5ebcd44d8e8d8b1fca175de0cbc31" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1212ht_a538d02d76d5_4c29f3e0d561", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1212ht", "b": "a538d02d76d5", "c": "4c29f3e0d561", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191-255,0-11-10-35-5-16-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 73, "first_seen": 1787471087, "last_seen": 1791184847, "transport": "t", "ja3_hash": "3dd7722e35af71a5714920be822a2cf8", "ja3_variant_count": 1, "ja3_variants": [ "3dd7722e35af71a5714920be822a2cf8" ], "user_agents": { "Mozilla/5.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 102, "Mozilla/5.0 (compatible; DataForSeoBot/1.0; +https://dataforseo.com/dataforseo-bot)": 49 }, "ua_disagreement": false } }, { "hash": "t13d131000_f57a46bbacb6_27f0a1fdd87d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131000", "b": "f57a46bbacb6", "c": "27f0a1fdd87d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9000, "first_seen": 1787444198, "last_seen": 1791360892, "transport": "t", "ja3_hash": "8bee49baa010986785a9e74d688ed7e9", "ja3_variant_count": 5, "ja3_variants": [ "8bee49baa010986785a9e74d688ed7e9", "9a382d25aa597efd92d217d84b6eca00", "5b479314f6cfb0a2a2272a2b316ef611", "830b214050a12f72787c1e61e84a6c04", "fe2890151de23c89070fe03e27e6bcf2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 18, "metabase-cve-2026-72898-detect/1.0 (benign detection probes only)": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 675, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 538, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36": 212, "AdsNexusBot/1.0": 2, "Mozilla/5.0 (compatible; AdsNexusBot/1.3; +https://example.invalid/bot)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0 Safari/537.36": 35, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0 Safari/537.36": 27, "Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0": 38, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 173, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 65, "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)": 134 }, "ua_disagreement": true } }, { "hash": "t13d131100_00f390d99b96_4b7cee5f0569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (4b7cee5f0569) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d131100", "b": "00f390d99b96", "c": "4b7cee5f0569", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-49171-49172-156-157-47-53-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 44, "first_seen": 1790427567, "last_seen": 1790895299, "transport": "t", "ja3_hash": "a19565b81b3f678c66e571deaa942a59", "ja3_variant_count": 1, "ja3_variants": [ "a19565b81b3f678c66e571deaa942a59" ], "user_agents": { "wp-cve-2026-87902-validator/1.0": 40 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d131100_f57a46bbacb6_0fe28f4911d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131100", "b": "f57a46bbacb6", "c": "0fe28f4911d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11057, "first_seen": 1787442834, "last_seen": 1791362784, "transport": "t", "ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "ja3_variant_count": 2, "ja3_variants": [ "20b279993ae2e137e62b9647c6d768fb", "6aa3e70ad597aeef07e78d50366922c1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Agency/93.8.2357.5": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.3": 15, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1.2 Mobile/15E148 Safari/604": 9, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0": 56, "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 7696, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36": 45 }, "ua_disagreement": false } }, { "hash": "t13d131100_f57a46bbacb6_4b7cee5f0569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131100", "b": "f57a46bbacb6", "c": "4b7cee5f0569", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 40150, "first_seen": 1787443443, "last_seen": 1791363374, "transport": "t", "ja3_hash": "9b7dcdf3f997f1fb7b4409c94cb7ef36", "ja3_variant_count": 8, "ja3_variants": [ "9b7dcdf3f997f1fb7b4409c94cb7ef36", "9abac2dcf8349281469c64c30519fde4", "27073b904a6a7f562e7cf9ccfb774e91", "8451414b0a735c0a73c47f41caf2444d", "e7f86882bd4c6321f5d3475e2e1b017d", "d5df8ed14c6aa4b7f756d4a97207974f", "5c4e3d1520f523c80030e4bb4085e740", "eb3f185aa09766e1317541246c639162" ], "user_agents": { "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)": 243, "Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (HTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://webmaster.petalsearch.com/site/petalbot)": 35980, "DuckDuckBot/1.1; (+http://duckduckgo.com/duckduckbot.html)": 784, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 186, "Go-http-client/1.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246": 4, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1": 31 }, "ua_disagreement": true } }, { "hash": "t13d1311h1_f4ad024020fe_c261ae327436", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1311h1", "b": "f4ad024020fe", "c": "c261ae327436", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-156-157-47-53,0-23-65281-10-11-35-16-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791345212, "last_seen": 1791345212, "transport": "t", "ja3_hash": "7d92de3951b8bd423387471bd5908e86", "ja3_variant_count": 1, "ja3_variants": [ "7d92de3951b8bd423387471bd5908e86" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Bravebot/1.0; +https://search.brave.com/help/brave-search-crawler) Chrome/W.X.Y.Z Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d131200_f57a46bbacb6_849faac7d55e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131200", "b": "f57a46bbacb6", "c": "849faac7d55e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787606017, "last_seen": 1789915066, "transport": "t", "ja3_hash": "da6b59fefd11b7489221a16e8fe89e62", "ja3_variant_count": 1, "ja3_variants": [ "da6b59fefd11b7489221a16e8fe89e62" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1312h2_a44d0ee8b3cc_7c86852a3392", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1312h2", "b": "a44d0ee8b3cc", "c": "7c86852a3392", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49196-49199-49200-49171-156-157-47-53-10,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24-25-4588-25497-65074,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 65074, "name": "65074 (0xfe32)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1101, "first_seen": 1787444070, "last_seen": 1791358270, "transport": "t", "ja3_hash": "67560f98d68783bd640246df3052c151", "ja3_variant_count": 2, "ja3_variants": [ "67560f98d68783bd640246df3052c151", "5b6568f7bfc663f7e47905a28ff74062" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.7 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 CloudflareWebScanner/1.0": 80, "http://pqpdf.com/wp-admin/install.php?step=1": 592, "http://stlweb.dev/wp-admin/install.php?step=1": 46 }, "ua_disagreement": true } }, { "hash": "t13d1312h2_f57a46bbacb6_36b6e4cc52f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1312h2", "b": "f57a46bbacb6", "c": "36b6e4cc52f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2137, "first_seen": 1787451388, "last_seen": 1791363323, "transport": "t", "ja3_hash": "03117a8ed39ef02427ebbc39f121275c", "ja3_variant_count": 4, "ja3_variants": [ "03117a8ed39ef02427ebbc39f121275c", "e69402f870ecf542b4f017b0ed32936a", "b87b027808ec9cc24d4714e78a728853", "7d095856c1a82e1d950c2f850b01738c" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1": 4, "Go-http-client/2.0": 18, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 305, "Slack-ImgProxy (+https://api.slack.com/robots)": 460, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 43 }, "ua_disagreement": true } }, { "hash": "t13d1312h2_f57a46bbacb6_4f01dca9c5c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1312h2", "b": "f57a46bbacb6", "c": "4f01dca9c5c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1789751503, "last_seen": 1791300218, "transport": "t", "ja3_hash": "95b6f6d62c2c0f5258859e829e0055f5", "ja3_variant_count": 1, "ja3_variants": [ "95b6f6d62c2c0f5258859e829e0055f5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 51, "Mozilla/5.0 (compatible; WordPressPostChecker/1.0)": 3 }, "ua_disagreement": false } }, { "hash": "t13d1312h2_f57a46bbacb6_b13c6082f84f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1312h2", "b": "f57a46bbacb6", "c": "b13c6082f84f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-16-43-51,25497-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 61, "first_seen": 1787508618, "last_seen": 1791286173, "transport": "t", "ja3_hash": "ed3e096ee0b25c6cc6d45430548096eb", "ja3_variant_count": 1, "ja3_variants": [ "ed3e096ee0b25c6cc6d45430548096eb" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Bytespider;https://zhanzhang.toutiao.com/": 20, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5, "Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/7.0 Mobile Safari/537.36 (compatible; Bytespider; https://bytedance.sg.larkof": 19 }, "ua_disagreement": false } }, { "hash": "t13d131300_f57a46bbacb6_1f5de3afc965", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131300", "b": "f57a46bbacb6", "c": "1f5de3afc965", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51-45,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1790433948, "last_seen": 1791155489, "transport": "t", "ja3_hash": "65da2ee199542b5bfb6ad7ee56bb8cd2", "ja3_variant_count": 1, "ja3_variants": [ "65da2ee199542b5bfb6ad7ee56bb8cd2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (l9scan/2.0.1353e25393e2937313e26363; +https://leakix.net)": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d131300_f57a46bbacb6_7e8bfdfcb2cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131300", "b": "f57a46bbacb6", "c": "7e8bfdfcb2cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790308918, "last_seen": 1790535902, "transport": "t", "ja3_hash": "1e868d37719b9b08000d33fd79c32db9", "ja3_variant_count": 1, "ja3_variants": [ "1e868d37719b9b08000d33fd79c32db9" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d1313h2_f57a46bbacb6_02fd2181c59f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1313h2", "b": "f57a46bbacb6", "c": "02fd2181c59f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-16-43-51-45,25497-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 587, "first_seen": 1787460079, "last_seen": 1791357993, "transport": "t", "ja3_hash": "d3516fb149c297df8b9e80e3d0471e6b", "ja3_variant_count": 1, "ja3_variants": [ "d3516fb149c297df8b9e80e3d0471e6b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Version/7.0 Mobile Safari/537.36 (compatible; Bytespider; https://bytedance.sg.larkof": 292, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Bytespider;https://zhanzhang.toutiao.com/": 162, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 57 }, "ua_disagreement": false } }, { "hash": "t13d1313h2_f57a46bbacb6_9c429092a687", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1313h2", "b": "f57a46bbacb6", "c": "9c429092a687", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1789933068, "last_seen": 1791290116, "transport": "t", "ja3_hash": "81e2f9b0f638109128bd72ffabea460f", "ja3_variant_count": 1, "ja3_variants": [ "81e2f9b0f638109128bd72ffabea460f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 83 }, "ua_disagreement": false } }, { "hash": "t13d1313h2_f57a46bbacb6_fb18a4f6686c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1313h2", "b": "f57a46bbacb6", "c": "fb18a4f6686c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-52393-49199-52392-49162-49161-49172-49171,0-23-65281-10-11-16-5-13-18-51-45-43-27,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 28, "first_seen": 1789323008, "last_seen": 1791219230, "transport": "t", "ja3_hash": "8527da8b8a640065e72ec6b6f99764f3", "ja3_variant_count": 1, "ja3_variants": [ "8527da8b8a640065e72ec6b6f99764f3" ], "user_agents": { "Snagit/2026.101 CFNetwork/3860.600.21 Darwin/25.5.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.4 facebookexternalhit/1.1 Facebot Twitterbot/1.0": 8, "Snagit/2026.98 CFNetwork/3860.600.21 Darwin/25.5.0": 42 }, "ua_disagreement": false } }, { "hash": "t13d131400_f57a46bbacb6_bd3a82ac733b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131400", "b": "f57a46bbacb6", "c": "bd3a82ac733b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 14, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51-45-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 152, "first_seen": 1790308920, "last_seen": 1790535903, "transport": "t", "ja3_hash": "692153c31061839138feeecb8e281fd5", "ja3_variant_count": 1, "ja3_variants": [ "692153c31061839138feeecb8e281fd5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari/537.36": 347 }, "ua_disagreement": false } }, { "hash": "t13d1314h2_f57a46bbacb6_1410edd0513f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1314h2", "b": "f57a46bbacb6", "c": "1410edd0513f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 124, "first_seen": 1789009551, "last_seen": 1790913592, "transport": "t", "ja3_hash": "a15e24f40a90d5cba676dfe012ff2d4a", "ja3_variant_count": 1, "ja3_variants": [ "a15e24f40a90d5cba676dfe012ff2d4a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 438 }, "ua_disagreement": false } }, { "hash": "t13d1314h2_f57a46bbacb6_31edcf4f4949", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (31edcf4f4949) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1314h2", "b": "f57a46bbacb6", "c": "31edcf4f4949", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 28, "first_seen": 1790303589, "last_seen": 1791341103, "transport": "t", "ja3_hash": "b76d503360ae441d410a85a7f8d648ab", "ja3_variant_count": 1, "ja3_variants": [ "b76d503360ae441d410a85a7f8d648ab" ], "user_agents": { "DeepSeek Chat/2.6.1 (com.deepseek.chat; build:3; iOS 18.7.7) Alamofire/5.10.2": 1 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1314h2_f57a46bbacb6_83d38ed57bc0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1314h2", "b": "f57a46bbacb6", "c": "83d38ed57bc0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-16-43-51-45-41,25497-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 47, "first_seen": 1787601172, "last_seen": 1790623141, "transport": "t", "ja3_hash": "613a531b715c884cc90ac9591a6059b5", "ja3_variant_count": 1, "ja3_variants": [ "613a531b715c884cc90ac9591a6059b5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Bytespider;https://zhanzhang.toutiao.com/": 46, "Mozilla/5.0 (Linux; Android 13; Pixel 6a) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.120 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1315h2_f57a46bbacb6_6695aec2af92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1315h2", "b": "f57a46bbacb6", "c": "6695aec2af92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51-45-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1789740903, "last_seen": 1790609700, "transport": "t", "ja3_hash": "95d89cdb32022f73a6a999104183c564", "ja3_variant_count": 1, "ja3_variants": [ "95d89cdb32022f73a6a999104183c564" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d140800_0c27f4e60a3e_e2dcb997b12f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d140800", "b": "0c27f4e60a3e", "c": "e2dcb997b12f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49188-52393-49187-49200-49199-49192-52392-49191-4866-4867-4865-255,10-5-35-11-13-0-51-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1791181695, "last_seen": 1791181699, "transport": "t", "ja3_hash": "68a0a2f0dc9e6a15c93dccd99aed364d", "ja3_variant_count": 10, "ja3_variants": [ "68a0a2f0dc9e6a15c93dccd99aed364d", "fda416bc1d4b106100a8178c64469cad", "4efafd545cb5569ca609f97dbe9d010f", "6d784890b54e330a92830952f914e42a", "51a2e7e37fc82860e36cef5df3416d62", "af30118040df8f212c76ed169808bf2e", "a916608e4e9df5a5e6f8baff48168743", "f4c2a77461a406825fda81ff3a9cb8d1", "0b420cbf3dd56f47ebfbee8e45319116", "17db51ff79a6b1854ee7aacd91f2be32" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 30 }, "ua_disagreement": false } }, { "hash": "t13d140900_f98f5dc5c741_077468b7bd5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d140900", "b": "f98f5dc5c741", "c": "077468b7bd5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-49199-157-156-49172-49171-53-47-255,0-11-10-23-13-43-45-51-41,23-24-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790189580, "last_seen": 1790189587, "transport": "t", "ja3_hash": "471bcefdc0427da483ef1e6f82597953", "ja3_variant_count": 1, "ja3_variants": [ "471bcefdc0427da483ef1e6f82597953" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d140900_f98f5dc5c741_53d4e768415e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d140900", "b": "f98f5dc5c741", "c": "53d4e768415e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-49199-157-156-49172-49171-53-47-255,0-11-10-23-13-43-45-51-21,23-24-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 53, "first_seen": 1790189581, "last_seen": 1790796584, "transport": "t", "ja3_hash": "8327588fe657e31a55c0dc77f87de542", "ja3_variant_count": 1, "ja3_variants": [ "8327588fe657e31a55c0dc77f87de542" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 98, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 80, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 166 }, "ua_disagreement": false } }, { "hash": "t13d141000_cbb2034c60b8_27f0a1fdd87d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d141000", "b": "cbb2034c60b8", "c": "27f0a1fdd87d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5276, "first_seen": 1787520939, "last_seen": 1791348069, "transport": "t", "ja3_hash": "88476a293aeb6f5dc7a3630d391c2980", "ja3_variant_count": 2, "ja3_variants": [ "88476a293aeb6f5dc7a3630d391c2980", "944ced96eb8f08b37bed45951d12594e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 22, "vuln_scanner/3.1.0 (CVE-2026-4020)": 9, "Mozilla/5.0 (Linux; arm_64; Android 12; CPH2205) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 YaBrowser/23.3.3.86.00 SA/3 Mobile Safari/537.36": 32, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 7, "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity": 8 }, "ua_disagreement": false } }, { "hash": "t13d1410h2_f98f5dc5c741_518300b43b53", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1410h2", "b": "f98f5dc5c741", "c": "518300b43b53", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-49171-49172-156-157-47-53-255,0-11-10-35-16-23-13-43-45-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790723753, "last_seen": 1790723754, "transport": "t", "ja3_hash": "522b1addc7730478afdad5f70bce7020", "ja3_variant_count": 1, "ja3_variants": [ "522b1addc7730478afdad5f70bce7020" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 13 }, "ua_disagreement": false } }, { "hash": "t13d1410h2_f98f5dc5c741_b0ef02ef599f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1410h2", "b": "f98f5dc5c741", "c": "b0ef02ef599f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-49199-157-156-49172-49171-53-47-255,0-11-10-16-23-13-43-45-51-21,23-24-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 51, "first_seen": 1787836080, "last_seen": 1791259958, "transport": "t", "ja3_hash": "35946cbf409b500b81dca502b65c4139", "ja3_variant_count": 1, "ja3_variants": [ "35946cbf409b500b81dca502b65c4139" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 82, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 534, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 94 }, "ua_disagreement": false } }, { "hash": "t13d141100_cbb2034c60b8_0fe28f4911d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d141100", "b": "cbb2034c60b8", "c": "0fe28f4911d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 507, "first_seen": 1787536732, "last_seen": 1791314091, "transport": "t", "ja3_hash": "6fcb7aa10768c08e39459bf9b7478ab4", "ja3_variant_count": 1, "ja3_variants": [ "6fcb7aa10768c08e39459bf9b7478ab4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1411h2_cbb2034c60b8_2f5041364463", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1411h2", "b": "cbb2034c60b8", "c": "2f5041364463", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-5-10-11-13-65281-23-16-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 100, "first_seen": 1787582629, "last_seen": 1791306898, "transport": "t", "ja3_hash": "fd75aaca18604d62f2bc8b02b345140f", "ja3_variant_count": 2, "ja3_variants": [ "fd75aaca18604d62f2bc8b02b345140f", "1aff7135b7ef63d5ab35602cfee4fe08" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36": 2, "PipericBot/1.0 (+https://piperic.com/bot)": 48, "Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com)": 88, "Mozilla/5.0 (compatible; AIPostBot/1.0)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1411h2_f98f5dc5c741_43244b3c42a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1411h2", "b": "f98f5dc5c741", "c": "43244b3c42a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-49171-49172-156-157-47-53-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789931519, "last_seen": 1790058432, "transport": "t", "ja3_hash": "3da8794700f3c16cffc6e95a30e25b0b", "ja3_variant_count": 1, "ja3_variants": [ "3da8794700f3c16cffc6e95a30e25b0b" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ABEvalBot/0.1) Version/11.1.2 Safari/605.1.15": 19 }, "ua_disagreement": false } }, { "hash": "t13d1413h2_cbb2034c60b8_02fd2181c59f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (02fd2181c59f) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1413h2", "b": "cbb2034c60b8", "c": "02fd2181c59f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-5-10-11-35-13-65281-23-16-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789777340, "last_seen": 1789777340, "transport": "t", "ja3_hash": "486df75fc4af1573cc1dd10925179ff4", "ja3_variant_count": 1, "ja3_variants": [ "486df75fc4af1573cc1dd10925179ff4" ], "user_agents": { "sellsybot/1.0 (+mailto:dev@sellsy.com)": 3 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1414ht_cbb2034c60b8_5cfd0277bcfd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1414ht", "b": "cbb2034c60b8", "c": "5cfd0277bcfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 52, "first_seen": 1787471855, "last_seen": 1791236722, "transport": "t", "ja3_hash": "e13341638f1239c92909f490b08d5b74", "ja3_variant_count": 1, "ja3_variants": [ "e13341638f1239c92909f490b08d5b74" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5; rv:127.0) Gecko/20100101 Firefox/127.0": 11 }, "ua_disagreement": false } }, { "hash": "t13d1415ht_cbb2034c60b8_3052c9156dc4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1415ht", "b": "cbb2034c60b8", "c": "3052c9156dc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 15, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51-45-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787471858, "last_seen": 1791236723, "transport": "t", "ja3_hash": "9b7eaffae07c43baf9ab33e59012bf9f", "ja3_variant_count": 1, "ja3_variants": [ "9b7eaffae07c43baf9ab33e59012bf9f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t13d150400_8daaf6152771_6395773a0331", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150400", "b": "8daaf6152771", "c": "6395773a0331", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789782777, "last_seen": 1789782777, "transport": "t", "ja3_hash": "2876134be8e2b31d44aca951a5405feb", "ja3_variant_count": 1, "ja3_variants": [ "2876134be8e2b31d44aca951a5405feb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150400_8daaf6152771_65583ff04902", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150400", "b": "8daaf6152771", "c": "65583ff04902", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789455856, "last_seen": 1789455856, "transport": "t", "ja3_hash": "22b149a3c1431166b7e04a0725af9843", "ja3_variant_count": 1, "ja3_variants": [ "22b149a3c1431166b7e04a0725af9843" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150400_8daaf6152771_793c12383e39", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150400", "b": "8daaf6152771", "c": "793c12383e39", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788973019, "last_seen": 1788973019, "transport": "t", "ja3_hash": "e3368a82ebc912309455b4e606fa7ef8", "ja3_variant_count": 1, "ja3_variants": [ "e3368a82ebc912309455b4e606fa7ef8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1504h2_8daaf6152771_db745f7197ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1504h2", "b": "8daaf6152771", "c": "db745f7197ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790778230, "last_seen": 1790778230, "transport": "t", "ja3_hash": "d7ae69a3b54e8c1f975af25061003245", "ja3_variant_count": 1, "ja3_variants": [ "d7ae69a3b54e8c1f975af25061003245" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_3fca233cb805", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "3fca233cb805", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790237414, "last_seen": 1790237414, "transport": "t", "ja3_hash": "ad47425917ccfe95737a5980f2014be5", "ja3_variant_count": 1, "ja3_variants": [ "ad47425917ccfe95737a5980f2014be5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_4cfca6cb5a9d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "4cfca6cb5a9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-43-17613-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790213891, "last_seen": 1790213891, "transport": "t", "ja3_hash": "48a0b25832f5969c0c2cfa2e3ad78ba0", "ja3_variant_count": 1, "ja3_variants": [ "48a0b25832f5969c0c2cfa2e3ad78ba0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_6e2606526f07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "6e2606526f07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-51-0-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790666917, "last_seen": 1790666917, "transport": "t", "ja3_hash": "8a9012b5bbc183eb518099d1aab76fa0", "ja3_variant_count": 1, "ja3_variants": [ "8a9012b5bbc183eb518099d1aab76fa0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_8878117fc4d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "8878117fc4d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-0-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790539802, "last_seen": 1790539802, "transport": "t", "ja3_hash": "4d5b7ea9decae9f2dfa22ef7774991a7", "ja3_variant_count": 1, "ja3_variants": [ "4d5b7ea9decae9f2dfa22ef7774991a7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_98a7beea59bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "98a7beea59bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789633635, "last_seen": 1789633635, "transport": "t", "ja3_hash": "40564364b76a383102c47647c0206976", "ja3_variant_count": 1, "ja3_variants": [ "40564364b76a383102c47647c0206976" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_ace5f9019dcb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "ace5f9019dcb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-0-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790360825, "last_seen": 1790360825, "transport": "t", "ja3_hash": "12a08cf5fca364c86888f8edfd68a733", "ja3_variant_count": 1, "ja3_variants": [ "12a08cf5fca364c86888f8edfd68a733" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_c79d6c8945ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "c79d6c8945ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-65281-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788767823, "last_seen": 1788767823, "transport": "t", "ja3_hash": "85b2d556966b520ec30fb50bab4a2719", "ja3_variant_count": 1, "ja3_variants": [ "85b2d556966b520ec30fb50bab4a2719" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_eafb04eb1612", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "eafb04eb1612", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-0-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790997269, "last_seen": 1790997269, "transport": "t", "ja3_hash": "a238cce3688349fc129536719f4658c1", "ja3_variant_count": 1, "ja3_variants": [ "a238cce3688349fc129536719f4658c1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_f0c919a2e8f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (f0c919a2e8f0) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "f0c919a2e8f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-43-45-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789963688, "last_seen": 1789963688, "transport": "t", "ja3_hash": "ced77aee1bc1b25a54e4c713c445af73", "ja3_variant_count": 1, "ja3_variants": [ "ced77aee1bc1b25a54e4c713c445af73" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d150500_8daaf6152771_fcfc74e37280", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "fcfc74e37280", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-13-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788847119, "last_seen": 1788847119, "transport": "t", "ja3_hash": "d36ac886b39f68e8b8fc02c723b68282", "ja3_variant_count": 1, "ja3_variants": [ "d36ac886b39f68e8b8fc02c723b68282" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1505h2_8daaf6152771_6c0a99cc6402", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1505h2", "b": "8daaf6152771", "c": "6c0a99cc6402", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-16-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789791000, "last_seen": 1789791000, "transport": "t", "ja3_hash": "01ff4fe865f89721f4d7b79b64a3384e", "ja3_variant_count": 1, "ja3_variants": [ "01ff4fe865f89721f4d7b79b64a3384e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_08841029404f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "08841029404f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-43-27-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789309288, "last_seen": 1790329037, "transport": "t", "ja3_hash": "993c441ae238c16f4ccc81f549eeed95", "ja3_variant_count": 3, "ja3_variants": [ "993c441ae238c16f4ccc81f549eeed95", "a24ce0136118afaf8735b21051c7ca0b", "27f3f1714e67b078835bb6fc1e0b353e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_0c11a4eb7702", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "0c11a4eb7702", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-43-35-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788756545, "last_seen": 1788756545, "transport": "t", "ja3_hash": "a23b77dcaad90edc81684345fb188e2d", "ja3_variant_count": 1, "ja3_variants": [ "a23b77dcaad90edc81684345fb188e2d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_12bf9c0e3530", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "12bf9c0e3530", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-18-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789008607, "last_seen": 1789008607, "transport": "t", "ja3_hash": "26114ed3899b79ab059978678f4a042c", "ja3_variant_count": 1, "ja3_variants": [ "26114ed3899b79ab059978678f4a042c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_1b89cb734486", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "1b89cb734486", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-11-5-27-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790207548, "last_seen": 1790207548, "transport": "t", "ja3_hash": "ffc756c593ac2c22e793db9ce32076fc", "ja3_variant_count": 1, "ja3_variants": [ "ffc756c593ac2c22e793db9ce32076fc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_3bacbcd22aa6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "3bacbcd22aa6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-0-13-51-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790221872, "last_seen": 1790221872, "transport": "t", "ja3_hash": "ece66d1188526555a8f922ad4f112eac", "ja3_variant_count": 1, "ja3_variants": [ "ece66d1188526555a8f922ad4f112eac" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_3bd3a522d002", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "3bd3a522d002", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-0-43-11-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789623810, "last_seen": 1789623810, "transport": "t", "ja3_hash": "e7f642621728b6ab0e238f9ceb6bbfdd", "ja3_variant_count": 1, "ja3_variants": [ "e7f642621728b6ab0e238f9ceb6bbfdd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_3d650ff37b5d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "3d650ff37b5d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-43-51-35-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790905488, "last_seen": 1790905488, "transport": "t", "ja3_hash": "dc75f83be3e29d917b1a3060c1b8b968", "ja3_variant_count": 1, "ja3_variants": [ "dc75f83be3e29d917b1a3060c1b8b968" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_4fe16887204d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "4fe16887204d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-17613-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790800526, "last_seen": 1790800526, "transport": "t", "ja3_hash": "d9044c5438139532c04e90b96ea92574", "ja3_variant_count": 1, "ja3_variants": [ "d9044c5438139532c04e90b96ea92574" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 38 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_5337dc83306a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "5337dc83306a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-0-27-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788881421, "last_seen": 1788881421, "transport": "t", "ja3_hash": "24939f506ab4c6b039fd942cf564651f", "ja3_variant_count": 1, "ja3_variants": [ "24939f506ab4c6b039fd942cf564651f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_5d3571b4b177", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "5d3571b4b177", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-43-18-13-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789006554, "last_seen": 1790984024, "transport": "t", "ja3_hash": "63bced1deae20c4edf126f6fb321be14", "ja3_variant_count": 2, "ja3_variants": [ "63bced1deae20c4edf126f6fb321be14", "3f866304892544a196e86fa3977e47c9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_5e2d4a56324a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "5e2d4a56324a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-10-13-11-51,514-4588-24-23-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789201599, "last_seen": 1789201599, "transport": "t", "ja3_hash": "8fff960d0cd0c2344158390289bee305", "ja3_variant_count": 1, "ja3_variants": [ "8fff960d0cd0c2344158390289bee305" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_6715be504730", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "6715be504730", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-51-27-0-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790239069, "last_seen": 1790239069, "transport": "t", "ja3_hash": "822ec85a1ecdef35e62e2e89dbe51f90", "ja3_variant_count": 1, "ja3_variants": [ "822ec85a1ecdef35e62e2e89dbe51f90" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_6ce2c773f3ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "6ce2c773f3ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-17613-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788740496, "last_seen": 1788740496, "transport": "t", "ja3_hash": "307cd0c2acf93dfe845319d032deb4f8", "ja3_variant_count": 1, "ja3_variants": [ "307cd0c2acf93dfe845319d032deb4f8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_6db434393cb9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "6db434393cb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-65281-43-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788530028, "last_seen": 1788530028, "transport": "t", "ja3_hash": "c3df9fc5ef5dfcbfd8fac45110db1e53", "ja3_variant_count": 1, "ja3_variants": [ "c3df9fc5ef5dfcbfd8fac45110db1e53" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_86e82231b862", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "86e82231b862", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-65281-51-0-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791150353, "last_seen": 1791150353, "transport": "t", "ja3_hash": "0906dff8ff5c6705a6454e3906fdd0b4", "ja3_variant_count": 1, "ja3_variants": [ "0906dff8ff5c6705a6454e3906fdd0b4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_92db56b2e6a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "92db56b2e6a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-23-43-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791040222, "last_seen": 1791040222, "transport": "t", "ja3_hash": "7aaa628e9eb79b8f0908f7b414a68242", "ja3_variant_count": 1, "ja3_variants": [ "7aaa628e9eb79b8f0908f7b414a68242" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_a01fa3adfb96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "a01fa3adfb96", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-43-51-0-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789845091, "last_seen": 1789845091, "transport": "t", "ja3_hash": "5da3b1bd6db0901d34b5e056f4e279a5", "ja3_variant_count": 1, "ja3_variants": [ "5da3b1bd6db0901d34b5e056f4e279a5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_a213014aa474", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "a213014aa474", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-0-17613-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790241358, "last_seen": 1791292031, "transport": "t", "ja3_hash": "af43b84aa70f43bc405a528e4cbddf7e", "ja3_variant_count": 2, "ja3_variants": [ "af43b84aa70f43bc405a528e4cbddf7e", "45bcd8e083a586ee22f7f1c44f028b14" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_aafa9231f672", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "aafa9231f672", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-13-43-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790984025, "last_seen": 1790984025, "transport": "t", "ja3_hash": "f2560ddade6ca122f7e4d8fd7be21096", "ja3_variant_count": 1, "ja3_variants": [ "f2560ddade6ca122f7e4d8fd7be21096" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_b8c35809ee15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "b8c35809ee15", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-35-43-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790520195, "last_seen": 1790520195, "transport": "t", "ja3_hash": "620d693ac44badf99b99475b24cfddb4", "ja3_variant_count": 1, "ja3_variants": [ "620d693ac44badf99b99475b24cfddb4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_c02a7a5970fb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "c02a7a5970fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-43-5-51-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789628951, "last_seen": 1789628951, "transport": "t", "ja3_hash": "1cab11e6c170045ed4a2fa78dc07fc19", "ja3_variant_count": 1, "ja3_variants": [ "1cab11e6c170045ed4a2fa78dc07fc19" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_d431a128cf61", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "d431a128cf61", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-0-23-43-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791193237, "last_seen": 1791193237, "transport": "t", "ja3_hash": "d09693abfa4ecfc996d36c68ab830a5e", "ja3_variant_count": 1, "ja3_variants": [ "d09693abfa4ecfc996d36c68ab830a5e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_e068b723aa3d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "e068b723aa3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-0-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789681297, "last_seen": 1789681297, "transport": "t", "ja3_hash": "0cc41d34a8e23fc9b6828d9ab5487147", "ja3_variant_count": 1, "ja3_variants": [ "0cc41d34a8e23fc9b6828d9ab5487147" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_e85b1c722c2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "e85b1c722c2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-0-13-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790317374, "last_seen": 1790317374, "transport": "t", "ja3_hash": "72dede7599e8ece7606a4de3499fcb7a", "ja3_variant_count": 1, "ja3_variants": [ "72dede7599e8ece7606a4de3499fcb7a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_327888c009b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "327888c009b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-0-16-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790350611, "last_seen": 1790350611, "transport": "t", "ja3_hash": "bf6adc270d8883e7761182c2976374ee", "ja3_variant_count": 1, "ja3_variants": [ "bf6adc270d8883e7761182c2976374ee" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_466d29fac45c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "466d29fac45c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-43-16-35-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790366489, "last_seen": 1790366489, "transport": "t", "ja3_hash": "1a4c323dfb09317804a4c50419573569", "ja3_variant_count": 1, "ja3_variants": [ "1a4c323dfb09317804a4c50419573569" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_48dbec39fd41", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "48dbec39fd41", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-16-43-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790399961, "last_seen": 1790399961, "transport": "t", "ja3_hash": "1bd97862042e8befd49eacb76a2dc0df", "ja3_variant_count": 1, "ja3_variants": [ "1bd97862042e8befd49eacb76a2dc0df" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_4fe92bf3cc54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "4fe92bf3cc54", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-10-0-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790117457, "last_seen": 1790117457, "transport": "t", "ja3_hash": "f7af13c199ecf390330c248b5f31bc33", "ja3_variant_count": 1, "ja3_variants": [ "f7af13c199ecf390330c248b5f31bc33" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_58437a1b3ffd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "58437a1b3ffd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-16-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197416, "last_seen": 1790197416, "transport": "t", "ja3_hash": "fb21c3d8c6e1230e4ea0bf6e307dbac4", "ja3_variant_count": 1, "ja3_variants": [ "fb21c3d8c6e1230e4ea0bf6e307dbac4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_d08c9b4fefc6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "d08c9b4fefc6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-23-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791162427, "last_seen": 1791162427, "transport": "t", "ja3_hash": "c047350e58a1ea1854b0afcc2cc7a3d8", "ja3_variant_count": 1, "ja3_variants": [ "c047350e58a1ea1854b0afcc2cc7a3d8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) QQEX/9.9.36-53644 Chrome/144.0.7559.60 Safari/537.36 OS/win32,x64 QQAppId/537391628 QQEXBrowser/1.": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) QQ/9.9.36-53644 Chrome/144.0.7559.60 Electron/40.0.0 Safari/537.36 OS/win32,x64,10.0.22631,Windows ": 2 }, "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_d1abf05d0e7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "d1abf05d0e7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-35-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788781697, "last_seen": 1788781697, "transport": "t", "ja3_hash": "603b7f75d95da9027ebae22f7235d69a", "ja3_variant_count": 1, "ja3_variants": [ "603b7f75d95da9027ebae22f7235d69a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_faa9608ca676", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "faa9608ca676", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-18-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790965273, "last_seen": 1790965273, "transport": "t", "ja3_hash": "08470b2e0ddb5a2775a540af97f79903", "ja3_variant_count": 1, "ja3_variants": [ "08470b2e0ddb5a2775a540af97f79903" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_02eb97ab6134", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "02eb97ab6134", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-10-51-43-23-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791165585, "last_seen": 1791165585, "transport": "t", "ja3_hash": "ff2ced346a454fc327810994613c50d7", "ja3_variant_count": 1, "ja3_variants": [ "ff2ced346a454fc327810994613c50d7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_0ff64e3b8744", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "0ff64e3b8744", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-43-0-13-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790709482, "last_seen": 1790709482, "transport": "t", "ja3_hash": "f9707c604abbd1b10260d896dc8c8680", "ja3_variant_count": 1, "ja3_variants": [ "f9707c604abbd1b10260d896dc8c8680" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_1791c59c9eed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "1791c59c9eed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-13-43-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790039861, "last_seen": 1790039861, "transport": "t", "ja3_hash": "da13ac1edddfa0004e93aaec2784e66c", "ja3_variant_count": 1, "ja3_variants": [ "da13ac1edddfa0004e93aaec2784e66c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_2402d613f51d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "2402d613f51d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-18-45-43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790670250, "last_seen": 1790670250, "transport": "t", "ja3_hash": "49de355f6ae705e14df304d5a84b49f9", "ja3_variant_count": 1, "ja3_variants": [ "49de355f6ae705e14df304d5a84b49f9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_3df1326d0b5a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "3df1326d0b5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-18-51-43-11-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788731568, "last_seen": 1788731568, "transport": "t", "ja3_hash": "1b56eb4ac316c35d225285c1308e797f", "ja3_variant_count": 1, "ja3_variants": [ "1b56eb4ac316c35d225285c1308e797f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_3ea645034b4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "3ea645034b4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-23-43-65281-0-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788521179, "last_seen": 1788521179, "transport": "t", "ja3_hash": "d1a13a9ca1d0497013e494958ec0c3e4", "ja3_variant_count": 1, "ja3_variants": [ "d1a13a9ca1d0497013e494958ec0c3e4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_3ee62416bff0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "3ee62416bff0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-5-0-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790009051, "last_seen": 1790009051, "transport": "t", "ja3_hash": "77cc21d902fc4ba34d550f6b3010ef56", "ja3_variant_count": 1, "ja3_variants": [ "77cc21d902fc4ba34d550f6b3010ef56" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_4970460b490a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "4970460b490a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-0-11-43-51-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789881535, "last_seen": 1789881535, "transport": "t", "ja3_hash": "092626e815f2f02495c50eacb2e65a65", "ja3_variant_count": 1, "ja3_variants": [ "092626e815f2f02495c50eacb2e65a65" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_5c0745aabeec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "5c0745aabeec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-43-27-18-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790526848, "last_seen": 1790871015, "transport": "t", "ja3_hash": "62856e39f08f6d26e612b1c1bda927c0", "ja3_variant_count": 2, "ja3_variants": [ "62856e39f08f6d26e612b1c1bda927c0", "67db04744e7c374704f6a2a301a2deab" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_640f52470877", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "640f52470877", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-18-11-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790365868, "last_seen": 1790365868, "transport": "t", "ja3_hash": "86a7381cd34e3af1fe6320ec527decf8", "ja3_variant_count": 1, "ja3_variants": [ "86a7381cd34e3af1fe6320ec527decf8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_643b03e972d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "643b03e972d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-23-27-45-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788564895, "last_seen": 1788564895, "transport": "t", "ja3_hash": "f74f516057d41fae633d8b89644bd178", "ja3_variant_count": 1, "ja3_variants": [ "f74f516057d41fae633d8b89644bd178" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_6551d99663da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "6551d99663da", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-43-65281-45-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790223156, "last_seen": 1790223156, "transport": "t", "ja3_hash": "815168f51638286d8653825ac2009f63", "ja3_variant_count": 1, "ja3_variants": [ "815168f51638286d8653825ac2009f63" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_69aed197c2a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "69aed197c2a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-10-0-5-43-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791287091, "last_seen": 1791287091, "transport": "t", "ja3_hash": "e99daab2d94553a970b289935676974a", "ja3_variant_count": 1, "ja3_variants": [ "e99daab2d94553a970b289935676974a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_6c790e779fd8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "6c790e779fd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-0-23-43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791133414, "last_seen": 1791133414, "transport": "t", "ja3_hash": "c3c4fe7447255f4bab17909d5e8e1b3e", "ja3_variant_count": 1, "ja3_variants": [ "c3c4fe7447255f4bab17909d5e8e1b3e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_7156dfa78d42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "7156dfa78d42", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-35-43-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789124462, "last_seen": 1789124462, "transport": "t", "ja3_hash": "a4a0629c86ff3c8582c3004d15ec5f58", "ja3_variant_count": 1, "ja3_variants": [ "a4a0629c86ff3c8582c3004d15ec5f58" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 20 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_89a5394c171a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "89a5394c171a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-35-13-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791221603, "last_seen": 1791221603, "transport": "t", "ja3_hash": "05ea8cbfb414f64a219e91b34b64fac1", "ja3_variant_count": 1, "ja3_variants": [ "05ea8cbfb414f64a219e91b34b64fac1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_8ac6097fa65b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "8ac6097fa65b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-27-35-5-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788888850, "last_seen": 1788888850, "transport": "t", "ja3_hash": "164f44fc313dd876a062e48b0ae2050a", "ja3_variant_count": 1, "ja3_variants": [ "164f44fc313dd876a062e48b0ae2050a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_8f622c51302a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "8f622c51302a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-65281-0-13-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788571457, "last_seen": 1788571457, "transport": "t", "ja3_hash": "21a18ddb12482357df5130774c9a2e83", "ja3_variant_count": 1, "ja3_variants": [ "21a18ddb12482357df5130774c9a2e83" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_92faed73e396", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "92faed73e396", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-13-23-0-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524873, "last_seen": 1790524873, "transport": "t", "ja3_hash": "c386aea2fd6dc0c92f0afa0c20e8489c", "ja3_variant_count": 1, "ja3_variants": [ "c386aea2fd6dc0c92f0afa0c20e8489c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_9ee38d8fd5e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "9ee38d8fd5e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-18-17613-0-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788782926, "last_seen": 1788782926, "transport": "t", "ja3_hash": "0a45117f30da3db51111afaa13ef468f", "ja3_variant_count": 1, "ja3_variants": [ "0a45117f30da3db51111afaa13ef468f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_9fa51bad6b80", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "9fa51bad6b80", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-45-0-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788444966, "last_seen": 1788444966, "transport": "t", "ja3_hash": "4e40923bcd3f4b169ccd83311da1f3a9", "ja3_variant_count": 1, "ja3_variants": [ "4e40923bcd3f4b169ccd83311da1f3a9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_bf4ab279fbb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "bf4ab279fbb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-43-45-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790042183, "last_seen": 1790042183, "transport": "t", "ja3_hash": "38c98e0195757f7885c4cd9a93aeba24", "ja3_variant_count": 1, "ja3_variants": [ "38c98e0195757f7885c4cd9a93aeba24" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_bf6ae64f4d0e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "bf6ae64f4d0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-43-45-17613-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791223314, "last_seen": 1791223314, "transport": "t", "ja3_hash": "dcce94842e818f7b48f78d3c71d32bb0", "ja3_variant_count": 1, "ja3_variants": [ "dcce94842e818f7b48f78d3c71d32bb0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 44 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_cbd15a882afb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "cbd15a882afb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-23-5-43-51-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789671191, "last_seen": 1789671191, "transport": "t", "ja3_hash": "83c35fc13d3341d4c7fd206b5a66be26", "ja3_variant_count": 1, "ja3_variants": [ "83c35fc13d3341d4c7fd206b5a66be26" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_cfa48b8189dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "cfa48b8189dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-0-45-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790633629, "last_seen": 1790633629, "transport": "t", "ja3_hash": "348f02702a6db04b028630ca5acfb844", "ja3_variant_count": 1, "ja3_variants": [ "348f02702a6db04b028630ca5acfb844" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 9 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_d7148763b69b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "d7148763b69b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-5-45-51-43-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789669041, "last_seen": 1789669041, "transport": "t", "ja3_hash": "819512efdb1ff3d1b55997002adb921c", "ja3_variant_count": 1, "ja3_variants": [ "819512efdb1ff3d1b55997002adb921c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_e28b548bd0e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "e28b548bd0e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-10-23-13-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197964, "last_seen": 1790197964, "transport": "t", "ja3_hash": "855cbcfca9e144a47733f5947e1a55a1", "ja3_variant_count": 1, "ja3_variants": [ "855cbcfca9e144a47733f5947e1a55a1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_e6691373226f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "e6691373226f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-10-35-65037-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790648909, "last_seen": 1790648909, "transport": "t", "ja3_hash": "709b19473a80e29349343b22adbf0cc0", "ja3_variant_count": 1, "ja3_variants": [ "709b19473a80e29349343b22adbf0cc0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_f49448a39853", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "f49448a39853", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-43-51-0-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789883872, "last_seen": 1789883872, "transport": "t", "ja3_hash": "3c4a7309858fdd6983f76b9edd859c11", "ja3_variant_count": 1, "ja3_variants": [ "3c4a7309858fdd6983f76b9edd859c11" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_f9d05b7f00a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "f9d05b7f00a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-18-17613-0-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790435845, "last_seen": 1790435845, "transport": "t", "ja3_hash": "f31bd3184c7959840805298108a3d0e9", "ja3_variant_count": 1, "ja3_variants": [ "f31bd3184c7959840805298108a3d0e9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_ffbaf31f629d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "ffbaf31f629d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-27-13-17613-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790228259, "last_seen": 1790228259, "transport": "t", "ja3_hash": "8815c9411d0f64328389149bd8e5e74d", "ja3_variant_count": 1, "ja3_variants": [ "8815c9411d0f64328389149bd8e5e74d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_1316e5f84d4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "1316e5f84d4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-5-27-43-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789419109, "last_seen": 1789419109, "transport": "t", "ja3_hash": "24f2b45814c951b4b9e689a30b2e406e", "ja3_variant_count": 1, "ja3_variants": [ "24f2b45814c951b4b9e689a30b2e406e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_2271590ce52a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "2271590ce52a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-16-17613-43-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791224403, "last_seen": 1791224403, "transport": "t", "ja3_hash": "bcc08282f53a5e3c72e0ac4c80013c1a", "ja3_variant_count": 1, "ja3_variants": [ "bcc08282f53a5e3c72e0ac4c80013c1a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_4d6d6de5b689", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "4d6d6de5b689", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51764-18-17613-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791120887, "last_seen": 1791120887, "transport": "t", "ja3_hash": "bff27ed6b5018346d7f61187d45345e4", "ja3_variant_count": 1, "ja3_variants": [ "bff27ed6b5018346d7f61187d45345e4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_66d5ebf3d402", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "66d5ebf3d402", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-51-16-23-18-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790230177, "last_seen": 1790230177, "transport": "t", "ja3_hash": "17eb4efd3539ecb81e27b2306860ec65", "ja3_variant_count": 1, "ja3_variants": [ "17eb4efd3539ecb81e27b2306860ec65" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_7260faf23634", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "7260faf23634", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-35-16-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791277920, "last_seen": 1791277920, "transport": "t", "ja3_hash": "89b5771020a4e70e0cc1ab75a8fce16f", "ja3_variant_count": 1, "ja3_variants": [ "89b5771020a4e70e0cc1ab75a8fce16f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_7d807eb1274d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "7d807eb1274d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-65281-17613-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789697327, "last_seen": 1789697327, "transport": "t", "ja3_hash": "a073d720f19910be7e38fddca91c7a45", "ja3_variant_count": 1, "ja3_variants": [ "a073d720f19910be7e38fddca91c7a45" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_ce28e2a9bc50", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "ce28e2a9bc50", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-45-5-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790225216, "last_seen": 1790225216, "transport": "t", "ja3_hash": "7ecdc6e94538c890c064fbc7d34861ed", "ja3_variant_count": 1, "ja3_variants": [ "7ecdc6e94538c890c064fbc7d34861ed" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_e2d0642d3468", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "e2d0642d3468", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-5-0-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789505655, "last_seen": 1789505655, "transport": "t", "ja3_hash": "4c5fe39c1f4dc82fed065af63769f930", "ja3_variant_count": 1, "ja3_variants": [ "4c5fe39c1f4dc82fed065af63769f930" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_f321f6fe1b55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "f321f6fe1b55", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-0-5-16-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788530017, "last_seen": 1788530017, "transport": "t", "ja3_hash": "027af4ab8128bcb94c1bec3f60bdc8d2", "ja3_variant_count": 1, "ja3_variants": [ "027af4ab8128bcb94c1bec3f60bdc8d2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_091b5ffd8da5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "091b5ffd8da5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-13-11-45-43-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789138240, "last_seen": 1789138240, "transport": "t", "ja3_hash": "ed72e7920f586adf65b0f4db48baea44", "ja3_variant_count": 1, "ja3_variants": [ "ed72e7920f586adf65b0f4db48baea44" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_1f7cd0ed21c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "1f7cd0ed21c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-0-65281-43-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788792031, "last_seen": 1788792031, "transport": "t", "ja3_hash": "e5ac03ad04c97ff504942d28205f078f", "ja3_variant_count": 1, "ja3_variants": [ "e5ac03ad04c97ff504942d28205f078f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_206d881c0591", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "206d881c0591", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-10-23-51-43-35-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790517904, "last_seen": 1790517904, "transport": "t", "ja3_hash": "9baaefe45da23923e59fbc615ba8717c", "ja3_variant_count": 1, "ja3_variants": [ "9baaefe45da23923e59fbc615ba8717c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 31 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_27804b92cf38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "27804b92cf38", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-65281-35-5-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789697451, "last_seen": 1789697451, "transport": "t", "ja3_hash": "c66362aa5eec97bee211cdb6479ed66b", "ja3_variant_count": 1, "ja3_variants": [ "c66362aa5eec97bee211cdb6479ed66b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_2909c2a4a072", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "2909c2a4a072", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-11-27-51764-0-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791139508, "last_seen": 1791139508, "transport": "t", "ja3_hash": "ac3e1d337114ff78dfab7f17ec3420a8", "ja3_variant_count": 1, "ja3_variants": [ "ac3e1d337114ff78dfab7f17ec3420a8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_29f92c729ab7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "29f92c729ab7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-23-43-0-65281-18-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790214497, "last_seen": 1790214497, "transport": "t", "ja3_hash": "5dafdbc11d7d126d6ab347d602cc13b3", "ja3_variant_count": 1, "ja3_variants": [ "5dafdbc11d7d126d6ab347d602cc13b3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_2bedaf58f8f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "2bedaf58f8f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-43-65037-35-5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788875540, "last_seen": 1788875540, "transport": "t", "ja3_hash": "dc352fcdc9c09937903b9e8241028f97", "ja3_variant_count": 1, "ja3_variants": [ "dc352fcdc9c09937903b9e8241028f97" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_30b6c24c6f83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "30b6c24c6f83", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-0-51-23-43-45-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790604952, "last_seen": 1790604952, "transport": "t", "ja3_hash": "b937294fc43b8bb5a74c3f97dff68294", "ja3_variant_count": 1, "ja3_variants": [ "b937294fc43b8bb5a74c3f97dff68294" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_3523741b4817", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "3523741b4817", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-43-45-23-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791008327, "last_seen": 1791008327, "transport": "t", "ja3_hash": "3ecc48e4fe0dbe29933b69785e511cf9", "ja3_variant_count": 1, "ja3_variants": [ "3ecc48e4fe0dbe29933b69785e511cf9" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_39e4abd14154", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "39e4abd14154", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-65281-13-65037-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788850315, "last_seen": 1788850315, "transport": "t", "ja3_hash": "393d89fbf9119458318ddec4c4676a92", "ja3_variant_count": 1, "ja3_variants": [ "393d89fbf9119458318ddec4c4676a92" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_3c1d35c4ea2e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "3c1d35c4ea2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-27-18-0-65037-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788777981, "last_seen": 1788777981, "transport": "t", "ja3_hash": "9b62561b6e7162678a9d426b0b4456e7", "ja3_variant_count": 1, "ja3_variants": [ "9b62561b6e7162678a9d426b0b4456e7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_46333065d5e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "46333065d5e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-13-17613-0-65281-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789848491, "last_seen": 1789848491, "transport": "t", "ja3_hash": "acadc26dfd63569c55b6aa17f3662aab", "ja3_variant_count": 1, "ja3_variants": [ "acadc26dfd63569c55b6aa17f3662aab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_55eb3265fc76", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "55eb3265fc76", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-23-11-0-51-18-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790542602, "last_seen": 1790542602, "transport": "t", "ja3_hash": "1b3b10ae89ad90adfd37e1d30d76d0ee", "ja3_variant_count": 1, "ja3_variants": [ "1b3b10ae89ad90adfd37e1d30d76d0ee" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 2 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_5bafd1a579bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "5bafd1a579bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-0-11-45-35-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788889114, "last_seen": 1788889114, "transport": "t", "ja3_hash": "42589ac23df7ce7cf1eb1fa06e8f9ae4", "ja3_variant_count": 1, "ja3_variants": [ "42589ac23df7ce7cf1eb1fa06e8f9ae4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_5edb5201e160", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "5edb5201e160", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-11-65037-17613-0-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789707036, "last_seen": 1789707036, "transport": "t", "ja3_hash": "43d640e44b331dcf0a9788d9db3c72e8", "ja3_variant_count": 1, "ja3_variants": [ "43d640e44b331dcf0a9788d9db3c72e8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_6091238c22fb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "6091238c22fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-43-65281-0-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790223757, "last_seen": 1790223757, "transport": "t", "ja3_hash": "d1e3fa64476a6d38ebddf00119387fb1", "ja3_variant_count": 1, "ja3_variants": [ "d1e3fa64476a6d38ebddf00119387fb1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_69ecb552dea4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "69ecb552dea4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-35-18-43-17613-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789108591, "last_seen": 1789108591, "transport": "t", "ja3_hash": "850d736b9e0c2b6ebfd93d59d0f2ae7b", "ja3_variant_count": 1, "ja3_variants": [ "850d736b9e0c2b6ebfd93d59d0f2ae7b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_767151cc9c05", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "767151cc9c05", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-65037-0-11-10-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791135546, "last_seen": 1791135546, "transport": "t", "ja3_hash": "046f60390d22ddeed43b3fcd5e82d845", "ja3_variant_count": 1, "ja3_variants": [ "046f60390d22ddeed43b3fcd5e82d845" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_776b4972314e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "776b4972314e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-43-5-0-65037-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788604987, "last_seen": 1788604987, "transport": "t", "ja3_hash": "fad937961f3f54d413c36f5e6f55cf98", "ja3_variant_count": 1, "ja3_variants": [ "fad937961f3f54d413c36f5e6f55cf98" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_779bc2c1004e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "779bc2c1004e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-0-11-10-5-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791128426, "last_seen": 1791128426, "transport": "t", "ja3_hash": "1eb26439fde5a7dbf4660917ae3dc734", "ja3_variant_count": 1, "ja3_variants": [ "1eb26439fde5a7dbf4660917ae3dc734" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_7bc938ec63f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "7bc938ec63f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-45-23-43-27-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788820893, "last_seen": 1788820893, "transport": "t", "ja3_hash": "a004c3641186a09fcf06fe39176c2ba8", "ja3_variant_count": 1, "ja3_variants": [ "a004c3641186a09fcf06fe39176c2ba8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_84c53e67bb69", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "84c53e67bb69", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-35-65281-43-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790820186, "last_seen": 1790820186, "transport": "t", "ja3_hash": "ccd41b5425efd5d82664bb5701bddde5", "ja3_variant_count": 1, "ja3_variants": [ "ccd41b5425efd5d82664bb5701bddde5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_8911d70b4bc4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "8911d70b4bc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-0-35-65037-18-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790089144, "last_seen": 1790089144, "transport": "t", "ja3_hash": "72a84d30e80693c79847b0a94198d3cc", "ja3_variant_count": 1, "ja3_variants": [ "72a84d30e80693c79847b0a94198d3cc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_8b200a1390a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "8b200a1390a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-23-10-43-0-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788991200, "last_seen": 1788991200, "transport": "t", "ja3_hash": "e399e07c784dee65bf7d1202092532be", "ja3_variant_count": 1, "ja3_variants": [ "e399e07c784dee65bf7d1202092532be" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_9134e9012544", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "9134e9012544", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-23-0-13-35-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790245728, "last_seen": 1790245728, "transport": "t", "ja3_hash": "c50e812302e0ba8dda0698aefc08d7fd", "ja3_variant_count": 1, "ja3_variants": [ "c50e812302e0ba8dda0698aefc08d7fd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_94a0ca49cedf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "94a0ca49cedf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-45-65037-17613-43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790218098, "last_seen": 1790218098, "transport": "t", "ja3_hash": "988d7a1570c6c2a38629dd26fcb7046a", "ja3_variant_count": 1, "ja3_variants": [ "988d7a1570c6c2a38629dd26fcb7046a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_9c20bd7c798d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "9c20bd7c798d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-5-45-23-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524377, "last_seen": 1790524377, "transport": "t", "ja3_hash": "a3d9bfe6330695e8d57402d8278c48c5", "ja3_variant_count": 1, "ja3_variants": [ "a3d9bfe6330695e8d57402d8278c48c5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_a31a3607aba1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "a31a3607aba1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-43-17613-0-51-35-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811259, "last_seen": 1788811259, "transport": "t", "ja3_hash": "772fbc266e1400be8602c00512425a97", "ja3_variant_count": 1, "ja3_variants": [ "772fbc266e1400be8602c00512425a97" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_a4c1aa2a9521", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "a4c1aa2a9521", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-65037-45-65281-18-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789415651, "last_seen": 1789415651, "transport": "t", "ja3_hash": "7ae3205f38e51e8753da6d3945018b63", "ja3_variant_count": 1, "ja3_variants": [ "7ae3205f38e51e8753da6d3945018b63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_a55082b2dbb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "a55082b2dbb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-10-0-11-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790662722, "last_seen": 1790662722, "transport": "t", "ja3_hash": "c1a5db1333e17cc1d610b18d598ad22c", "ja3_variant_count": 1, "ja3_variants": [ "c1a5db1333e17cc1d610b18d598ad22c" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_ada14649382f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "ada14649382f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-51-11-0-43-65281-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791298642, "last_seen": 1791298642, "transport": "t", "ja3_hash": "4788f7c8801297fa9b8025b0f930fcfd", "ja3_variant_count": 1, "ja3_variants": [ "4788f7c8801297fa9b8025b0f930fcfd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_b1cc12118d2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "b1cc12118d2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-5-0-43-45-51-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790169810, "last_seen": 1790169810, "transport": "t", "ja3_hash": "938020b38f38c8f54841473f94f2918d", "ja3_variant_count": 1, "ja3_variants": [ "938020b38f38c8f54841473f94f2918d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_b3ca4e5e7e8c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "b3ca4e5e7e8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-10-0-45-23-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552992, "last_seen": 1788552992, "transport": "t", "ja3_hash": "977dffb09be8306aabd83cc39706f6d3", "ja3_variant_count": 1, "ja3_variants": [ "977dffb09be8306aabd83cc39706f6d3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_b6a789b2bdd8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "b6a789b2bdd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-43-13-23-45-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790980746, "last_seen": 1790980746, "transport": "t", "ja3_hash": "feb6dc825371c919f604e93ff4a8f078", "ja3_variant_count": 1, "ja3_variants": [ "feb6dc825371c919f604e93ff4a8f078" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_b950b2b20b0c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "b950b2b20b0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-45-0-35-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790515071, "last_seen": 1790515071, "transport": "t", "ja3_hash": "54f4d41406a8ce05e5772d5edbe84dce", "ja3_variant_count": 1, "ja3_variants": [ "54f4d41406a8ce05e5772d5edbe84dce" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.7390.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_be23ae07a5c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "be23ae07a5c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-17613-43-23-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790696196, "last_seen": 1790696196, "transport": "t", "ja3_hash": "b75ee7b14bc6751dd649b201b8c47293", "ja3_variant_count": 1, "ja3_variants": [ "b75ee7b14bc6751dd649b201b8c47293" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_c1309e771f53", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "c1309e771f53", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-0-65037-27-65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789977541, "last_seen": 1789977541, "transport": "t", "ja3_hash": "86d43e91f46f0c8e24a78aee89e80453", "ja3_variant_count": 1, "ja3_variants": [ "86d43e91f46f0c8e24a78aee89e80453" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_c2c06f8b0d7f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "c2c06f8b0d7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-0-11-10-23-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790243920, "last_seen": 1790243920, "transport": "t", "ja3_hash": "1fb1fcd55443186fc7eaaf4d014bd358", "ja3_variant_count": 1, "ja3_variants": [ "1fb1fcd55443186fc7eaaf4d014bd358" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_cb271997266a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "cb271997266a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-27-18-45-51-11-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788833625, "last_seen": 1788833625, "transport": "t", "ja3_hash": "bcfa7caa59e5d9b114cdf1ff4a871416", "ja3_variant_count": 1, "ja3_variants": [ "bcfa7caa59e5d9b114cdf1ff4a871416" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_cc7ba10103f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "cc7ba10103f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-5-0-10-45-43-23,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788724239, "last_seen": 1788724239, "transport": "t", "ja3_hash": "241b46aee87b7caed08b9a9acc8691d6", "ja3_variant_count": 1, "ja3_variants": [ "241b46aee87b7caed08b9a9acc8691d6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_cd228004deee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "cd228004deee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-18-51764-0-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790799458, "last_seen": 1790799458, "transport": "t", "ja3_hash": "37f835ea7942406511c228a31e4a2dfb", "ja3_variant_count": 1, "ja3_variants": [ "37f835ea7942406511c228a31e4a2dfb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_d3b842ac4282", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "d3b842ac4282", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-23-51-43-18-65281-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789735699, "last_seen": 1789735699, "transport": "t", "ja3_hash": "4ef461a943b659f67a504e134b55701d", "ja3_variant_count": 1, "ja3_variants": [ "4ef461a943b659f67a504e134b55701d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_ddd4087cbd28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "ddd4087cbd28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-17613-23-5-43-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202870, "last_seen": 1790202870, "transport": "t", "ja3_hash": "50ca854aa93bdf8216456b23728bb147", "ja3_variant_count": 1, "ja3_variants": [ "50ca854aa93bdf8216456b23728bb147" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_f2b873672f1e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "f2b873672f1e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-35-18-10-65281-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791224746, "last_seen": 1791224746, "transport": "t", "ja3_hash": "b463be74e587ab77a80119e24f33a49c", "ja3_variant_count": 1, "ja3_variants": [ "b463be74e587ab77a80119e24f33a49c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_fc0c48139dc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "fc0c48139dc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-43-0-45-35-65281-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790547391, "last_seen": 1790547391, "transport": "t", "ja3_hash": "96295a287e82cab52c4e403bc3faf7f5", "ja3_variant_count": 1, "ja3_variants": [ "96295a287e82cab52c4e403bc3faf7f5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h1_8daaf6152771_0994449af5c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h1", "b": "8daaf6152771", "c": "0994449af5c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-10-0-16-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790672750, "last_seen": 1790672750, "transport": "t", "ja3_hash": "e9157e310c57d03c433e11f9b5294ebb", "ja3_variant_count": 1, "ja3_variants": [ "e9157e310c57d03c433e11f9b5294ebb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h1_8daaf6152771_9594c35119a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h1", "b": "8daaf6152771", "c": "9594c35119a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-0-18-27-16-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790568308, "last_seen": 1790568308, "transport": "t", "ja3_hash": "bad0a9fdd8e9b738f8d96605750a9195", "ja3_variant_count": 1, "ja3_variants": [ "bad0a9fdd8e9b738f8d96605750a9195" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_18b0f3bd0406", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "18b0f3bd0406", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-0-43-16-35-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790794646, "last_seen": 1790794646, "transport": "t", "ja3_hash": "917fa7662bb8e6d9f027b4afea933df0", "ja3_variant_count": 1, "ja3_variants": [ "917fa7662bb8e6d9f027b4afea933df0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_1b0694017cad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "1b0694017cad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-43-16-65281-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790590149, "last_seen": 1790590149, "transport": "t", "ja3_hash": "8773db590fbd77f2db9843937c30f1cc", "ja3_variant_count": 1, "ja3_variants": [ "8773db590fbd77f2db9843937c30f1cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_2b1b717fecc9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "2b1b717fecc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-43-0-27-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790236340, "last_seen": 1790236340, "transport": "t", "ja3_hash": "1beee98ef4e623565815ef9533a4d4ec", "ja3_variant_count": 1, "ja3_variants": [ "1beee98ef4e623565815ef9533a4d4ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_2f61be931617", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "2f61be931617", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-27-0-43-17613-16-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790383627, "last_seen": 1790383627, "transport": "t", "ja3_hash": "705b902a87f95211f45f4785f234fd07", "ja3_variant_count": 1, "ja3_variants": [ "705b902a87f95211f45f4785f234fd07" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_386d3a552a71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "386d3a552a71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-23-43-18-16-27-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788811257, "last_seen": 1788811257, "transport": "t", "ja3_hash": "cb1f8985e61283a17e8e3358767e3dc6", "ja3_variant_count": 1, "ja3_variants": [ "cb1f8985e61283a17e8e3358767e3dc6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_4df71e9dd28d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "4df71e9dd28d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-0-35-65037-16-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790747902, "last_seen": 1790747902, "transport": "t", "ja3_hash": "83aed22ac086235e7da7c8f9009094f4", "ja3_variant_count": 1, "ja3_variants": [ "83aed22ac086235e7da7c8f9009094f4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_5988f37d4d60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "5988f37d4d60", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-43-16-45-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791142798, "last_seen": 1791142798, "transport": "t", "ja3_hash": "a35538dc8ba8134a629bc52f88657ca4", "ja3_variant_count": 1, "ja3_variants": [ "a35538dc8ba8134a629bc52f88657ca4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_647822cbe0b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "647822cbe0b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-0-23-18-43-51-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789651386, "last_seen": 1789651386, "transport": "t", "ja3_hash": "58ac40f8170f91af53fe3ac1b3e5a592", "ja3_variant_count": 1, "ja3_variants": [ "58ac40f8170f91af53fe3ac1b3e5a592" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_700e7196a7bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "700e7196a7bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-11-43-23-27-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788625329, "last_seen": 1788625329, "transport": "t", "ja3_hash": "387611f6320ea86d26bdfeb660ba08cc", "ja3_variant_count": 1, "ja3_variants": [ "387611f6320ea86d26bdfeb660ba08cc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_7851be5e4c25", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "7851be5e4c25", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-0-45-43-35-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790212934, "last_seen": 1790212934, "transport": "t", "ja3_hash": "85df6042431cdad1261eba7f3876640f", "ja3_variant_count": 1, "ja3_variants": [ "85df6042431cdad1261eba7f3876640f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_7dd074c0a900", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "7dd074c0a900", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-43-10-0-18-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788856453, "last_seen": 1788856453, "transport": "t", "ja3_hash": "7a9f2cbc3621a1e9ed85e1b7a0776c77", "ja3_variant_count": 1, "ja3_variants": [ "7a9f2cbc3621a1e9ed85e1b7a0776c77" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_7f5d081c707b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "7f5d081c707b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-18-5-16-43-11-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790199918, "last_seen": 1790199918, "transport": "t", "ja3_hash": "a26185a36b6097ddad2c25a5d33a35e5", "ja3_variant_count": 1, "ja3_variants": [ "a26185a36b6097ddad2c25a5d33a35e5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_9d614a51b9d3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "9d614a51b9d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-16-18-51764-0-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791120625, "last_seen": 1791120625, "transport": "t", "ja3_hash": "5df3d457dffa96c6cc82af0089a47631", "ja3_variant_count": 1, "ja3_variants": [ "5df3d457dffa96c6cc82af0089a47631" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_b962d1331ca8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "b962d1331ca8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-65037-0-23-16-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790185333, "last_seen": 1790185333, "transport": "t", "ja3_hash": "48f03626fa1958cd21df2880e05f0c04", "ja3_variant_count": 1, "ja3_variants": [ "48f03626fa1958cd21df2880e05f0c04" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_c0d2f195bc20", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "c0d2f195bc20", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789146027, "last_seen": 1790777402, "transport": "t", "ja3_hash": "442b3545972f2507309b65d26bea590e", "ja3_variant_count": 1, "ja3_variants": [ "442b3545972f2507309b65d26bea590e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_d886d2cd99b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "d886d2cd99b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-65037-45-43-35-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791132330, "last_seen": 1791132330, "transport": "t", "ja3_hash": "6b13f630008d95ccb90eee58c2ce1267", "ja3_variant_count": 1, "ja3_variants": [ "6b13f630008d95ccb90eee58c2ce1267" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_de2ff867fc75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "de2ff867fc75", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-0-65281-16-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790166218, "last_seen": 1790166218, "transport": "t", "ja3_hash": "b9a201a529c3c597f597f7404e0866ae", "ja3_variant_count": 1, "ja3_variants": [ "b9a201a529c3c597f597f7404e0866ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_e71f9423e6e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "e71f9423e6e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-17613-16-0-35-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790256298, "last_seen": 1790256298, "transport": "t", "ja3_hash": "f2a383ca592ab4dbfc46566b1c8e1f31", "ja3_variant_count": 1, "ja3_variants": [ "f2a383ca592ab4dbfc46566b1c8e1f31" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_f4690e350745", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "f4690e350745", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 220, "first_seen": 1787519933, "last_seen": 1790682811, "transport": "t", "ja3_hash": "afe8d9ad42fcbd57b861ac2c485fab64", "ja3_variant_count": 1, "ja3_variants": [ "afe8d9ad42fcbd57b861ac2c485fab64" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 655, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1850, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_fe38c72f67b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "fe38c72f67b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-16-35-65281-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790942394, "last_seen": 1790942394, "transport": "t", "ja3_hash": "cdb080e704e26079d1e694cfce49f8de", "ja3_variant_count": 1, "ja3_variants": [ "cdb080e704e26079d1e694cfce49f8de" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_ff3c0ed93428", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "ff3c0ed93428", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-16-65037-18-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789014997, "last_seen": 1789014997, "transport": "t", "ja3_hash": "7f04035fc12337ce2f145cc302ea1eff", "ja3_variant_count": 1, "ja3_variants": [ "7f04035fc12337ce2f145cc302ea1eff" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_01ed16fe7a24", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "01ed16fe7a24", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-45-43-65281-27-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788841762, "last_seen": 1788841762, "transport": "t", "ja3_hash": "1eb079dccd727c93adc7366b6724db75", "ja3_variant_count": 1, "ja3_variants": [ "1eb079dccd727c93adc7366b6724db75" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_0a3264aeb8ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "0a3264aeb8ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-10-5-13-27-0-51-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791118526, "last_seen": 1791118526, "transport": "t", "ja3_hash": "a8a478697b2c0a47e58174afc18a03fc", "ja3_variant_count": 1, "ja3_variants": [ "a8a478697b2c0a47e58174afc18a03fc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_177a6b31bbf9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "177a6b31bbf9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-45-0-23-27-10-18-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789635413, "last_seen": 1789635413, "transport": "t", "ja3_hash": "c9dbd9824136bb0e82677ea864e8a496", "ja3_variant_count": 1, "ja3_variants": [ "c9dbd9824136bb0e82677ea864e8a496" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_197f2773653f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "197f2773653f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-35-65281-23-65037-11-51-0-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790941752, "last_seen": 1790941752, "transport": "t", "ja3_hash": "77117f1d3a87baa76909a8b301935a72", "ja3_variant_count": 1, "ja3_variants": [ "77117f1d3a87baa76909a8b301935a72" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_1f0fa7178733", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "1f0fa7178733", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-11-45-27-65037-43-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750233, "last_seen": 1789750233, "transport": "t", "ja3_hash": "f65fb479d4a81a901c05c3d7776d2bb4", "ja3_variant_count": 1, "ja3_variants": [ "f65fb479d4a81a901c05c3d7776d2bb4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_2a4e2de53331", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "2a4e2de53331", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-0-65281-13-5-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790223532, "last_seen": 1790223532, "transport": "t", "ja3_hash": "7155908a0b2efe2131fde2c383969c4e", "ja3_variant_count": 1, "ja3_variants": [ "7155908a0b2efe2131fde2c383969c4e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_2d8b4f23cbf9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "2d8b4f23cbf9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-0-27-45-51-23-43-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024334, "last_seen": 1789024334, "transport": "t", "ja3_hash": "e0143f07c4730aa3803112a00905769d", "ja3_variant_count": 1, "ja3_variants": [ "e0143f07c4730aa3803112a00905769d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_3139a3fc29c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "3139a3fc29c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-10-13-51764-5-0-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789751585, "last_seen": 1789751585, "transport": "t", "ja3_hash": "2c42b65c965bd4f467029591eb8c1cdc", "ja3_variant_count": 1, "ja3_variants": [ "2c42b65c965bd4f467029591eb8c1cdc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_33b5fa156c07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "33b5fa156c07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-17613-18-13-27-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789898052, "last_seen": 1789898052, "transport": "t", "ja3_hash": "1ca03e42d7cfa24b984d9c0702f6ab46", "ja3_variant_count": 1, "ja3_variants": [ "1ca03e42d7cfa24b984d9c0702f6ab46" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_3a04e7b8d729", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "3a04e7b8d729", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-0-13-11-65037-27-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790529943, "last_seen": 1790529943, "transport": "t", "ja3_hash": "2d7e7aad7bc095f1b429f75a16fca8d6", "ja3_variant_count": 1, "ja3_variants": [ "2d7e7aad7bc095f1b429f75a16fca8d6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_44f5f8581b9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "44f5f8581b9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-0-17613-65037-43-10-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790138384, "last_seen": 1790138384, "transport": "t", "ja3_hash": "e4e8a867005a70e4f6289f4ab557ecd6", "ja3_variant_count": 1, "ja3_variants": [ "e4e8a867005a70e4f6289f4ab557ecd6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_48f25b789641", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "48f25b789641", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-18-35-0-43-51-5-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790656031, "last_seen": 1790656031, "transport": "t", "ja3_hash": "f6155f6174e1801009ba940f23be3cf1", "ja3_variant_count": 1, "ja3_variants": [ "f6155f6174e1801009ba940f23be3cf1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_4dc97e6a0c4a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "4dc97e6a0c4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-43-17513-51-35-18-11-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791285422, "last_seen": 1791285422, "transport": "t", "ja3_hash": "89f5d2397d0e48dab6a9418d6a319e86", "ja3_variant_count": 1, "ja3_variants": [ "89f5d2397d0e48dab6a9418d6a319e86" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_4e9f51966537", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "4e9f51966537", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-13-45-5-23-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789058939, "last_seen": 1789058939, "transport": "t", "ja3_hash": "df703f5b3124a35017d407b2138e3c9e", "ja3_variant_count": 1, "ja3_variants": [ "df703f5b3124a35017d407b2138e3c9e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_50eed6e31992", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "50eed6e31992", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-0-45-5-18-23-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790536521, "last_seen": 1790536521, "transport": "t", "ja3_hash": "c1db1b593c1cf09d9917da52e753f316", "ja3_variant_count": 1, "ja3_variants": [ "c1db1b593c1cf09d9917da52e753f316" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_54bdc124d96d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "54bdc124d96d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-65037-45-23-43-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789022587, "last_seen": 1789022587, "transport": "t", "ja3_hash": "2542f9232cf5b7bb07ff7c8ba006e58a", "ja3_variant_count": 1, "ja3_variants": [ "2542f9232cf5b7bb07ff7c8ba006e58a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_60a117a20f13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "60a117a20f13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-10-11-43-18-13-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790526434, "last_seen": 1790526434, "transport": "t", "ja3_hash": "20f0fcc6c38580c9d4c5ad0e8881acd2", "ja3_variant_count": 1, "ja3_variants": [ "20f0fcc6c38580c9d4c5ad0e8881acd2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_60dcc1284d2b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "60dcc1284d2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-13-0-17613-43-65037-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788771529, "last_seen": 1790178966, "transport": "t", "ja3_hash": "9f3ce1dc47ccc64ff783e887461f8040", "ja3_variant_count": 2, "ja3_variants": [ "9f3ce1dc47ccc64ff783e887461f8040", "f7171a198e969df6fe36177aa3734944" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_6eae12bf6194", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "6eae12bf6194", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-27-45-0-43-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789008714, "last_seen": 1789701456, "transport": "t", "ja3_hash": "610df90204c1e30a48b368db71478421", "ja3_variant_count": 2, "ja3_variants": [ "610df90204c1e30a48b368db71478421", "01d8bb400fc1aabd4cc849ed857d6b01" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_71dbd31b7ec0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "71dbd31b7ec0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-0-13-43-35-65037-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790258376, "last_seen": 1790258376, "transport": "t", "ja3_hash": "5f32d35d7f3b2edcb4b1ed0e69f63049", "ja3_variant_count": 1, "ja3_variants": [ "5f32d35d7f3b2edcb4b1ed0e69f63049" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_76cf14b67fc5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "76cf14b67fc5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-23-65281-27-0-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790172945, "last_seen": 1790172945, "transport": "t", "ja3_hash": "cc4434248efff86ae054b12bfac8467d", "ja3_variant_count": 1, "ja3_variants": [ "cc4434248efff86ae054b12bfac8467d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_790431388602", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "790431388602", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-65037-0-27-45-43-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790541454, "last_seen": 1790541454, "transport": "t", "ja3_hash": "c2bf9a6e6c57bfd8032d077427ebb3af", "ja3_variant_count": 1, "ja3_variants": [ "c2bf9a6e6c57bfd8032d077427ebb3af" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_7acf5cc4c480", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "7acf5cc4c480", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-65281-35-5-51-45-27-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789381286, "last_seen": 1789381286, "transport": "t", "ja3_hash": "a3faa30823c40d9c50db0bbb13f902ea", "ja3_variant_count": 1, "ja3_variants": [ "a3faa30823c40d9c50db0bbb13f902ea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_7e3c2fd65945", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "7e3c2fd65945", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51764-43-65281-5-0-45-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790457831, "last_seen": 1790457831, "transport": "t", "ja3_hash": "fd6c357bee1dea1d8a93e3bbbdde2f82", "ja3_variant_count": 1, "ja3_variants": [ "fd6c357bee1dea1d8a93e3bbbdde2f82" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_8a8763b36db7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "8a8763b36db7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-27-11-0-18-17613-51-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789253274, "last_seen": 1789253274, "transport": "t", "ja3_hash": "64128570dabc9a738ef1ac89e7dcd184", "ja3_variant_count": 1, "ja3_variants": [ "64128570dabc9a738ef1ac89e7dcd184" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Safari/605.1.15": 2 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_8cd72475b5b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "8cd72475b5b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-51-11-10-17513-0-43-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790945520, "last_seen": 1790945520, "transport": "t", "ja3_hash": "a02eafcc1787b52783d36a733df59bd4", "ja3_variant_count": 1, "ja3_variants": [ "a02eafcc1787b52783d36a733df59bd4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_8ec4dc607cb1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "8ec4dc607cb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-43-10-0-51764-65037-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791229394, "last_seen": 1791229394, "transport": "t", "ja3_hash": "6291f2c4e3a3f0914c6bbdbfeef211f6", "ja3_variant_count": 1, "ja3_variants": [ "6291f2c4e3a3f0914c6bbdbfeef211f6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_8fa7efba754c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "8fa7efba754c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-23-5-65037-0-17613-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790313005, "last_seen": 1790313005, "transport": "t", "ja3_hash": "b390ba1d13bfc885e1e5c4cb4461899e", "ja3_variant_count": 1, "ja3_variants": [ "b390ba1d13bfc885e1e5c4cb4461899e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 18, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_9299e92064c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "9299e92064c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-0-23-10-43-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789966794, "last_seen": 1789966794, "transport": "t", "ja3_hash": "bc6fe27022bf1553f8c82944333e618e", "ja3_variant_count": 1, "ja3_variants": [ "bc6fe27022bf1553f8c82944333e618e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_a01b5f01320b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "a01b5f01320b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-65281-45-0-18-27-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791015029, "last_seen": 1791015029, "transport": "t", "ja3_hash": "30a47ffcd20f58bc8f5cf938ddad9a19", "ja3_variant_count": 1, "ja3_variants": [ "30a47ffcd20f58bc8f5cf938ddad9a19" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_a6bbba6632b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "a6bbba6632b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-65037-43-0-13-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790791613, "last_seen": 1790791613, "transport": "t", "ja3_hash": "6f23a567b09d272a32ce4b22164d9d15", "ja3_variant_count": 1, "ja3_variants": [ "6f23a567b09d272a32ce4b22164d9d15" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_a83a7c8280ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "a83a7c8280ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-23-43-45-65281-13-5-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789163949, "last_seen": 1789163949, "transport": "t", "ja3_hash": "72fe3645ead2001614243607e0256a98", "ja3_variant_count": 1, "ja3_variants": [ "72fe3645ead2001614243607e0256a98" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_a98bbcc5bc28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "a98bbcc5bc28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-17613-43-23-27-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789214368, "last_seen": 1789214368, "transport": "t", "ja3_hash": "4eb0d4b41b4ac6dfe052c195f7fc2bd8", "ja3_variant_count": 1, "ja3_variants": [ "4eb0d4b41b4ac6dfe052c195f7fc2bd8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_ad5424c46727", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "ad5424c46727", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-27-65037-35-43-5-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788825779, "last_seen": 1788825779, "transport": "t", "ja3_hash": "b1e44f9777eaaaefe162274174de37d8", "ja3_variant_count": 1, "ja3_variants": [ "b1e44f9777eaaaefe162274174de37d8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_ae7534c0c424", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "ae7534c0c424", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-0-11-17613-65281-27-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789096316, "last_seen": 1789096316, "transport": "t", "ja3_hash": "74f7c72479b5dbf09dd6052bf9cf21d2", "ja3_variant_count": 1, "ja3_variants": [ "74f7c72479b5dbf09dd6052bf9cf21d2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_b6b443f6192d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "b6b443f6192d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-5-35-10-43-65037-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789693034, "last_seen": 1789693034, "transport": "t", "ja3_hash": "409a69b4807d7f0bf27144cb35a44e5d", "ja3_variant_count": 1, "ja3_variants": [ "409a69b4807d7f0bf27144cb35a44e5d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_b88a3a88b36f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "b88a3a88b36f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-65281-51-43-23-10-0-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791134630, "last_seen": 1791134630, "transport": "t", "ja3_hash": "be86a8f8472c6b576dcea0ef74816dc8", "ja3_variant_count": 1, "ja3_variants": [ "be86a8f8472c6b576dcea0ef74816dc8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_c50d23b8a46e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "c50d23b8a46e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-43-0-65037-23-65281-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790228937, "last_seen": 1790228937, "transport": "t", "ja3_hash": "bf3b12b6389bcf5242c07c1b84daa30b", "ja3_variant_count": 1, "ja3_variants": [ "bf3b12b6389bcf5242c07c1b84daa30b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_c901a5b4defe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "c901a5b4defe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-43-65037-0-65281-45-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788807321, "last_seen": 1788807321, "transport": "t", "ja3_hash": "01676dac3b397c9849f86d0c865f4d99", "ja3_variant_count": 1, "ja3_variants": [ "01676dac3b397c9849f86d0c865f4d99" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_db8980ddcf26", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "db8980ddcf26", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-45-10-13-43-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790196605, "last_seen": 1790196605, "transport": "t", "ja3_hash": "10aebf3cc0ff0a1070cc7763157bb72e", "ja3_variant_count": 1, "ja3_variants": [ "10aebf3cc0ff0a1070cc7763157bb72e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_dd98d7aad946", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "dd98d7aad946", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-17613-23-35-0-43-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790803811, "last_seen": 1790803811, "transport": "t", "ja3_hash": "c7b1c68e03ac6d1465248bee289003a6", "ja3_variant_count": 1, "ja3_variants": [ "c7b1c68e03ac6d1465248bee289003a6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.163 Safari/537.36": 32 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_e06a6fa876e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "e06a6fa876e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-45-43-51764-18-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791229698, "last_seen": 1791229698, "transport": "t", "ja3_hash": "704ba0584f1b28a7564f81413c757ed2", "ja3_variant_count": 1, "ja3_variants": [ "704ba0584f1b28a7564f81413c757ed2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_e13d7959d4f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "e13d7959d4f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-17513-18-0-43-65037-65281-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791141180, "last_seen": 1791141180, "transport": "t", "ja3_hash": "0ce70a6a86b4b3e26edccac911cbd3a8", "ja3_variant_count": 1, "ja3_variants": [ "0ce70a6a86b4b3e26edccac911cbd3a8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_e169224a60e8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "e169224a60e8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-43-45-65281-17613-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791178974, "last_seen": 1791178974, "transport": "t", "ja3_hash": "5f36db2fa1a2302a1793324daa77dda0", "ja3_variant_count": 1, "ja3_variants": [ "5f36db2fa1a2302a1793324daa77dda0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_e68c4ed1a086", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "e68c4ed1a086", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-0-35-11-5-43-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789207832, "last_seen": 1789207832, "transport": "t", "ja3_hash": "d6814bf6d02bec6fd7e6d03ecf196860", "ja3_variant_count": 1, "ja3_variants": [ "d6814bf6d02bec6fd7e6d03ecf196860" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_e935b566eaef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "e935b566eaef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-43-35-0-45-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788773208, "last_seen": 1788773208, "transport": "t", "ja3_hash": "5efd5194e4925caa4864fc7765bb3af1", "ja3_variant_count": 1, "ja3_variants": [ "5efd5194e4925caa4864fc7765bb3af1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_ecce13e72081", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "ecce13e72081", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-13-27-17613-43-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790727984, "last_seen": 1790727984, "transport": "t", "ja3_hash": "e473572cfbc847a666aeb4080b2434ab", "ja3_variant_count": 1, "ja3_variants": [ "e473572cfbc847a666aeb4080b2434ab" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_ee422d949c56", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "ee422d949c56", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-10-35-0-43-51-45-5,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790572653, "last_seen": 1790572653, "transport": "t", "ja3_hash": "58744c36e2b3beae8d61b8289f988293", "ja3_variant_count": 1, "ja3_variants": [ "58744c36e2b3beae8d61b8289f988293" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_f25e528dacd2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "f25e528dacd2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-43-5-10-45-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788783135, "last_seen": 1788783135, "transport": "t", "ja3_hash": "22877f7b897c93b1d3cfb70995a1fb47", "ja3_variant_count": 1, "ja3_variants": [ "22877f7b897c93b1d3cfb70995a1fb47" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_f6834d08b84f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "f6834d08b84f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-10-5-43-35-0-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790683709, "last_seen": 1790683709, "transport": "t", "ja3_hash": "4e5d87b6a2a2587c9daa22137d24db25", "ja3_variant_count": 1, "ja3_variants": [ "4e5d87b6a2a2587c9daa22137d24db25" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_f997b03b1f7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "f997b03b1f7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-0-23-18-11-43-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791126960, "last_seen": 1791126960, "transport": "t", "ja3_hash": "c69429cd21ea835df10a129876c00452", "ja3_variant_count": 1, "ja3_variants": [ "c69429cd21ea835df10a129876c00452" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_fe4b9d93d35a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "fe4b9d93d35a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-10-5-43-35-17613-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790183443, "last_seen": 1790183443, "transport": "t", "ja3_hash": "4519b38a28140b1704a7f0d1bb546a34", "ja3_variant_count": 1, "ja3_variants": [ "4519b38a28140b1704a7f0d1bb546a34" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h1_8daaf6152771_e22728ecebd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h1", "b": "8daaf6152771", "c": "e22728ecebd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-23-35-43-5-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790607308, "last_seen": 1790607308, "transport": "t", "ja3_hash": "80e41b33967b5a9ed5533343959f008b", "ja3_variant_count": 1, "ja3_variants": [ "80e41b33967b5a9ed5533343959f008b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_26c67c4d74e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "26c67c4d74e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-45-43-17613-13-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790159017, "last_seen": 1790159017, "transport": "t", "ja3_hash": "55e394196ebb8f337696da292113634b", "ja3_variant_count": 1, "ja3_variants": [ "55e394196ebb8f337696da292113634b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_2896e066ab3c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "2896e066ab3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-18-43-11-45-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790243009, "last_seen": 1790243009, "transport": "t", "ja3_hash": "5d09b4ba2db0f1089d64a387458e5114", "ja3_variant_count": 1, "ja3_variants": [ "5d09b4ba2db0f1089d64a387458e5114" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_29e0a2c968b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "29e0a2c968b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-65281-16-35-5-13-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789010554, "last_seen": 1789010554, "transport": "t", "ja3_hash": "dab0e03ccd37dc2dbb63dbeca63d1454", "ja3_variant_count": 1, "ja3_variants": [ "dab0e03ccd37dc2dbb63dbeca63d1454" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_2b3496e8f2c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "2b3496e8f2c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-16-27-10-18-5-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789689133, "last_seen": 1789689133, "transport": "t", "ja3_hash": "ed307f1da50f716146d941e18aaa5ceb", "ja3_variant_count": 1, "ja3_variants": [ "ed307f1da50f716146d941e18aaa5ceb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_2ec59c7f9baf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "2ec59c7f9baf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-0-65037-16-43-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790234295, "last_seen": 1790234295, "transport": "t", "ja3_hash": "5866ba0cd78be828b05523f97878be7e", "ja3_variant_count": 1, "ja3_variants": [ "5866ba0cd78be828b05523f97878be7e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_38dcca881054", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "38dcca881054", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-5-35-10-13-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790264813, "last_seen": 1790264813, "transport": "t", "ja3_hash": "dad5a57eda16a9671bb923d783f5c2e8", "ja3_variant_count": 1, "ja3_variants": [ "dad5a57eda16a9671bb923d783f5c2e8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_3c74165c1ccf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "3c74165c1ccf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-0-13-43-51-16-17513-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791276883, "last_seen": 1791276883, "transport": "t", "ja3_hash": "b0eb0b168a4eb7438ed776cf2b2526f7", "ja3_variant_count": 1, "ja3_variants": [ "b0eb0b168a4eb7438ed776cf2b2526f7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_45951111fdb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "45951111fdb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-16-45-43-0-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788822990, "last_seen": 1788822990, "transport": "t", "ja3_hash": "765a6d93df82dcdb8018fb20cbb90008", "ja3_variant_count": 1, "ja3_variants": [ "765a6d93df82dcdb8018fb20cbb90008" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_49e7b9e70e8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "49e7b9e70e8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-16-17613-45-5-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789946651, "last_seen": 1789946651, "transport": "t", "ja3_hash": "76b86965623dff497a32511b91913d90", "ja3_variant_count": 1, "ja3_variants": [ "76b86965623dff497a32511b91913d90" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_4a67b33f471c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "4a67b33f471c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-27-43-45-23-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790193855, "last_seen": 1790193855, "transport": "t", "ja3_hash": "b2e7b1732b405bd5c72fee18e424b45a", "ja3_variant_count": 1, "ja3_variants": [ "b2e7b1732b405bd5c72fee18e424b45a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_545fbee21e2c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "545fbee21e2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-16-13-65037-10-5-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788769133, "last_seen": 1788769133, "transport": "t", "ja3_hash": "d3ebd3219ab77c99af8559c287615a70", "ja3_variant_count": 1, "ja3_variants": [ "d3ebd3219ab77c99af8559c287615a70" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_635a2f6ee591", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "635a2f6ee591", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-65281-45-18-23-13-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790196901, "last_seen": 1790196901, "transport": "t", "ja3_hash": "6b6ae2d5d7e4bf79d58c3f8405fbeb21", "ja3_variant_count": 1, "ja3_variants": [ "6b6ae2d5d7e4bf79d58c3f8405fbeb21" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_6fe6cd1bef01", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "6fe6cd1bef01", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-23-16-43-65037-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791233029, "last_seen": 1791233029, "transport": "t", "ja3_hash": "9e83f159ed68950eaaf4f9d59ea7f4bf", "ja3_variant_count": 1, "ja3_variants": [ "9e83f159ed68950eaaf4f9d59ea7f4bf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_714425a3fe8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "714425a3fe8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-16-5-43-0-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788637363, "last_seen": 1788637363, "transport": "t", "ja3_hash": "cc370c0b32864cf25a7041c4a2dd1f25", "ja3_variant_count": 1, "ja3_variants": [ "cc370c0b32864cf25a7041c4a2dd1f25" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_960c9681de8e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "960c9681de8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-35-11-45-13-43-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790273611, "last_seen": 1790273611, "transport": "t", "ja3_hash": "8c5d22936c34820ad6e8d7de7216f5be", "ja3_variant_count": 1, "ja3_variants": [ "8c5d22936c34820ad6e8d7de7216f5be" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_9e1f89c7a490", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "9e1f89c7a490", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-27-65281-16-51764-0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791240104, "last_seen": 1791240104, "transport": "t", "ja3_hash": "fa33830b08403f1cb2c1e598d8fe256d", "ja3_variant_count": 1, "ja3_variants": [ "fa33830b08403f1cb2c1e598d8fe256d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_a141c742da45", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "a141c742da45", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-27-13-43-16-18-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790571716, "last_seen": 1790571716, "transport": "t", "ja3_hash": "9639362af00ee58d62f9983a887ff3ed", "ja3_variant_count": 1, "ja3_variants": [ "9639362af00ee58d62f9983a887ff3ed" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_a40e8493d471", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "a40e8493d471", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-23-65281-65037-27-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791135415, "last_seen": 1791135415, "transport": "t", "ja3_hash": "0cbb8baf01b721342f62b111e1e71fc2", "ja3_variant_count": 1, "ja3_variants": [ "0cbb8baf01b721342f62b111e1e71fc2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_b9905d84783f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "b9905d84783f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-11-16-0-18-43-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791077427, "last_seen": 1791077427, "transport": "t", "ja3_hash": "cb7f5c715d9237bf7affc7b0c8914a4e", "ja3_variant_count": 1, "ja3_variants": [ "cb7f5c715d9237bf7affc7b0c8914a4e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_c55430d3dd35", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "c55430d3dd35", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790984782, "last_seen": 1790984782, "transport": "t", "ja3_hash": "d1a7003a6b293c1097cfa3e8b32d2558", "ja3_variant_count": 1, "ja3_variants": [ "d1a7003a6b293c1097cfa3e8b32d2558" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 59 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_c8feaab0560c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "c8feaab0560c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-43-65281-11-35-5-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790801830, "last_seen": 1790801830, "transport": "t", "ja3_hash": "76977f8f4c06ec567344ca9fd9554c2a", "ja3_variant_count": 1, "ja3_variants": [ "76977f8f4c06ec567344ca9fd9554c2a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.6.2 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_d00fbc7e2486", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "d00fbc7e2486", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-43-17613-10-16-45-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788846271, "last_seen": 1788846271, "transport": "t", "ja3_hash": "2983a2a0fa6c6ab0bd451d75f15b662d", "ja3_variant_count": 1, "ja3_variants": [ "2983a2a0fa6c6ab0bd451d75f15b662d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_d2d94938909d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "d2d94938909d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-35-17613-0-16-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789384905, "last_seen": 1789384905, "transport": "t", "ja3_hash": "d797f6add7d458660212391fd5f4caae", "ja3_variant_count": 1, "ja3_variants": [ "d797f6add7d458660212391fd5f4caae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 48 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_db33ea47f560", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "db33ea47f560", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-0-65281-23-18-5-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790228219, "last_seen": 1790228219, "transport": "t", "ja3_hash": "eaeddcd0e824ab329132230b175b5fae", "ja3_variant_count": 1, "ja3_variants": [ "eaeddcd0e824ab329132230b175b5fae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_eb0a6af672b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "eb0a6af672b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-23-0-11-43-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790211012, "last_seen": 1790211012, "transport": "t", "ja3_hash": "94dbe705b1cae8368d648debdd359a4c", "ja3_variant_count": 1, "ja3_variants": [ "94dbe705b1cae8368d648debdd359a4c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_f042f3584f2b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "f042f3584f2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-43-27-16-11-45-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790228223, "last_seen": 1790228223, "transport": "t", "ja3_hash": "b4565072c71ac4ca7e1d9766cf5377ea", "ja3_variant_count": 1, "ja3_variants": [ "b4565072c71ac4ca7e1d9766cf5377ea" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_07a58f455bf8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "07a58f455bf8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-43-13-10-27-51-45-18-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791261407, "last_seen": 1791261407, "transport": "t", "ja3_hash": "44629d84772aa7d77531a54a2d0a3c50", "ja3_variant_count": 1, "ja3_variants": [ "44629d84772aa7d77531a54a2d0a3c50" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_0a19e4678e5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "0a19e4678e5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-65037-13-0-23-18-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789637716, "last_seen": 1789637716, "transport": "t", "ja3_hash": "db02292e094947c2d6d0e1bb5d5c33a8", "ja3_variant_count": 1, "ja3_variants": [ "db02292e094947c2d6d0e1bb5d5c33a8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_0fb015de9b9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "0fb015de9b9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-13-17613-11-0-43-23-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789729311, "last_seen": 1789729311, "transport": "t", "ja3_hash": "44e16dead07fdc1da591cfbaa7d57374", "ja3_variant_count": 1, "ja3_variants": [ "44e16dead07fdc1da591cfbaa7d57374" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_1d9debc5e393", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "1d9debc5e393", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-5-65037-10-35-45-0-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790431946, "last_seen": 1790431946, "transport": "t", "ja3_hash": "1dc1a4e3a93fff7f611f3067e6a8b702", "ja3_variant_count": 1, "ja3_variants": [ "1dc1a4e3a93fff7f611f3067e6a8b702" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_2143c1fcf86a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "2143c1fcf86a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-43-18-10-11-23-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790238493, "last_seen": 1790238493, "transport": "t", "ja3_hash": "68efec313a88485279d50b08aefeaa4a", "ja3_variant_count": 1, "ja3_variants": [ "68efec313a88485279d50b08aefeaa4a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_2350e164a227", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "2350e164a227", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-65037-45-43-35-10-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790446439, "last_seen": 1790446439, "transport": "t", "ja3_hash": "e46602190077a107dfe4b2df967bf5bc", "ja3_variant_count": 1, "ja3_variants": [ "e46602190077a107dfe4b2df967bf5bc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.175 Safari/537.36": 28 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_2ca7c56ca825", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "2ca7c56ca825", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-0-13-10-65281-5-65037-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791298278, "last_seen": 1791298278, "transport": "t", "ja3_hash": "a54e5404fe774ad28c26bf9c3ddd0024", "ja3_variant_count": 1, "ja3_variants": [ "a54e5404fe774ad28c26bf9c3ddd0024" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_2fe042fdfdb5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "2fe042fdfdb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-0-13-35-27-23-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790240515, "last_seen": 1790240515, "transport": "t", "ja3_hash": "b1a38f56658741ad8357a165ed8f16b6", "ja3_variant_count": 1, "ja3_variants": [ "b1a38f56658741ad8357a165ed8f16b6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_312153169968", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "312153169968", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-51-18-23-27-65281-43-17613-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789543661, "last_seen": 1789543661, "transport": "t", "ja3_hash": "7de2139fce87380092800063c8915a3a", "ja3_variant_count": 1, "ja3_variants": [ "7de2139fce87380092800063c8915a3a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 78 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_3794b70954a2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "3794b70954a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-5-10-43-11-65037-13-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790531514, "last_seen": 1790531514, "transport": "t", "ja3_hash": "acf100c5887a65127da467cd6358e751", "ja3_variant_count": 1, "ja3_variants": [ "acf100c5887a65127da467cd6358e751" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_439bde0fe37e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "439bde0fe37e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-18-65281-13-10-45-0-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788829533, "last_seen": 1788829533, "transport": "t", "ja3_hash": "0a475ec9a651e730b6abf64c46b662ab", "ja3_variant_count": 1, "ja3_variants": [ "0a475ec9a651e730b6abf64c46b662ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_4a0388bde464", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "4a0388bde464", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-23-5-13-45-0-27-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790083139, "last_seen": 1790083139, "transport": "t", "ja3_hash": "b7086e6bf81f9209a006aa71d983ce90", "ja3_variant_count": 1, "ja3_variants": [ "b7086e6bf81f9209a006aa71d983ce90" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 40 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_4d054ab18a02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "4d054ab18a02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-18-0-13-43-65281-65037-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790515994, "last_seen": 1791110332, "transport": "t", "ja3_hash": "9c3d26f02e1850c73ae4e19e47323d0e", "ja3_variant_count": 2, "ja3_variants": [ "9c3d26f02e1850c73ae4e19e47323d0e", "77c73f808227d77f206fea5a9a2f7f15" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_62049aba77a8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "62049aba77a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-18-65281-0-11-45-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791184176, "last_seen": 1791184176, "transport": "t", "ja3_hash": "57de1e5a57199e1f4c73389dcc454a63", "ja3_variant_count": 1, "ja3_variants": [ "57de1e5a57199e1f4c73389dcc454a63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_66dcd6b4dce9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "66dcd6b4dce9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-13-43-18-17613-11-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790743561, "last_seen": 1790743561, "transport": "t", "ja3_hash": "5c707ece30270505f038561f6e7ad546", "ja3_variant_count": 1, "ja3_variants": [ "5c707ece30270505f038561f6e7ad546" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_670a174695a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "670a174695a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-43-23-10-13-45-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789653249, "last_seen": 1789653249, "transport": "t", "ja3_hash": "f37a6b0dd0a35a536d2e1b6e9f949a60", "ja3_variant_count": 1, "ja3_variants": [ "f37a6b0dd0a35a536d2e1b6e9f949a60" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_6897ef1a2cda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "6897ef1a2cda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-65037-17613-13-5-0-65281-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790879668, "last_seen": 1790879668, "transport": "t", "ja3_hash": "a3bcff59e967dfefb7c5d3376fcbe75f", "ja3_variant_count": 1, "ja3_variants": [ "a3bcff59e967dfefb7c5d3376fcbe75f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_6e2f93b60b2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "6e2f93b60b2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-27-43-5-35-18-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790876549, "last_seen": 1790876549, "transport": "t", "ja3_hash": "8d513e167b2dad8543f119ea9ec3b974", "ja3_variant_count": 1, "ja3_variants": [ "8d513e167b2dad8543f119ea9ec3b974" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_6ec2f00538fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "6ec2f00538fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-11-45-65037-18-17613-43-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790832407, "last_seen": 1790832407, "transport": "t", "ja3_hash": "efb3bf2667ddb2ddc5585f4d689c9ff2", "ja3_variant_count": 1, "ja3_variants": [ "efb3bf2667ddb2ddc5585f4d689c9ff2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_7c8bf02b2b19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "7c8bf02b2b19", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-10-45-11-43-5-0-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788800430, "last_seen": 1788800430, "transport": "t", "ja3_hash": "bda3173455605a4dc0936aeab84e11c9", "ja3_variant_count": 1, "ja3_variants": [ "bda3173455605a4dc0936aeab84e11c9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_87ef5b343047", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "87ef5b343047", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-65281-18-35-43-11-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790529443, "last_seen": 1790529443, "transport": "t", "ja3_hash": "c2d9ef4b4de3387bfea786703a4a440e", "ja3_variant_count": 1, "ja3_variants": [ "c2d9ef4b4de3387bfea786703a4a440e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_887d147055c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "887d147055c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-0-11-35-27-43-18-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790536397, "last_seen": 1790536397, "transport": "t", "ja3_hash": "79f99019142a7ea011c13a0eb5e546b5", "ja3_variant_count": 1, "ja3_variants": [ "79f99019142a7ea011c13a0eb5e546b5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_9c8446d3a3aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "9c8446d3a3aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-43-65281-13-27-10-23-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790226633, "last_seen": 1790226633, "transport": "t", "ja3_hash": "695d1826daf4223bf33e5137b71e5e79", "ja3_variant_count": 1, "ja3_variants": [ "695d1826daf4223bf33e5137b71e5e79" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_a859a99fb925", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "a859a99fb925", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-0-13-43-11-35-23-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788848128, "last_seen": 1788848128, "transport": "t", "ja3_hash": "97440e2282d4987906903f446ea68275", "ja3_variant_count": 1, "ja3_variants": [ "97440e2282d4987906903f446ea68275" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_a9fc2cfb70dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "a9fc2cfb70dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-0-65281-11-23-18-43-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788763596, "last_seen": 1788763596, "transport": "t", "ja3_hash": "3d1e801b650b006c39351d727660d88a", "ja3_variant_count": 1, "ja3_variants": [ "3d1e801b650b006c39351d727660d88a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_aefab1b5c69c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "aefab1b5c69c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-11-35-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 157, "first_seen": 1787501957, "last_seen": 1791275427, "transport": "t", "ja3_hash": "773454095eae22d82b441a3d5fd38f2c", "ja3_variant_count": 1, "ja3_variants": [ "773454095eae22d82b441a3d5fd38f2c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 150, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_b1d8b2d7768c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "b1d8b2d7768c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-11-43-51-18-45-27-0-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788646496, "last_seen": 1788646496, "transport": "t", "ja3_hash": "ddc7cc2a98f0e6d2425e64dcc8ea3bdf", "ja3_variant_count": 1, "ja3_variants": [ "ddc7cc2a98f0e6d2425e64dcc8ea3bdf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_b7b15d02aced", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "b7b15d02aced", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-5-27-10-51764-13-0-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790711580, "last_seen": 1790711580, "transport": "t", "ja3_hash": "4a77b64405a32b8e437de8eef1f5b1b6", "ja3_variant_count": 1, "ja3_variants": [ "4a77b64405a32b8e437de8eef1f5b1b6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_c17802dd9d2f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "c17802dd9d2f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-23-43-5-11-17613-18-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788777733, "last_seen": 1788777733, "transport": "t", "ja3_hash": "ba3c493808b22ada0954b65361495ef5", "ja3_variant_count": 1, "ja3_variants": [ "ba3c493808b22ada0954b65361495ef5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_c47219fbd6dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "c47219fbd6dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-17613-65037-23-0-43-5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791129477, "last_seen": 1791129477, "transport": "t", "ja3_hash": "b7e95bad2a5e852a62fe204f99b7c112", "ja3_variant_count": 1, "ja3_variants": [ "b7e95bad2a5e852a62fe204f99b7c112" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_c7956fbd5a3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "c7956fbd5a3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-17613-10-5-18-11-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789811524, "last_seen": 1789811524, "transport": "t", "ja3_hash": "bdf9040637621a3e39e2fbee1ac682dd", "ja3_variant_count": 1, "ja3_variants": [ "bdf9040637621a3e39e2fbee1ac682dd" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 4 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_cc6f402e9645", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "cc6f402e9645", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-65037-10-43-65281-0-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788766527, "last_seen": 1788766527, "transport": "t", "ja3_hash": "04d0450fa6b0d33bc60092949343d0a8", "ja3_variant_count": 1, "ja3_variants": [ "04d0450fa6b0d33bc60092949343d0a8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_cc966371b891", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "cc966371b891", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-65037-43-27-11-35-18-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789139670, "last_seen": 1789139670, "transport": "t", "ja3_hash": "a906e342f80447ed893a331087b37683", "ja3_variant_count": 1, "ja3_variants": [ "a906e342f80447ed893a331087b37683" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_cd3b10793836", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "cd3b10793836", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-35-0-43-18-13-27-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790215954, "last_seen": 1790215954, "transport": "t", "ja3_hash": "d9e884d3e8d352e6320ef990c4c2ac51", "ja3_variant_count": 1, "ja3_variants": [ "d9e884d3e8d352e6320ef990c4c2ac51" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_ce9115b133e8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "ce9115b133e8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-0-5-35-23-11-18-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788823618, "last_seen": 1788823618, "transport": "t", "ja3_hash": "fd4a9e71844daaa8143087deeb1365ef", "ja3_variant_count": 1, "ja3_variants": [ "fd4a9e71844daaa8143087deeb1365ef" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 20 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_df2c812e45a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "df2c812e45a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-43-23-27-10-35-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788889493, "last_seen": 1788889493, "transport": "t", "ja3_hash": "2c7b5ee47a8784024e6b4860b2c47e60", "ja3_variant_count": 1, "ja3_variants": [ "2c7b5ee47a8784024e6b4860b2c47e60" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_e090d4e4a727", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "e090d4e4a727", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-45-27-11-43-13-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789118203, "last_seen": 1789118203, "transport": "t", "ja3_hash": "a642b4118a27a1bba7bc171a7881a4fa", "ja3_variant_count": 1, "ja3_variants": [ "a642b4118a27a1bba7bc171a7881a4fa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_e6d2f66b5ddd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "e6d2f66b5ddd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-43-11-27-23-45-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789235993, "last_seen": 1789235993, "transport": "t", "ja3_hash": "a7346a297bccb3880825c8976b4fd98d", "ja3_variant_count": 1, "ja3_variants": [ "a7346a297bccb3880825c8976b4fd98d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 269 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_eb93eb8da10c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "eb93eb8da10c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-23-17613-43-10-5-13-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791119383, "last_seen": 1791119383, "transport": "t", "ja3_hash": "21f822df1b8e9000e9c7ad234fb8006b", "ja3_variant_count": 1, "ja3_variants": [ "21f822df1b8e9000e9c7ad234fb8006b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_fd3fae43409d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "fd3fae43409d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-0-65281-5-43-45-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789199759, "last_seen": 1789199759, "transport": "t", "ja3_hash": "8c1cfc81ff454f18a7537c1f3fd8a084", "ja3_variant_count": 1, "ja3_variants": [ "8c1cfc81ff454f18a7537c1f3fd8a084" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1510h1_8daaf6152771_5903c7656303", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h1", "b": "8daaf6152771", "c": "5903c7656303", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-43-10-35-23-0-27-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790537476, "last_seen": 1790537476, "transport": "t", "ja3_hash": "d547104ebc8c7f29c42c6e567f022017", "ja3_variant_count": 1, "ja3_variants": [ "d547104ebc8c7f29c42c6e567f022017" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h1_8daaf6152771_6d624ac144fb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h1", "b": "8daaf6152771", "c": "6d624ac144fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-16-0-27-5-10-45-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524989, "last_seen": 1790524989, "transport": "t", "ja3_hash": "994505932e004a1bd3af0f6347ebd484", "ja3_variant_count": 1, "ja3_variants": [ "994505932e004a1bd3af0f6347ebd484" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h1_8daaf6152771_750b78383c24", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h1", "b": "8daaf6152771", "c": "750b78383c24", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-65281-0-65037-16-43-45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790558209, "last_seen": 1790558209, "transport": "t", "ja3_hash": "946d567a3cd2cedd600e042547b87a3b", "ja3_variant_count": 1, "ja3_variants": [ "946d567a3cd2cedd600e042547b87a3b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h1_8daaf6152771_ace23962264e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h1", "b": "8daaf6152771", "c": "ace23962264e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-0-43-45-11-10-35-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790529751, "last_seen": 1790529751, "transport": "t", "ja3_hash": "78d22560d122a6bae16b220d6f3d359f", "ja3_variant_count": 1, "ja3_variants": [ "78d22560d122a6bae16b220d6f3d359f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h1_8daaf6152771_b3f912660ba6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h1", "b": "8daaf6152771", "c": "b3f912660ba6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65037-10-35-18-43-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790531873, "last_seen": 1790531873, "transport": "t", "ja3_hash": "cf82a5571f4dffde79cf88a1687047eb", "ja3_variant_count": 1, "ja3_variants": [ "cf82a5571f4dffde79cf88a1687047eb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h1_8daaf6152771_d51220cda6f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h1", "b": "8daaf6152771", "c": "d51220cda6f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-11-18-43-65037-0-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790998461, "last_seen": 1790998461, "transport": "t", "ja3_hash": "594fcc4fd50b37c5e46830ea75cc994d", "ja3_variant_count": 1, "ja3_variants": [ "594fcc4fd50b37c5e46830ea75cc994d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_0097c4617540", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "0097c4617540", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-16-43-18-65037-0-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788787065, "last_seen": 1788787065, "transport": "t", "ja3_hash": "9619dcf06874686c882cc9c9dd891641", "ja3_variant_count": 1, "ja3_variants": [ "9619dcf06874686c882cc9c9dd891641" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_021e0fe6f61b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "021e0fe6f61b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-27-45-10-23-43-0-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790728002, "last_seen": 1790728002, "transport": "t", "ja3_hash": "6c93a491da8852f0a1f28e7ec3134a98", "ja3_variant_count": 1, "ja3_variants": [ "6c93a491da8852f0a1f28e7ec3134a98" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_024097c4f251", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "024097c4f251", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51-65281-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1078, "first_seen": 1787519932, "last_seen": 1791228705, "transport": "t", "ja3_hash": "f93e221ff54567d63c32136b7f1b40a2", "ja3_variant_count": 2, "ja3_variants": [ "f93e221ff54567d63c32136b7f1b40a2", "c2d6ee96a384947ed9ffab9aea3ecc5b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 77, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2053, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_1a8d7b53d35d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "1a8d7b53d35d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-11-18-43-5-65037-0-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790517783, "last_seen": 1790517783, "transport": "t", "ja3_hash": "773f1f5a5535d18679a741458ea2560d", "ja3_variant_count": 1, "ja3_variants": [ "773f1f5a5535d18679a741458ea2560d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_1caa804f6aed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "1caa804f6aed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-27-35-43-65281-18-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789070268, "last_seen": 1789070268, "transport": "t", "ja3_hash": "60f3ab1cefc6b46be7615b217179703c", "ja3_variant_count": 1, "ja3_variants": [ "60f3ab1cefc6b46be7615b217179703c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_224276210b97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "224276210b97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-0-23-65037-16-18-27-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788703784, "last_seen": 1788703784, "transport": "t", "ja3_hash": "6f1bf0c5c237576e4b373df02090dbb8", "ja3_variant_count": 1, "ja3_variants": [ "6f1bf0c5c237576e4b373df02090dbb8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_295aa345bde1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "295aa345bde1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-16-10-45-17613-65281-43-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790234604, "last_seen": 1790234604, "transport": "t", "ja3_hash": "a86a3a8fdab10564618ba6658462aacd", "ja3_variant_count": 1, "ja3_variants": [ "a86a3a8fdab10564618ba6658462aacd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_3268242b94ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3268242b94ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-0-43-10-16-5-65037-11-51-27,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791107860, "last_seen": 1791107860, "transport": "t", "ja3_hash": "621112f89ff39c7eb1e2b6883d4d11b6", "ja3_variant_count": 1, "ja3_variants": [ "621112f89ff39c7eb1e2b6883d4d11b6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_3820c08d9b29", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3820c08d9b29", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-65281-0-16-27-43-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788782098, "last_seen": 1788782098, "transport": "t", "ja3_hash": "9a65e65a9cd82c022d2a25ed8bb05f86", "ja3_variant_count": 1, "ja3_variants": [ "9a65e65a9cd82c022d2a25ed8bb05f86" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_385f0cf05797", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "385f0cf05797", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-13-5-43-0-17613-16-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789752922, "last_seen": 1789752922, "transport": "t", "ja3_hash": "47f2f51e42897cc32b7595a006d8573b", "ja3_variant_count": 1, "ja3_variants": [ "47f2f51e42897cc32b7595a006d8573b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_38c56a134c36", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "38c56a134c36", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-27-18-11-16-35-0-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791110329, "last_seen": 1791110329, "transport": "t", "ja3_hash": "8e5d0a17be52ae74cbc76cebb7f418cb", "ja3_variant_count": 1, "ja3_variants": [ "8e5d0a17be52ae74cbc76cebb7f418cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_3a1d51480ecd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3a1d51480ecd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-5-27-23-0-35-10-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790433808, "last_seen": 1790433808, "transport": "t", "ja3_hash": "1fdc126cee3a1336e3d42b6381171831", "ja3_variant_count": 1, "ja3_variants": [ "1fdc126cee3a1336e3d42b6381171831" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_3b99283b1712", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3b99283b1712", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-65281-11-13-35-43-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790233528, "last_seen": 1790233528, "transport": "t", "ja3_hash": "f7b46a17bde157c7a14733ee832ec149", "ja3_variant_count": 1, "ja3_variants": [ "f7b46a17bde157c7a14733ee832ec149" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_3efca25bb031", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3efca25bb031", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-27-11-16-65281-65037-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790534906, "last_seen": 1790534906, "transport": "t", "ja3_hash": "2527fdcd754061d3c17d306e3b5432ae", "ja3_variant_count": 1, "ja3_variants": [ "2527fdcd754061d3c17d306e3b5432ae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_49ea69128b21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "49ea69128b21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,16-11-43-35-18-0-17613-5-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789719613, "last_seen": 1789719613, "transport": "t", "ja3_hash": "78620f19f5f4a482e16e8706adba800d", "ja3_variant_count": 1, "ja3_variants": [ "78620f19f5f4a482e16e8706adba800d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_4fd8e575f8d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "4fd8e575f8d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-10-45-18-35-16-65281-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790238234, "last_seen": 1790238234, "transport": "t", "ja3_hash": "e6e7c6e5e598ad525943f7b8270a634a", "ja3_variant_count": 1, "ja3_variants": [ "e6e7c6e5e598ad525943f7b8270a634a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_50374a1ad581", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "50374a1ad581", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-0-18-10-5-43-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790074692, "last_seen": 1790074692, "transport": "t", "ja3_hash": "ed0ebe6e27ab9ea8e45053702c043efe", "ja3_variant_count": 1, "ja3_variants": [ "ed0ebe6e27ab9ea8e45053702c043efe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_5cc8e47cb800", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "5cc8e47cb800", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51-65281-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 88, "first_seen": 1787693730, "last_seen": 1790810310, "transport": "t", "ja3_hash": "f2fa9ccaf82656bb0fe6560cff4b0e69", "ja3_variant_count": 1, "ja3_variants": [ "f2fa9ccaf82656bb0fe6560cff4b0e69" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 861 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_6257c8789e6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "6257c8789e6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-10-43-11-0-65037-16-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790778981, "last_seen": 1790778981, "transport": "t", "ja3_hash": "d2699b0f734bdfb655baee49ca126328", "ja3_variant_count": 1, "ja3_variants": [ "d2699b0f734bdfb655baee49ca126328" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_671ac21c53f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "671ac21c53f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-27-10-45-65281-13-23-16-43,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791291463, "last_seen": 1791291463, "transport": "t", "ja3_hash": "ac90f899afe354e206feb73aaf2c5d4d", "ja3_variant_count": 1, "ja3_variants": [ "ac90f899afe354e206feb73aaf2c5d4d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_6ba760eed02f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "6ba760eed02f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-18-43-16-13-0-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789912221, "last_seen": 1789912221, "transport": "t", "ja3_hash": "24fdc59b94956f0cdc7f261cde76a6b5", "ja3_variant_count": 1, "ja3_variants": [ "24fdc59b94956f0cdc7f261cde76a6b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_73c5745ef636", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "73c5745ef636", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-16-10-35-23-27-43-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790158155, "last_seen": 1790158155, "transport": "t", "ja3_hash": "7ed0d40232cd9eca335a4a2b60010e9c", "ja3_variant_count": 1, "ja3_variants": [ "7ed0d40232cd9eca335a4a2b60010e9c" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_763cee2d13aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "763cee2d13aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-43-13-65037-0-16-65281-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788459869, "last_seen": 1788459869, "transport": "t", "ja3_hash": "7396dbd7a58c01bcecc16d2e3dcca373", "ja3_variant_count": 1, "ja3_variants": [ "7396dbd7a58c01bcecc16d2e3dcca373" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_7738f8652c44", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "7738f8652c44", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-18-13-17613-35-45-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788644546, "last_seen": 1788644546, "transport": "t", "ja3_hash": "415ff11702c0092f74244f4bd2d6af15", "ja3_variant_count": 1, "ja3_variants": [ "415ff11702c0092f74244f4bd2d6af15" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_7b036783c0c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "7b036783c0c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-10-23-51764-65281-16-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790239951, "last_seen": 1790239951, "transport": "t", "ja3_hash": "75f6d1f4e40e5b38c0d181419d69e6bd", "ja3_variant_count": 1, "ja3_variants": [ "75f6d1f4e40e5b38c0d181419d69e6bd" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_7c9ee44981df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "7c9ee44981df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51764-65037-16-0-13-27-43-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790702411, "last_seen": 1790702411, "transport": "t", "ja3_hash": "98bcad5edf2ef99b894891ab48b15833", "ja3_variant_count": 1, "ja3_variants": [ "98bcad5edf2ef99b894891ab48b15833" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_883fda694c53", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "883fda694c53", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-16-13-10-43-51-0-35-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791150833, "last_seen": 1791150833, "transport": "t", "ja3_hash": "6bae610574cdd8094f7004d6cd457291", "ja3_variant_count": 1, "ja3_variants": [ "6bae610574cdd8094f7004d6cd457291" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_8a6fc4fba0ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "8a6fc4fba0ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-0-35-18-13-43-16-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790233627, "last_seen": 1790233627, "transport": "t", "ja3_hash": "e3fb39c8ecfc2735671f0a014c0049ef", "ja3_variant_count": 1, "ja3_variants": [ "e3fb39c8ecfc2735671f0a014c0049ef" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_8cb294dcfa71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "8cb294dcfa71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-23-10-0-16-43-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788832106, "last_seen": 1788832106, "transport": "t", "ja3_hash": "7fa7e35972c0509a2a8f8abaa1337243", "ja3_variant_count": 1, "ja3_variants": [ "7fa7e35972c0509a2a8f8abaa1337243" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_936529a29ab0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "936529a29ab0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-65281-45-13-35-65037-0-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790801724, "last_seen": 1790801724, "transport": "t", "ja3_hash": "0059538800512f58b429d7107ea938dc", "ja3_variant_count": 1, "ja3_variants": [ "0059538800512f58b429d7107ea938dc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_95ab6350f31e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "95ab6350f31e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-23-13-27-0-65037-43-35-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790941770, "last_seen": 1790941770, "transport": "t", "ja3_hash": "74201d697c2327a0e5344d383cdc5c98", "ja3_variant_count": 1, "ja3_variants": [ "74201d697c2327a0e5344d383cdc5c98" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_962d460064af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "962d460064af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-5-11-43-65281-0-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789843707, "last_seen": 1789843707, "transport": "t", "ja3_hash": "c8da74970829fa20950f476a204ff685", "ja3_variant_count": 1, "ja3_variants": [ "c8da74970829fa20950f476a204ff685" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_9d48eeabca4d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "9d48eeabca4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-13-43-18-10-0-17613-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457561, "last_seen": 1789457561, "transport": "t", "ja3_hash": "e4e8dc203d6b19005b861d05b91b5b41", "ja3_variant_count": 1, "ja3_variants": [ "e4e8dc203d6b19005b861d05b91b5b41" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_a30789231c8b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "a30789231c8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-65281-43-11-16-10-13-0-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791142252, "last_seen": 1791142252, "transport": "t", "ja3_hash": "8f89f68a6dc05aacfc506dcabbcbe250", "ja3_variant_count": 1, "ja3_variants": [ "8f89f68a6dc05aacfc506dcabbcbe250" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_ab42972b873b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "ab42972b873b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-16-65281-10-65037-43-17613-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791032233, "last_seen": 1791032233, "transport": "t", "ja3_hash": "1fbeb1749b603a4bb5246571db36804a", "ja3_variant_count": 1, "ja3_variants": [ "1fbeb1749b603a4bb5246571db36804a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 26 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_afc7d8ac0217", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "afc7d8ac0217", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-35-45-65037-5-65281-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790690789, "last_seen": 1790690789, "transport": "t", "ja3_hash": "c6e2db4c7301e4399c38db707f719915", "ja3_variant_count": 1, "ja3_variants": [ "c6e2db4c7301e4399c38db707f719915" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_be1782c892b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "be1782c892b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-35-65037-43-0-10-45-13-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791152897, "last_seen": 1791152897, "transport": "t", "ja3_hash": "45a4e4356433f57cde22d74096b158dd", "ja3_variant_count": 1, "ja3_variants": [ "45a4e4356433f57cde22d74096b158dd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_c3bd72be5ba3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "c3bd72be5ba3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-0-10-16-11-13-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789681815, "last_seen": 1789681815, "transport": "t", "ja3_hash": "6752ee8930e6e12d597a4f1e1e353947", "ja3_variant_count": 1, "ja3_variants": [ "6752ee8930e6e12d597a4f1e1e353947" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_c8b7a43fbf54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "c8b7a43fbf54", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-0-43-35-23-27-17613-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789064036, "last_seen": 1789064036, "transport": "t", "ja3_hash": "e7fb42f5c55de5eeb0ef490347f6f1fd", "ja3_variant_count": 1, "ja3_variants": [ "e7fb42f5c55de5eeb0ef490347f6f1fd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_cd9215fcbba7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "cd9215fcbba7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-23-65281-0-5-43-16-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788781375, "last_seen": 1788781375, "transport": "t", "ja3_hash": "8b0037f6ce5efb3b5b7fddb7ff79f54a", "ja3_variant_count": 1, "ja3_variants": [ "8b0037f6ce5efb3b5b7fddb7ff79f54a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_cde3186e70e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "cde3186e70e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-10-13-5-43-65037-45-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790594535, "last_seen": 1790594535, "transport": "t", "ja3_hash": "6220dc4b48365f49661c42f8ee6d613c", "ja3_variant_count": 1, "ja3_variants": [ "6220dc4b48365f49661c42f8ee6d613c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_d25ddb0b6289", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "d25ddb0b6289", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17513-45-0-16-23-65281-35-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791088734, "last_seen": 1791088734, "transport": "t", "ja3_hash": "ee53f0eda73d76f0b3ed51af923dd0b5", "ja3_variant_count": 1, "ja3_variants": [ "ee53f0eda73d76f0b3ed51af923dd0b5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_db8841e39bab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "db8841e39bab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-43-13-16-17513-11-0-65037-23,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791290763, "last_seen": 1791290763, "transport": "t", "ja3_hash": "c410973eff5863d0037474cd3af25126", "ja3_variant_count": 1, "ja3_variants": [ "c410973eff5863d0037474cd3af25126" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_e5d1eea1ea95", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "e5d1eea1ea95", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-27-0-11-45-35-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790227022, "last_seen": 1790227022, "transport": "t", "ja3_hash": "b1d85419edbee7547922838817a1ffff", "ja3_variant_count": 1, "ja3_variants": [ "b1d85419edbee7547922838817a1ffff" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_e7bc5fedc20c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "e7bc5fedc20c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-5-11-18-65037-0-43-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790265760, "last_seen": 1790265760, "transport": "t", "ja3_hash": "6d7bff024e247e215e147e4d20a03d1f", "ja3_variant_count": 1, "ja3_variants": [ "6d7bff024e247e215e147e4d20a03d1f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_eaa8c95d3238", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "eaa8c95d3238", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-45-16-17513-0-43-65037-11-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791103107, "last_seen": 1791103107, "transport": "t", "ja3_hash": "cf9fbb9d76a6ccacc16cc58d2af99aba", "ja3_variant_count": 1, "ja3_variants": [ "cf9fbb9d76a6ccacc16cc58d2af99aba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_eacebce271aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "eacebce271aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-35-18-43-65037-27-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791122019, "last_seen": 1791122019, "transport": "t", "ja3_hash": "ba1ea490d7a22b4cce3c245c2aeeb4fc", "ja3_variant_count": 1, "ja3_variants": [ "ba1ea490d7a22b4cce3c245c2aeeb4fc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_f037a32b9ade", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "f037a32b9ade", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-17613-18-23-43-65281-65037-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788990720, "last_seen": 1788990720, "transport": "t", "ja3_hash": "4d53bb470815e341cf4b3ba47a7a3fb2", "ja3_variant_count": 1, "ja3_variants": [ "4d53bb470815e341cf4b3ba47a7a3fb2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_f72166f4b89a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "f72166f4b89a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-11-10-45-16-18-13-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790237740, "last_seen": 1790237740, "transport": "t", "ja3_hash": "fe8b66be047fb30750e8c615d721c6a8", "ja3_variant_count": 1, "ja3_variants": [ "fe8b66be047fb30750e8c615d721c6a8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_07f1a9fa2d24", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "07f1a9fa2d24", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-13-5-11-43-27-65281-0-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789006243, "last_seen": 1789006243, "transport": "t", "ja3_hash": "8492575f30280d6fad895e3f88ddd4f8", "ja3_variant_count": 1, "ja3_variants": [ "8492575f30280d6fad895e3f88ddd4f8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_0b839a8cf517", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "0b839a8cf517", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-65281-27-17613-43-23-65037-11-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791050849, "last_seen": 1791050849, "transport": "t", "ja3_hash": "f83e2948ea6acf643b2719d4167cbe2a", "ja3_variant_count": 1, "ja3_variants": [ "f83e2948ea6acf643b2719d4167cbe2a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_1e75d25c99ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "1e75d25c99ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-13-65281-0-45-35-11-43-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788962539, "last_seen": 1788962539, "transport": "t", "ja3_hash": "7e5105887edfc262e807dea19e8958d3", "ja3_variant_count": 1, "ja3_variants": [ "7e5105887edfc262e807dea19e8958d3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_2279ae24c2c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "2279ae24c2c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-27-35-23-10-11-45-43-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790658640, "last_seen": 1790658640, "transport": "t", "ja3_hash": "7b34f7c60707447834fa273a7b46c3f5", "ja3_variant_count": 1, "ja3_variants": [ "7b34f7c60707447834fa273a7b46c3f5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 6 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_22e24e9b3e8f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "22e24e9b3e8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-17613-0-65037-27-13-45-43-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789651387, "last_seen": 1789651387, "transport": "t", "ja3_hash": "32dbd9d1d69d3b6535fd4c3e24f4f8b8", "ja3_variant_count": 1, "ja3_variants": [ "32dbd9d1d69d3b6535fd4c3e24f4f8b8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_3540b99cfaec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "3540b99cfaec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-5-45-11-65037-0-51764-13-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790860058, "last_seen": 1790860058, "transport": "t", "ja3_hash": "5437216311f3b31dfb2a5e713c650768", "ja3_variant_count": 1, "ja3_variants": [ "5437216311f3b31dfb2a5e713c650768" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d151100_8daaf6152771_37d19c2a8beb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "37d19c2a8beb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-5-43-10-13-11-0-27-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790323932, "last_seen": 1790323932, "transport": "t", "ja3_hash": "0a10a236cf9b5cc483b2c722f3f94c60", "ja3_variant_count": 1, "ja3_variants": [ "0a10a236cf9b5cc483b2c722f3f94c60" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_3c150d2331e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "3c150d2331e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-65037-18-11-35-0-43-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791102906, "last_seen": 1791126449, "transport": "t", "ja3_hash": "e956133cfbfa49009e7e065ba6474a98", "ja3_variant_count": 2, "ja3_variants": [ "e956133cfbfa49009e7e065ba6474a98", "ce3ac382e65a69f84e3b90b7cb854a94" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_536f4a11b565", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "536f4a11b565", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-65281-0-5-27-18-43-51-23-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790267396, "last_seen": 1790267396, "transport": "t", "ja3_hash": "77cebf1367eded82ba5a477d3142de9f", "ja3_variant_count": 1, "ja3_variants": [ "77cebf1367eded82ba5a477d3142de9f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_54071b22e800", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "54071b22e800", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-65281-43-11-27-65037-0-23-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790757267, "last_seen": 1790757267, "transport": "t", "ja3_hash": "d561a6f87ea8354485133e78f1199070", "ja3_variant_count": 1, "ja3_variants": [ "d561a6f87ea8354485133e78f1199070" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_5bf8ac3f66fb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "5bf8ac3f66fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17513-43-51-11-18-23-5-10-0-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791148331, "last_seen": 1791148331, "transport": "t", "ja3_hash": "3b56f1457fabbc35cad1d4de1ae9e509", "ja3_variant_count": 1, "ja3_variants": [ "3b56f1457fabbc35cad1d4de1ae9e509" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_6ce39561f363", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "6ce39561f363", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-0-45-27-43-65281-13-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790152377, "last_seen": 1790152377, "transport": "t", "ja3_hash": "8673f1b893d88b62134a4cd398d7ca90", "ja3_variant_count": 1, "ja3_variants": [ "8673f1b893d88b62134a4cd398d7ca90" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_70abe2ec39bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "70abe2ec39bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-10-65037-43-17613-0-45-13-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791132329, "last_seen": 1791132329, "transport": "t", "ja3_hash": "653df76003e06d484c5265fa7d74011c", "ja3_variant_count": 1, "ja3_variants": [ "653df76003e06d484c5265fa7d74011c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_78abf8a7a398", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "78abf8a7a398", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-11-43-13-0-65037-18-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788803632, "last_seen": 1788803632, "transport": "t", "ja3_hash": "1ab82e57977c6e2db27a47400c60b11f", "ja3_variant_count": 1, "ja3_variants": [ "1ab82e57977c6e2db27a47400c60b11f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_7d5c04c6d6fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "7d5c04c6d6fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-5-65281-43-45-0-18-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789148315, "last_seen": 1789148315, "transport": "t", "ja3_hash": "7aafab82dc63f83cc4e11ce54bb59b39", "ja3_variant_count": 1, "ja3_variants": [ "7aafab82dc63f83cc4e11ce54bb59b39" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_7e4601712cea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "7e4601712cea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-18-13-10-45-43-65037-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791041844, "last_seen": 1791041844, "transport": "t", "ja3_hash": "7865d5e231bd6d8c37875530dd5acb3a", "ja3_variant_count": 1, "ja3_variants": [ "7865d5e231bd6d8c37875530dd5acb3a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_7e982064af61", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "7e982064af61", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-0-23-13-65281-17513-43-27-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790961165, "last_seen": 1790961165, "transport": "t", "ja3_hash": "79c602e6db0104df0c7d0e17541745d2", "ja3_variant_count": 1, "ja3_variants": [ "79c602e6db0104df0c7d0e17541745d2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_7fb2619fd4e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "7fb2619fd4e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-11-23-13-43-17613-5-18-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790238233, "last_seen": 1790238233, "transport": "t", "ja3_hash": "43e6788a5c5307bbaba7d8208d70341b", "ja3_variant_count": 1, "ja3_variants": [ "43e6788a5c5307bbaba7d8208d70341b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_8c20a4fdc6b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "8c20a4fdc6b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-18-13-43-65037-35-5-27-17513-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791260810, "last_seen": 1791260810, "transport": "t", "ja3_hash": "3c85986a787f1cd1222dd579994a0f10", "ja3_variant_count": 1, "ja3_variants": [ "3c85986a787f1cd1222dd579994a0f10" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_9616931c81b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "9616931c81b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-65037-43-11-10-0-18-27-5-13-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791126021, "last_seen": 1791126021, "transport": "t", "ja3_hash": "fe364a810ee152f933680ba8c3e56dd9", "ja3_variant_count": 1, "ja3_variants": [ "fe364a810ee152f933680ba8c3e56dd9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_adeb24d900be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "adeb24d900be", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-43-35-0-17613-5-65281-65037-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790003190, "last_seen": 1790003190, "transport": "t", "ja3_hash": "8f220e835830674b7b5f7c2e742b2574", "ja3_variant_count": 1, "ja3_variants": [ "8f220e835830674b7b5f7c2e742b2574" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_af6f8eb7fcd3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "af6f8eb7fcd3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-35-27-10-13-23-45-43-5-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790956909, "last_seen": 1790956909, "transport": "t", "ja3_hash": "dbe25a9c9250beb5883ff3b6a0361292", "ja3_variant_count": 1, "ja3_variants": [ "dbe25a9c9250beb5883ff3b6a0361292" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_b1275c911d30", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "b1275c911d30", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-65037-35-13-10-0-17613-23-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790794988, "last_seen": 1790794988, "transport": "t", "ja3_hash": "b12faa2b7fe10714da77477cbcb87943", "ja3_variant_count": 1, "ja3_variants": [ "b12faa2b7fe10714da77477cbcb87943" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_c7c6fa084ca8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "c7c6fa084ca8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-0-65281-27-35-10-23-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791040732, "last_seen": 1791040732, "transport": "t", "ja3_hash": "d78728a091986d6f5b5d889f2e3012c5", "ja3_variant_count": 1, "ja3_variants": [ "d78728a091986d6f5b5d889f2e3012c5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_d6208125c2b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "d6208125c2b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-11-65037-65281-5-10-0-27-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791221605, "last_seen": 1791221605, "transport": "t", "ja3_hash": "5d7034d0df15bb5c6ffe171bf8b98f53", "ja3_variant_count": 1, "ja3_variants": [ "5d7034d0df15bb5c6ffe171bf8b98f53" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_e635fd08c765", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "e635fd08c765", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-0-11-43-23-10-35-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790224727, "last_seen": 1790224727, "transport": "t", "ja3_hash": "7e8c1444c7356d02a2c95b1be9354392", "ja3_variant_count": 1, "ja3_variants": [ "7e8c1444c7356d02a2c95b1be9354392" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_e88adec25712", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "e88adec25712", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-5-17613-27-18-11-65281-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790627408, "last_seen": 1791172784, "transport": "t", "ja3_hash": "96a52b46b1926061b529c68705c144e9", "ja3_variant_count": 2, "ja3_variants": [ "96a52b46b1926061b529c68705c144e9", "d1d1962369ffc9d8668ba48b3f5f6454" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_e96174c57891", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "e96174c57891", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-65281-43-5-27-23-17613-45-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790516166, "last_seen": 1790516166, "transport": "t", "ja3_hash": "3e044adc2c7b07896bb4e7a4a8c965c9", "ja3_variant_count": 1, "ja3_variants": [ "3e044adc2c7b07896bb4e7a4a8c965c9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_ed05561cdcbb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "ed05561cdcbb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-43-10-65281-17613-65037-27-0-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457564, "last_seen": 1789457564, "transport": "t", "ja3_hash": "4c8adbcc6ef6549897c972862b88198e", "ja3_variant_count": 1, "ja3_variants": [ "4c8adbcc6ef6549897c972862b88198e" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_f22168f95d7f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "f22168f95d7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-0-10-65281-65037-35-43-23-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790235720, "last_seen": 1790235720, "transport": "t", "ja3_hash": "4ca62a06100257cce0a15654b4249600", "ja3_variant_count": 1, "ja3_variants": [ "4ca62a06100257cce0a15654b4249600" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_fbe3f329954d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "fbe3f329954d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-0-18-27-35-13-43-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789452923, "last_seen": 1789452923, "transport": "t", "ja3_hash": "1140a63647ff6123b484aa54b2d77c36", "ja3_variant_count": 1, "ja3_variants": [ "1140a63647ff6123b484aa54b2d77c36" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_fc9b8c99330a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "fc9b8c99330a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-5-43-17513-13-65037-65281-35-51-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791291967, "last_seen": 1791291967, "transport": "t", "ja3_hash": "10006088dee82e8adc97da2f943eaafc", "ja3_variant_count": 1, "ja3_variants": [ "10006088dee82e8adc97da2f943eaafc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_fd5568b3044b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "fd5568b3044b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-65037-65281-10-0-43-5-13-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790208850, "last_seen": 1791036560, "transport": "t", "ja3_hash": "90ca1bf2d65d04963ffc7b0b61612844", "ja3_variant_count": 2, "ja3_variants": [ "90ca1bf2d65d04963ffc7b0b61612844", "01f49f757adf3653ccef7d2fcb12c4a9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_ff3ba1ac77a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "ff3ba1ac77a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-35-10-5-0-18-17613-27-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791024046, "last_seen": 1791024046, "transport": "t", "ja3_hash": "7f1ca18bff75a9336a1a276856c8b162", "ja3_variant_count": 1, "ja3_variants": [ "7f1ca18bff75a9336a1a276856c8b162" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h1_8daaf6152771_139637b2b2a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h1", "b": "8daaf6152771", "c": "139637b2b2a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-43-45-13-27-35-0-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790566777, "last_seen": 1790566777, "transport": "t", "ja3_hash": "8c721c85e4c3e1ed1f7707b0ea03fe8e", "ja3_variant_count": 1, "ja3_variants": [ "8c721c85e4c3e1ed1f7707b0ea03fe8e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h1_8daaf6152771_7ade489c992f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h1", "b": "8daaf6152771", "c": "7ade489c992f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-11-18-13-23-10-43-65037-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790542313, "last_seen": 1790542313, "transport": "t", "ja3_hash": "71094ba16864ff44a04fe1bc1f7777d8", "ja3_variant_count": 1, "ja3_variants": [ "71094ba16864ff44a04fe1bc1f7777d8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h1_8daaf6152771_80bc2994951c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h1", "b": "8daaf6152771", "c": "80bc2994951c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-18-13-11-65037-65281-43-0-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790997069, "last_seen": 1790997069, "transport": "t", "ja3_hash": "544a153c398b57f9c3b8744cfbbce9b1", "ja3_variant_count": 1, "ja3_variants": [ "544a153c398b57f9c3b8744cfbbce9b1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h1_8daaf6152771_9844c5375b4c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h1", "b": "8daaf6152771", "c": "9844c5375b4c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-65037-65281-5-18-10-16-0-13-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790990615, "last_seen": 1790990615, "transport": "t", "ja3_hash": "c56275835d06dd2cc35d2d7ee975edbb", "ja3_variant_count": 1, "ja3_variants": [ "c56275835d06dd2cc35d2d7ee975edbb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h1_8daaf6152771_a91bdff6d08d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h1", "b": "8daaf6152771", "c": "a91bdff6d08d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-18-5-10-16-43-65281-27-23-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790540101, "last_seen": 1790540101, "transport": "t", "ja3_hash": "9fb3fd12c8a42f26b85427cbef3efcf4", "ja3_variant_count": 1, "ja3_variants": [ "9fb3fd12c8a42f26b85427cbef3efcf4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h1_8daaf6152771_c34481424f6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h1", "b": "8daaf6152771", "c": "c34481424f6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-65037-43-35-0-45-10-18-13-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790540179, "last_seen": 1790540179, "transport": "t", "ja3_hash": "c753f61f41dcb645f6bb844355b71bb5", "ja3_variant_count": 1, "ja3_variants": [ "c753f61f41dcb645f6bb844355b71bb5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_0aca93fd3ea6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "0aca93fd3ea6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-45-13-35-18-27-65281-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790233534, "last_seen": 1790233534, "transport": "t", "ja3_hash": "0731dc4e2a2b68949c839c6952f188f1", "ja3_variant_count": 1, "ja3_variants": [ "0731dc4e2a2b68949c839c6952f188f1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_0c1c51d3ace5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "0c1c51d3ace5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-65281-13-18-0-11-16-35-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790348487, "last_seen": 1790348487, "transport": "t", "ja3_hash": "a2cc253569fc6e2f4fec2cafa59c5770", "ja3_variant_count": 1, "ja3_variants": [ "a2cc253569fc6e2f4fec2cafa59c5770" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_12ce15345c8a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "12ce15345c8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-51764-45-17613-16-18-23-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791107001, "last_seen": 1791107001, "transport": "t", "ja3_hash": "f219a44021ce9fd7ee2064fc8f547c00", "ja3_variant_count": 1, "ja3_variants": [ "f219a44021ce9fd7ee2064fc8f547c00" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_17fd571d0693", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "17fd571d0693", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-45-10-17613-23-0-13-65281-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788516354, "last_seen": 1788516354, "transport": "t", "ja3_hash": "4948b978019b5221648e0f210d583924", "ja3_variant_count": 1, "ja3_variants": [ "4948b978019b5221648e0f210d583924" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_19841fe9d1e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "19841fe9d1e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-11-5-13-23-16-65281-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789368924, "last_seen": 1789368924, "transport": "t", "ja3_hash": "67fee289fcd6ffdf911ec7ad0641ce3a", "ja3_variant_count": 1, "ja3_variants": [ "67fee289fcd6ffdf911ec7ad0641ce3a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_1b2ba15931e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "1b2ba15931e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-10-0-65037-16-43-27-17613-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790729978, "last_seen": 1790729978, "transport": "t", "ja3_hash": "73a3d27bea0a449e6f84573932d7688f", "ja3_variant_count": 1, "ja3_variants": [ "73a3d27bea0a449e6f84573932d7688f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_1be5d9282827", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "1be5d9282827", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-18-35-0-45-13-16-43-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669079, "last_seen": 1789669079, "transport": "t", "ja3_hash": "0baf074749919722b69f9764c1a2f9a8", "ja3_variant_count": 1, "ja3_variants": [ "0baf074749919722b69f9764c1a2f9a8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_209b8ad6518f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "209b8ad6518f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-16-45-18-23-5-0-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788791276, "last_seen": 1788791276, "transport": "t", "ja3_hash": "4c423957623a41db83004fbb32073e04", "ja3_variant_count": 1, "ja3_variants": [ "4c423957623a41db83004fbb32073e04" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_22875d1bc6f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "22875d1bc6f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-27-45-13-18-65281-5-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027397, "last_seen": 1789027397, "transport": "t", "ja3_hash": "ad6afe08ea53d5756143cec15fc7457e", "ja3_variant_count": 1, "ja3_variants": [ "ad6afe08ea53d5756143cec15fc7457e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_25e3b976f565", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "25e3b976f565", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-65281-11-5-45-17613-16-0-27-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789927619, "last_seen": 1789927619, "transport": "t", "ja3_hash": "4d559ffdae66d07d3a6cc2dcb9b5cc0f", "ja3_variant_count": 1, "ja3_variants": [ "4d559ffdae66d07d3a6cc2dcb9b5cc0f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_2b10ee47c4d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "2b10ee47c4d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-11-5-18-35-27-13-0-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788993431, "last_seen": 1788993431, "transport": "t", "ja3_hash": "872681f892ca9baa87bd7aa2489aba3d", "ja3_variant_count": 1, "ja3_variants": [ "872681f892ca9baa87bd7aa2489aba3d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_324c097558a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "324c097558a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-0-16-43-18-27-65037-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790189501, "last_seen": 1790189501, "transport": "t", "ja3_hash": "76216d878bb126179e03fca7edbf978c", "ja3_variant_count": 1, "ja3_variants": [ "76216d878bb126179e03fca7edbf978c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_347de1b02a0a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "347de1b02a0a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-11-35-23-65037-18-43-45-17513-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790947518, "last_seen": 1790947518, "transport": "t", "ja3_hash": "c2aba2806832b5da2a0294e307c3c9f5", "ja3_variant_count": 1, "ja3_variants": [ "c2aba2806832b5da2a0294e307c3c9f5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_360bbdb5861d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "360bbdb5861d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-11-13-16-23-43-51-65281-45-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 47, "first_seen": 1787804995, "last_seen": 1790377742, "transport": "t", "ja3_hash": "1eb0b3368d6ff19b6eaba2a4f04c2b5f", "ja3_variant_count": 2, "ja3_variants": [ "1eb0b3368d6ff19b6eaba2a4f04c2b5f", "2f8e8303e312fc24db0daa7b43e52d93" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 133, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 522 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_36a8f8f50db5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "36a8f8f50db5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-23-11-65281-10-0-43-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788582122, "last_seen": 1788582122, "transport": "t", "ja3_hash": "6d4cb3453a233ed471ac3e5f82421aec", "ja3_variant_count": 1, "ja3_variants": [ "6d4cb3453a233ed471ac3e5f82421aec" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_3d5dec722ba2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "3d5dec722ba2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-5-43-45-13-27-23-0-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789655104, "last_seen": 1789655104, "transport": "t", "ja3_hash": "6174f4c7a8d7fe9aba0cdde3c9afde85", "ja3_variant_count": 1, "ja3_variants": [ "6174f4c7a8d7fe9aba0cdde3c9afde85" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_3ebb54a1387c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "3ebb54a1387c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-45-65037-35-27-43-0-65281-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791281697, "last_seen": 1791281697, "transport": "t", "ja3_hash": "0ebb36a507663f4b2b06e2250a099466", "ja3_variant_count": 1, "ja3_variants": [ "0ebb36a507663f4b2b06e2250a099466" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_409bdf742628", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "409bdf742628", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-27-43-16-0-18-5-51-10-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791276533, "last_seen": 1791276533, "transport": "t", "ja3_hash": "f1e3cde545af06848235d296a1fdab5d", "ja3_variant_count": 1, "ja3_variants": [ "f1e3cde545af06848235d296a1fdab5d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_4213b862c86e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "4213b862c86e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-17613-65037-13-43-11-16-23-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788765046, "last_seen": 1788765046, "transport": "t", "ja3_hash": "c9e016e64c18dc64690e7d57b10ea6ff", "ja3_variant_count": 1, "ja3_variants": [ "c9e016e64c18dc64690e7d57b10ea6ff" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_42223435a986", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "42223435a986", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-65037-0-65281-18-35-16-43-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788802836, "last_seen": 1788802836, "transport": "t", "ja3_hash": "d41d05fcee95d269b6e157ded2ff400b", "ja3_variant_count": 1, "ja3_variants": [ "d41d05fcee95d269b6e157ded2ff400b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_47ffc1ce98ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "47ffc1ce98ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-13-0-65037-18-43-45-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789858619, "last_seen": 1789858619, "transport": "t", "ja3_hash": "d3f6dc0151906393913d6c6a289afe61", "ja3_variant_count": 1, "ja3_variants": [ "d3f6dc0151906393913d6c6a289afe61" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_4e5585429ba5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "4e5585429ba5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-65037-16-27-43-35-65281-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789118338, "last_seen": 1789118338, "transport": "t", "ja3_hash": "9d63b28cd3591b07272d590c7c55a15b", "ja3_variant_count": 1, "ja3_variants": [ "9d63b28cd3591b07272d590c7c55a15b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_565d30dce49e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "565d30dce49e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-35-51-16-27-17513-11-5-0-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791142802, "last_seen": 1791142802, "transport": "t", "ja3_hash": "ee4b852ce7cb6a062193e91bbff0c3be", "ja3_variant_count": 1, "ja3_variants": [ "ee4b852ce7cb6a062193e91bbff0c3be" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_5b0fb0c3ff58", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "5b0fb0c3ff58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-43-11-0-65037-23-51764-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723985, "last_seen": 1788723985, "transport": "t", "ja3_hash": "52caa32b2dccc72603e91d20df321f16", "ja3_variant_count": 1, "ja3_variants": [ "52caa32b2dccc72603e91d20df321f16" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_5b5f5c75cbbe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "5b5f5c75cbbe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-35-17613-43-0-16-45-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788731567, "last_seen": 1788731567, "transport": "t", "ja3_hash": "bf0d028b06e68b97d17de84758e59820", "ja3_variant_count": 1, "ja3_variants": [ "bf0d028b06e68b97d17de84758e59820" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_5bd46daf736c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "5bd46daf736c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-0-16-11-18-35-43-65037-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790718282, "last_seen": 1790718282, "transport": "t", "ja3_hash": "6b47310caf9eeca93de84a3cc5c4950a", "ja3_variant_count": 1, "ja3_variants": [ "6b47310caf9eeca93de84a3cc5c4950a" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.1.0 Safari/537.36 Edg/135.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_7269cec5ddd6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "7269cec5ddd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-23-16-27-11-17613-43-35-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790671122, "last_seen": 1790671122, "transport": "t", "ja3_hash": "cec4c9ad8b20e847512216a28791ff19", "ja3_variant_count": 1, "ja3_variants": [ "cec4c9ad8b20e847512216a28791ff19" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_7c6ae8dd6dac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "7c6ae8dd6dac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-43-18-45-27-0-65037-65281-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790820597, "last_seen": 1790820597, "transport": "t", "ja3_hash": "52588513d979628b00178e76f56e3d6d", "ja3_variant_count": 1, "ja3_variants": [ "52588513d979628b00178e76f56e3d6d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_8298423332d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "8298423332d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-0-16-35-13-45-65281-43-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788709821, "last_seen": 1788709821, "transport": "t", "ja3_hash": "41a42cbf761e95e4e153dd126cdfdba0", "ja3_variant_count": 1, "ja3_variants": [ "41a42cbf761e95e4e153dd126cdfdba0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_85a662c2fe29", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "85a662c2fe29", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-23-65281-13-45-27-43-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789843705, "last_seen": 1789843705, "transport": "t", "ja3_hash": "90b933ba4661392126e0ed4cad859a8b", "ja3_variant_count": 1, "ja3_variants": [ "90b933ba4661392126e0ed4cad859a8b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 10 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_97acd34d019a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "97acd34d019a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-45-0-35-13-17613-65037-16-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789919972, "last_seen": 1789919972, "transport": "t", "ja3_hash": "9ddc4e0082406eb6f008d71f7d6173c3", "ja3_variant_count": 1, "ja3_variants": [ "9ddc4e0082406eb6f008d71f7d6173c3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_97c8d764e0a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "97c8d764e0a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-0-16-23-5-18-17613-43-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790380112, "last_seen": 1790380112, "transport": "t", "ja3_hash": "200c4fa2feb6074027581a735003af9d", "ja3_variant_count": 1, "ja3_variants": [ "200c4fa2feb6074027581a735003af9d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_9e2a667fa4ef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "9e2a667fa4ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-16-65281-51-0-35-5-10-18-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791259033, "last_seen": 1791259033, "transport": "t", "ja3_hash": "bc2134d99584a424864e2a04bb9b79ba", "ja3_variant_count": 1, "ja3_variants": [ "bc2134d99584a424864e2a04bb9b79ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_a83a6ad058dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "a83a6ad058dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-11-45-65037-27-23-35-13-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790942097, "last_seen": 1790942097, "transport": "t", "ja3_hash": "26c88a307625ccd99f9c50eb7536fd2a", "ja3_variant_count": 1, "ja3_variants": [ "26c88a307625ccd99f9c50eb7536fd2a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_a9a02edd3f66", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "a9a02edd3f66", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-45-0-35-43-16-5-13-65037-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791132489, "last_seen": 1791132489, "transport": "t", "ja3_hash": "715c137bedcda6250b8ad683492e5e8d", "ja3_variant_count": 1, "ja3_variants": [ "715c137bedcda6250b8ad683492e5e8d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_aae00fd5a1f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "aae00fd5a1f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-16-18-13-43-10-0-11-45-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791146788, "last_seen": 1791146788, "transport": "t", "ja3_hash": "88a97dc6eaf76934c2389050d3ed83e9", "ja3_variant_count": 1, "ja3_variants": [ "88a97dc6eaf76934c2389050d3ed83e9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_ab95340afe9b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "ab95340afe9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-0-65037-43-5-13-18-65281-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791008474, "last_seen": 1791008474, "transport": "t", "ja3_hash": "79d091d7cdea0917310165ea9171a8a8", "ja3_variant_count": 1, "ja3_variants": [ "79d091d7cdea0917310165ea9171a8a8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_add99ce8637a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "add99ce8637a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-5-65037-16-65281-0-27-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790433878, "last_seen": 1790433878, "transport": "t", "ja3_hash": "dd8242d3afeeeb157a36011cd631610c", "ja3_variant_count": 1, "ja3_variants": [ "dd8242d3afeeeb157a36011cd631610c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c47281b5edb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c47281b5edb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-11-16-17613-43-23-27-35-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789325998, "last_seen": 1789325998, "transport": "t", "ja3_hash": "5463183d2b545079d1008ff004564743", "ja3_variant_count": 1, "ja3_variants": [ "5463183d2b545079d1008ff004564743" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c58d90d87b02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c58d90d87b02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-43-13-16-18-35-65037-27-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790243270, "last_seen": 1790243270, "transport": "t", "ja3_hash": "25afb885246c61de190e2728ad4c90cb", "ja3_variant_count": 1, "ja3_variants": [ "25afb885246c61de190e2728ad4c90cb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c762e395f2cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c762e395f2cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-10-43-0-65037-17613-65281-16-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788730215, "last_seen": 1788730215, "transport": "t", "ja3_hash": "efce995b358f7299ea5fc6609f88f444", "ja3_variant_count": 1, "ja3_variants": [ "efce995b358f7299ea5fc6609f88f444" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c805d88b9197", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c805d88b9197", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-35-17613-11-27-5-23-16-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789872682, "last_seen": 1789872682, "transport": "t", "ja3_hash": "af4867692dba49287ee0ee3c96c93a71", "ja3_variant_count": 1, "ja3_variants": [ "af4867692dba49287ee0ee3c96c93a71" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c85858262b4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c85858262b4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-27-0-45-65281-16-43-23-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790730857, "last_seen": 1790730857, "transport": "t", "ja3_hash": "888806d252025c5f071382960690e1af", "ja3_variant_count": 1, "ja3_variants": [ "888806d252025c5f071382960690e1af" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_cd081f799d34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "cd081f799d34", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-11-65037-0-13-65281-16-43-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791110119, "last_seen": 1791110119, "transport": "t", "ja3_hash": "c4f68d65c67f63f26a15ec2094d6da7e", "ja3_variant_count": 1, "ja3_variants": [ "c4f68d65c67f63f26a15ec2094d6da7e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_cdfbc3db6561", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "cdfbc3db6561", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-17613-0-65037-11-16-5-18-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791257608, "last_seen": 1791257608, "transport": "t", "ja3_hash": "31967803fa543cce91220b0f35d2ad11", "ja3_variant_count": 1, "ja3_variants": [ "31967803fa543cce91220b0f35d2ad11" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_d09ac63a7c51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "d09ac63a7c51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-45-11-43-35-5-18-23-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789829487, "last_seen": 1789829487, "transport": "t", "ja3_hash": "438f75bec9d8f8af8e76122921382d5f", "ja3_variant_count": 1, "ja3_variants": [ "438f75bec9d8f8af8e76122921382d5f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_d8646ba701d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "d8646ba701d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-45-43-0-65037-35-5-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790786556, "last_seen": 1790786556, "transport": "t", "ja3_hash": "691f9c571cbb8bd7af137b9ad3d1115c", "ja3_variant_count": 1, "ja3_variants": [ "691f9c571cbb8bd7af137b9ad3d1115c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_def3f5a7ff09", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "def3f5a7ff09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-35-10-23-16-43-11-17613-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790366916, "last_seen": 1790366916, "transport": "t", "ja3_hash": "a7cb964a4a20058a3157d5343effa4c5", "ja3_variant_count": 1, "ja3_variants": [ "a7cb964a4a20058a3157d5343effa4c5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_dfe12e85d0f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "dfe12e85d0f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-13-27-18-0-17613-45-35-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789671484, "last_seen": 1789671484, "transport": "t", "ja3_hash": "903fbbdba3487aeefbb06f424134ee65", "ja3_variant_count": 1, "ja3_variants": [ "903fbbdba3487aeefbb06f424134ee65" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_e1c065a2ad62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "e1c065a2ad62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-43-5-27-65281-65037-23-16-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790604512, "last_seen": 1790604512, "transport": "t", "ja3_hash": "71de8a77ab4090420f886d31a785f467", "ja3_variant_count": 1, "ja3_variants": [ "71de8a77ab4090420f886d31a785f467" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_e54cf09538ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "e54cf09538ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-5-65037-16-45-11-65281-43-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791014825, "last_seen": 1791014825, "transport": "t", "ja3_hash": "6930a17a28e07ea9229525400d0eef20", "ja3_variant_count": 1, "ja3_variants": [ "6930a17a28e07ea9229525400d0eef20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_ea715b37d11b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "ea715b37d11b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-43-16-35-10-17613-0-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790202578, "last_seen": 1790202578, "transport": "t", "ja3_hash": "5f10035168b14c0e2897be3d515846ab", "ja3_variant_count": 1, "ja3_variants": [ "5f10035168b14c0e2897be3d515846ab" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_ee20d2fd135a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "ee20d2fd135a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-65037-27-0-35-43-13-5-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790563232, "last_seen": 1790563232, "transport": "t", "ja3_hash": "825bee1dfcf64f152694d2a7ac8b5126", "ja3_variant_count": 1, "ja3_variants": [ "825bee1dfcf64f152694d2a7ac8b5126" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_ef4a228db532", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "ef4a228db532", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-10-65281-0-5-16-13-23-45-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 48, "first_seen": 1787780324, "last_seen": 1790779040, "transport": "t", "ja3_hash": "91644439ec027e4a30f5cbcb88efae13", "ja3_variant_count": 2, "ja3_variants": [ "91644439ec027e4a30f5cbcb88efae13", "af86da6cc1b8392a61f2c9c3189a3655" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 39, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 111 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_f48117cc7d16", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "f48117cc7d16", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-16-11-0-17613-18-45-43-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790208109, "last_seen": 1790208109, "transport": "t", "ja3_hash": "6c5d0b820ef953c25674649f0e8ac4cd", "ja3_variant_count": 1, "ja3_variants": [ "6c5d0b820ef953c25674649f0e8ac4cd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_f759734d6047", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "f759734d6047", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-18-5-35-43-23-16-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789676697, "last_seen": 1789676697, "transport": "t", "ja3_hash": "7afd8799dbcb10b3d64e223b04f2decc", "ja3_variant_count": 1, "ja3_variants": [ "7afd8799dbcb10b3d64e223b04f2decc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 40 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_f7d53836188e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "f7d53836188e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-13-10-17613-0-11-43-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789604461, "last_seen": 1789604461, "transport": "t", "ja3_hash": "d3f8eb2648141e424c0115c452bcaf37", "ja3_variant_count": 1, "ja3_variants": [ "d3f8eb2648141e424c0115c452bcaf37" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_fc94c450c1d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "fc94c450c1d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-13-17613-45-27-5-16-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788964084, "last_seen": 1788964084, "transport": "t", "ja3_hash": "e7c2b1f0978cedbf2691d8c50e718f11", "ja3_variant_count": 1, "ja3_variants": [ "e7c2b1f0978cedbf2691d8c50e718f11" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_ff3fc185ef31", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "ff3fc185ef31", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17513-10-16-13-5-45-0-11-35-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791280366, "last_seen": 1791280366, "transport": "t", "ja3_hash": "61def40e7f123a24144f8e60418db467", "ja3_variant_count": 1, "ja3_variants": [ "61def40e7f123a24144f8e60418db467" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1511h2_bd33cfcc426e_b90686e98e0a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511h2", "b": "bd33cfcc426e", "c": "b90686e98e0a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49195-49196-49187-49188-49200-49199-49191-49192-159-158-107-103-255,0-11-10-5-16-22-23-13-43-45-51,23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1790700841, "last_seen": 1790963820, "transport": "t", "ja3_hash": "2336d7c999464f7025dd6c46bb390686", "ja3_variant_count": 1, "ja3_variants": [ "2336d7c999464f7025dd6c46bb390686" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 59, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 426 }, "ua_disagreement": false } }, { "hash": "t13d1511ht_8daaf6152771_757c955fe60b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1511ht", "b": "8daaf6152771", "c": "757c955fe60b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-49171-49172-52392-156-157-47-53,0-23-65281-10-11-35-16-13-51-45-43,4588-25497-29-65074-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 65074, "name": "65074 (0xfe32)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788379485, "last_seen": 1790956967, "transport": "t", "ja3_hash": "6c86e352b6818bacf1b5f5b06aa262d8", "ja3_variant_count": 1, "ja3_variants": [ "6c86e352b6818bacf1b5f5b06aa262d8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 97, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (compatible; ChannelResearchBot/1.0; +contact via CSV owner)": 6 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_074628138801", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "074628138801", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-23-43-17513-65281-45-13-5-51-10-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791103485, "last_seen": 1791103485, "transport": "t", "ja3_hash": "0b295bfd0f7233aa5d2d360bf59f60a8", "ja3_variant_count": 1, "ja3_variants": [ "0b295bfd0f7233aa5d2d360bf59f60a8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_092f9e7d7362", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "092f9e7d7362", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-65037-18-13-51764-10-35-23-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791169808, "last_seen": 1791169808, "transport": "t", "ja3_hash": "aff561e8ec8941e3bbb4206580103f8d", "ja3_variant_count": 1, "ja3_variants": [ "aff561e8ec8941e3bbb4206580103f8d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_0a95e5db3995", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "0a95e5db3995", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-65037-18-23-10-13-65281-0-27-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202592, "last_seen": 1790202592, "transport": "t", "ja3_hash": "84ad626dec23ee329dcda72139984a74", "ja3_variant_count": 1, "ja3_variants": [ "84ad626dec23ee329dcda72139984a74" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_0b5fc2fc3b07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "0b5fc2fc3b07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-65281-5-35-13-65037-45-10-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788835500, "last_seen": 1788835500, "transport": "t", "ja3_hash": "6b4d0df56d37ddcb6050163dc8031cfd", "ja3_variant_count": 1, "ja3_variants": [ "6b4d0df56d37ddcb6050163dc8031cfd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_11ea533c4d3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "11ea533c4d3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-51764-65037-45-23-17613-43-11-18-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790314464, "last_seen": 1790314464, "transport": "t", "ja3_hash": "685deb16f65a8a8192e937e5792d93a7", "ja3_variant_count": 1, "ja3_variants": [ "685deb16f65a8a8192e937e5792d93a7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_1aacfcfa4d6a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "1aacfcfa4d6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-13-65037-5-43-0-17613-23-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790715146, "last_seen": 1790715146, "transport": "t", "ja3_hash": "31cf54712c554bb33f6556ca0d0f4bfa", "ja3_variant_count": 1, "ja3_variants": [ "31cf54712c554bb33f6556ca0d0f4bfa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_1e3282a30c40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "1e3282a30c40", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-10-18-65281-0-11-43-35-27-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789740901, "last_seen": 1789740901, "transport": "t", "ja3_hash": "1225664cf95d46122aa6170e9bfb29e8", "ja3_variant_count": 1, "ja3_variants": [ "1225664cf95d46122aa6170e9bfb29e8" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 2 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_1f5872d1fd3f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "1f5872d1fd3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-0-43-18-45-13-11-17613-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788763292, "last_seen": 1788763292, "transport": "t", "ja3_hash": "17d2b5280a354fcb8707c4fe789b4aaa", "ja3_variant_count": 1, "ja3_variants": [ "17d2b5280a354fcb8707c4fe789b4aaa" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_31938250cbb9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "31938250cbb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-18-0-5-45-23-65281-13-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789883298, "last_seen": 1789883298, "transport": "t", "ja3_hash": "f2be5ee55a118617ee1ffabe6075f5f1", "ja3_variant_count": 1, "ja3_variants": [ "f2be5ee55a118617ee1ffabe6075f5f1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_341e8f247611", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "341e8f247611", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-18-10-35-45-27-23-65281-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789253278, "last_seen": 1790236051, "transport": "t", "ja3_hash": "cbea8c2f3391c4336dd7bccdfb856c9c", "ja3_variant_count": 2, "ja3_variants": [ "cbea8c2f3391c4336dd7bccdfb856c9c", "3a7dd59f30b6c26dfdfabe9e71748d76" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_3bbed027218c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "3bbed027218c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-27-23-35-5-65281-45-0-17613-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790240012, "last_seen": 1790240012, "transport": "t", "ja3_hash": "cd11139071e1a17ce16a41c2ac17c8d8", "ja3_variant_count": 1, "ja3_variants": [ "cd11139071e1a17ce16a41c2ac17c8d8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_3e16e91cc5f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "3e16e91cc5f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-5-0-13-18-45-11-65037-43-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788956532, "last_seen": 1788956532, "transport": "t", "ja3_hash": "04b957cea200d9ca77f9710faec0f3e1", "ja3_variant_count": 1, "ja3_variants": [ "04b957cea200d9ca77f9710faec0f3e1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_4aea63be1d8f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "4aea63be1d8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-43-5-18-17613-23-0-13-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788855374, "last_seen": 1788855374, "transport": "t", "ja3_hash": "11006a684c1944308f051b1eea5c43e7", "ja3_variant_count": 1, "ja3_variants": [ "11006a684c1944308f051b1eea5c43e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 20 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_51acd692be23", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "51acd692be23", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-65281-11-27-45-35-13-5-65037-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790930583, "last_seen": 1791135414, "transport": "t", "ja3_hash": "1fc3a287593ced1a4edc38a218545fea", "ja3_variant_count": 2, "ja3_variants": [ "1fc3a287593ced1a4edc38a218545fea", "fe8f7e1c666466dad376e13e76e0547a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_5557336b508f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "5557336b508f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-5-0-35-13-65037-10-27-43-17513-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791104079, "last_seen": 1791104079, "transport": "t", "ja3_hash": "32c04de8482247dae71a165bdbf8d88b", "ja3_variant_count": 1, "ja3_variants": [ "32c04de8482247dae71a165bdbf8d88b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_5a3ef650c878", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "5a3ef650c878", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-0-13-27-65281-65037-18-45-23-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791091054, "last_seen": 1791091054, "transport": "t", "ja3_hash": "1419d450b45e828205ac133fbadfee8d", "ja3_variant_count": 1, "ja3_variants": [ "1419d450b45e828205ac133fbadfee8d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_5b71f8e78adb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "5b71f8e78adb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-23-35-65037-11-5-45-17613-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788565034, "last_seen": 1788565034, "transport": "t", "ja3_hash": "670d81d6eadda63fe53b668a35f11d54", "ja3_variant_count": 1, "ja3_variants": [ "670d81d6eadda63fe53b668a35f11d54" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_5bba5247613e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "5bba5247613e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-5-13-23-35-0-17613-43-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791110533, "last_seen": 1791110533, "transport": "t", "ja3_hash": "da49fa105aea2287f7dccda2a7c09db0", "ja3_variant_count": 1, "ja3_variants": [ "da49fa105aea2287f7dccda2a7c09db0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_644078a2e2f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "644078a2e2f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-65037-11-43-10-5-18-17613-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789704531, "last_seen": 1789704531, "transport": "t", "ja3_hash": "f01b0541af2b07833d7d094f13fa89f3", "ja3_variant_count": 1, "ja3_variants": [ "f01b0541af2b07833d7d094f13fa89f3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_6b09fc79ad32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "6b09fc79ad32", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-13-35-65037-51764-45-27-11-43-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789669041, "last_seen": 1789669041, "transport": "t", "ja3_hash": "55392fd03e5feb7b511274b45e02cf3c", "ja3_variant_count": 1, "ja3_variants": [ "55392fd03e5feb7b511274b45e02cf3c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_6e1cdb3e551c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "6e1cdb3e551c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-17613-18-23-11-51764-43-5-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791071852, "last_seen": 1791071852, "transport": "t", "ja3_hash": "9d087767957093706e02f74ec5fef80c", "ja3_variant_count": 1, "ja3_variants": [ "9d087767957093706e02f74ec5fef80c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_7a2072c0d393", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "7a2072c0d393", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-43-23-45-18-65037-65281-35-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790534720, "last_seen": 1790534720, "transport": "t", "ja3_hash": "8556df2b2a1f4c763335e5281ca63412", "ja3_variant_count": 1, "ja3_variants": [ "8556df2b2a1f4c763335e5281ca63412" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_7d6bf1020748", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "7d6bf1020748", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-43-13-17613-18-11-65281-0-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790696894, "last_seen": 1790696894, "transport": "t", "ja3_hash": "675b7c426c3461ce51bd4bcf5313faa2", "ja3_variant_count": 1, "ja3_variants": [ "675b7c426c3461ce51bd4bcf5313faa2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_7ebf1af37c72", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "7ebf1af37c72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-45-35-13-17613-18-0-10-65281-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790208536, "last_seen": 1790208536, "transport": "t", "ja3_hash": "633ce72797f0d573daf86e5c2b1ec961", "ja3_variant_count": 1, "ja3_variants": [ "633ce72797f0d573daf86e5c2b1ec961" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_850d0a6af0b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "850d0a6af0b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-18-10-17613-65281-27-43-0-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789035458, "last_seen": 1789035458, "transport": "t", "ja3_hash": "e70ab9b5dcf6436f6941a5afadc0d58e", "ja3_variant_count": 1, "ja3_variants": [ "e70ab9b5dcf6436f6941a5afadc0d58e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_851b0988ae67", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "851b0988ae67", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-65037-18-13-0-43-23-45-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790593304, "last_seen": 1790593304, "transport": "t", "ja3_hash": "de7abf5a63a51583729bedee8b7c0242", "ja3_variant_count": 1, "ja3_variants": [ "de7abf5a63a51583729bedee8b7c0242" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_85be4176550b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "85be4176550b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-65037-43-17513-5-23-35-65281-13-18-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791263241, "last_seen": 1791263241, "transport": "t", "ja3_hash": "d1456aca1a26922f93b9267c62969e77", "ja3_variant_count": 1, "ja3_variants": [ "d1456aca1a26922f93b9267c62969e77" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_9f720e18b5ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "9f720e18b5ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-18-43-35-27-23-0-45-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789306865, "last_seen": 1789306865, "transport": "t", "ja3_hash": "800e5228b5c08c52eb6df504c8ea72cb", "ja3_variant_count": 1, "ja3_variants": [ "800e5228b5c08c52eb6df504c8ea72cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_a1ede108e172", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "a1ede108e172", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-13-35-0-65037-23-27-43-10-45-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791260678, "last_seen": 1791260678, "transport": "t", "ja3_hash": "8225e83711c15c79d8a8dc8a74e2f1c6", "ja3_variant_count": 1, "ja3_variants": [ "8225e83711c15c79d8a8dc8a74e2f1c6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_adca8be63ddc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "adca8be63ddc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-65281-13-5-11-17613-23-43-27-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790086184, "last_seen": 1790086184, "transport": "t", "ja3_hash": "9c626e0231343d10293b5eca2c94e8f2", "ja3_variant_count": 1, "ja3_variants": [ "9c626e0231343d10293b5eca2c94e8f2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_b7fd86e9c189", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "b7fd86e9c189", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-43-23-27-11-17613-45-65037-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791226963, "last_seen": 1791226963, "transport": "t", "ja3_hash": "cb0032c6901b25c0e9536e107f7f74ed", "ja3_variant_count": 1, "ja3_variants": [ "cb0032c6901b25c0e9536e107f7f74ed" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 2 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_b807ec064736", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "b807ec064736", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-27-65037-11-45-10-0-23-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790236376, "last_seen": 1790236376, "transport": "t", "ja3_hash": "bfabf5d860157a55fe87e3e7c102306e", "ja3_variant_count": 1, "ja3_variants": [ "bfabf5d860157a55fe87e3e7c102306e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_c712dc9bc45c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "c712dc9bc45c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-35-0-23-17613-10-51764-11-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791122610, "last_seen": 1791122610, "transport": "t", "ja3_hash": "30f73af02b45f9ed0eb10996b5e7ca1b", "ja3_variant_count": 1, "ja3_variants": [ "30f73af02b45f9ed0eb10996b5e7ca1b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_d221d9b39cd6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "d221d9b39cd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-11-0-35-5-65281-45-13-43-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790217230, "last_seen": 1790217230, "transport": "t", "ja3_hash": "7b33246e569d8b9b3ab2c3595b7f3d7f", "ja3_variant_count": 1, "ja3_variants": [ "7b33246e569d8b9b3ab2c3595b7f3d7f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_d74d3e796514", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "d74d3e796514", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-65281-11-23-65037-35-10-13-43-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791178742, "last_seen": 1791178742, "transport": "t", "ja3_hash": "31f7ff383c078e834e685e8328425935", "ja3_variant_count": 1, "ja3_variants": [ "31f7ff383c078e834e685e8328425935" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_eb301d6ffdc9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "eb301d6ffdc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-23-43-5-0-65281-35-10-27-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789627301, "last_seen": 1789627301, "transport": "t", "ja3_hash": "b73b702868174a280adcf4bd0db5b0ac", "ja3_variant_count": 1, "ja3_variants": [ "b73b702868174a280adcf4bd0db5b0ac" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_ecd887dcf077", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "ecd887dcf077", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-27-0-11-5-45-65281-43-23-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790242948, "last_seen": 1790242948, "transport": "t", "ja3_hash": "521492cf5b8e2af3d7ec616438664ee2", "ja3_variant_count": 1, "ja3_variants": [ "521492cf5b8e2af3d7ec616438664ee2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_f577fa8935a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "f577fa8935a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-23-0-65281-13-5-35-45-10-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789853892, "last_seen": 1789853892, "transport": "t", "ja3_hash": "7d5b6ee65eb6d606dbe3aba9f02bbc15", "ja3_variant_count": 1, "ja3_variants": [ "7d5b6ee65eb6d606dbe3aba9f02bbc15" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 29 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_fb9f4b3da8dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "fb9f4b3da8dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-43-35-13-11-45-18-65037-0-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790203902, "last_seen": 1790203902, "transport": "t", "ja3_hash": "20cd4e45e31c16885a0beee906e3ea47", "ja3_variant_count": 1, "ja3_variants": [ "20cd4e45e31c16885a0beee906e3ea47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 22 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_fe746e694ea6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "fe746e694ea6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-65281-11-10-65037-5-23-43-35-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790241348, "last_seen": 1791122615, "transport": "t", "ja3_hash": "c429d3537be04d5331164dfad4f5bdec", "ja3_variant_count": 2, "ja3_variants": [ "c429d3537be04d5331164dfad4f5bdec", "2a36da6b3b2668206300deaaae3529ee" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 2 }, "ua_disagreement": false } }, { "hash": "t13d1512h1_8daaf6152771_43af321e381f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h1", "b": "8daaf6152771", "c": "43af321e381f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-10-0-35-18-27-5-43-23-11-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790558065, "last_seen": 1790558065, "transport": "t", "ja3_hash": "8767530ad8ad1d6dd7d99a5bb814af07", "ja3_variant_count": 1, "ja3_variants": [ "8767530ad8ad1d6dd7d99a5bb814af07" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h1_8daaf6152771_7708c72cb737", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h1", "b": "8daaf6152771", "c": "7708c72cb737", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-43-18-65281-0-65037-10-27-13-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790540021, "last_seen": 1790540021, "transport": "t", "ja3_hash": "063c5824ce3024120e4c5b47099cdcab", "ja3_variant_count": 1, "ja3_variants": [ "063c5824ce3024120e4c5b47099cdcab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h1_8daaf6152771_7ada9660e9c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h1", "b": "8daaf6152771", "c": "7ada9660e9c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-65281-18-16-45-0-11-27-5-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790547443, "last_seen": 1790569175, "transport": "t", "ja3_hash": "d159b56bde07e508593458d9d6018ce9", "ja3_variant_count": 2, "ja3_variants": [ "d159b56bde07e508593458d9d6018ce9", "c49b0192ddfa831628344ccfee6b8bcf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h1_8daaf6152771_ad60ef693faa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h1", "b": "8daaf6152771", "c": "ad60ef693faa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-10-16-45-23-18-65281-0-35-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790643190, "last_seen": 1790643190, "transport": "t", "ja3_hash": "b3c1df589338a94844d521dd271b2513", "ja3_variant_count": 1, "ja3_variants": [ "b3c1df589338a94844d521dd271b2513" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h1_8daaf6152771_bebafabed2a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h1", "b": "8daaf6152771", "c": "bebafabed2a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-35-10-43-65037-5-13-11-0-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790526120, "last_seen": 1790526120, "transport": "t", "ja3_hash": "3189bea36a61b72aa111ea43b790e111", "ja3_variant_count": 1, "ja3_variants": [ "3189bea36a61b72aa111ea43b790e111" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h1_8daaf6152771_e07664b1eb81", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h1", "b": "8daaf6152771", "c": "e07664b1eb81", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-27-35-18-65281-13-45-43-0-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790538240, "last_seen": 1790538240, "transport": "t", "ja3_hash": "c77a08af5e8965c0f9e760994e281642", "ja3_variant_count": 1, "ja3_variants": [ "c77a08af5e8965c0f9e760994e281642" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h1_8daaf6152771_ee5fdd3d11f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h1", "b": "8daaf6152771", "c": "ee5fdd3d11f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-18-10-65037-43-0-45-11-23-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790562176, "last_seen": 1790562176, "transport": "t", "ja3_hash": "bfde89e937737b700d8b8e690a80a59d", "ja3_variant_count": 1, "ja3_variants": [ "bfde89e937737b700d8b8e690a80a59d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h1_8daaf6152771_f05182a826b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h1", "b": "8daaf6152771", "c": "f05182a826b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-18-5-0-16-35-13-65281-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790985271, "last_seen": 1790985271, "transport": "t", "ja3_hash": "50c437341aa06f8f29c9d23b31274a7b", "ja3_variant_count": 1, "ja3_variants": [ "50c437341aa06f8f29c9d23b31274a7b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_0164fa580d60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "0164fa580d60", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-13-23-18-16-10-43-17513-0-35-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788609802, "last_seen": 1788609802, "transport": "t", "ja3_hash": "5662e51d509364dde73dca969d0b8451", "ja3_variant_count": 1, "ja3_variants": [ "5662e51d509364dde73dca969d0b8451" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_029f13e87f96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "029f13e87f96", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-11-45-0-43-65281-10-5-27-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791032442, "last_seen": 1791032442, "transport": "t", "ja3_hash": "41ee5d4372bf3499a8a43d9aa65da262", "ja3_variant_count": 1, "ja3_variants": [ "41ee5d4372bf3499a8a43d9aa65da262" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 OPR/102.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_04e2e80bd37f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "04e2e80bd37f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-43-23-5-0-10-35-11-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789682730, "last_seen": 1789682730, "transport": "t", "ja3_hash": "e10344affe5c47cc1fa5bb7632a01073", "ja3_variant_count": 1, "ja3_variants": [ "e10344affe5c47cc1fa5bb7632a01073" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_090f2b624444", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "090f2b624444", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-18-35-23-13-65037-27-45-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789028628, "last_seen": 1789028628, "transport": "t", "ja3_hash": "db89e742a809e003a06c95bc8452c64e", "ja3_variant_count": 1, "ja3_variants": [ "db89e742a809e003a06c95bc8452c64e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_0995b6d4cea4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "0995b6d4cea4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-13-5-0-23-11-27-43-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790728761, "last_seen": 1790728761, "transport": "t", "ja3_hash": "c9f2f3714125dbe1fedc6430117528f9", "ja3_variant_count": 1, "ja3_variants": [ "c9f2f3714125dbe1fedc6430117528f9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 6 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_0d023f2dc25d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "0d023f2dc25d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-18-11-16-43-65281-0-17613-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789439000, "last_seen": 1790709792, "transport": "t", "ja3_hash": "ed0c9889078894e7afb51059893d7f11", "ja3_variant_count": 2, "ja3_variants": [ "ed0c9889078894e7afb51059893d7f11", "36b024b2b4b36636a2d881727c929d48" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1512h2_8daaf6152771_0ecc311eab21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "0ecc311eab21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-27-45-43-10-16-5-65037-23-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789009659, "last_seen": 1789009659, "transport": "t", "ja3_hash": "75372f74f3f19af5039d085fdd0527b9", "ja3_variant_count": 1, "ja3_variants": [ "75372f74f3f19af5039d085fdd0527b9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_18c558d30639", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "18c558d30639", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-23-0-27-45-5-11-13-18-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791202255, "last_seen": 1791202255, "transport": "t", "ja3_hash": "80d70bdde6bd637178b0bb16d8af6f67", "ja3_variant_count": 1, "ja3_variants": [ "80d70bdde6bd637178b0bb16d8af6f67" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_1a64300c5a06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "1a64300c5a06", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-0-11-10-23-43-18-17613-35-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789346522, "last_seen": 1789346522, "transport": "t", "ja3_hash": "40579b6b14aad156b15b4c3caedc665d", "ja3_variant_count": 1, "ja3_variants": [ "40579b6b14aad156b15b4c3caedc665d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_1cad341dc738", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "1cad341dc738", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-11-35-16-65281-17613-18-43-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790205685, "last_seen": 1790205685, "transport": "t", "ja3_hash": "3175c4d6cfa88414c73ae5c7e58c535c", "ja3_variant_count": 1, "ja3_variants": [ "3175c4d6cfa88414c73ae5c7e58c535c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_23979d033086", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "23979d033086", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-10-65281-16-43-65037-5-35-27-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790349796, "last_seen": 1790349796, "transport": "t", "ja3_hash": "d0531c3f902abb2a513a8a19a13d15e3", "ja3_variant_count": 1, "ja3_variants": [ "d0531c3f902abb2a513a8a19a13d15e3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 45 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_2f4e7de0857d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "2f4e7de0857d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-17613-16-35-51764-23-11-0-13-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788459297, "last_seen": 1788459297, "transport": "t", "ja3_hash": "c36200a8b9419864aa64d576f94a1630", "ja3_variant_count": 1, "ja3_variants": [ "c36200a8b9419864aa64d576f94a1630" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_30ccf3c97a91", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "30ccf3c97a91", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-11-18-10-35-17613-43-65281-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789240082, "last_seen": 1789240082, "transport": "t", "ja3_hash": "4a7a6b540b6dffc7b8f09482a7a8f757", "ja3_variant_count": 1, "ja3_variants": [ "4a7a6b540b6dffc7b8f09482a7a8f757" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_33d8483153fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "33d8483153fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-10-43-65281-11-17613-0-35-16-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790244141, "last_seen": 1790244141, "transport": "t", "ja3_hash": "6da646f7ea1c76d26102101089781b5f", "ja3_variant_count": 1, "ja3_variants": [ "6da646f7ea1c76d26102101089781b5f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_3baaa80d0ead", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "3baaa80d0ead", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-0-43-16-10-45-18-65281-65037-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791271422, "last_seen": 1791271422, "transport": "t", "ja3_hash": "72542d4f00553d70fc70569d4669081c", "ja3_variant_count": 1, "ja3_variants": [ "72542d4f00553d70fc70569d4669081c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4117c4a90569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4117c4a90569", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-65037-0-5-10-18-17613-27-16-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789680537, "last_seen": 1789680537, "transport": "t", "ja3_hash": "b2e5a1d70b39e07de4278397b831de35", "ja3_variant_count": 1, "ja3_variants": [ "b2e5a1d70b39e07de4278397b831de35" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_470abf78f606", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "470abf78f606", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-11-10-65281-35-16-43-5-13-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788803576, "last_seen": 1790720309, "transport": "t", "ja3_hash": "69f50d405792b939b373b333103494a9", "ja3_variant_count": 2, "ja3_variants": [ "69f50d405792b939b373b333103494a9", "e258164c3235eaae51481ca9be09de38" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_479def3d05ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "479def3d05ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-35-13-23-10-11-5-0-16-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789950612, "last_seen": 1789950612, "transport": "t", "ja3_hash": "bba2dae0fad0a764f273b6cfbcfc5c72", "ja3_variant_count": 1, "ja3_variants": [ "bba2dae0fad0a764f273b6cfbcfc5c72" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_47f6b8fd4452", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "47f6b8fd4452", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-0-23-43-16-65037-18-45-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790236908, "last_seen": 1790236908, "transport": "t", "ja3_hash": "b89f1d8f8b2f2bf55d5594bebf2a4581", "ja3_variant_count": 1, "ja3_variants": [ "b89f1d8f8b2f2bf55d5594bebf2a4581" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_498c980218f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "498c980218f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-65281-17613-65037-43-16-0-45-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789460144, "last_seen": 1789460144, "transport": "t", "ja3_hash": "47deee615069d42b93b9e547f4346829", "ja3_variant_count": 1, "ja3_variants": [ "47deee615069d42b93b9e547f4346829" ], "user_agents": { "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 36, "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4ba36ce0a94a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4ba36ce0a94a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-16-13-5-18-43-0-65037-23-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790976940, "last_seen": 1790976940, "transport": "t", "ja3_hash": "43770c4397ceff5adb26fb8d408ceda5", "ja3_variant_count": 1, "ja3_variants": [ "43770c4397ceff5adb26fb8d408ceda5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4e87461a2012", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4e87461a2012", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-11-13-17613-45-27-43-16-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789684752, "last_seen": 1789684752, "transport": "t", "ja3_hash": "989f3b10a348d73702ee4c63fc879b03", "ja3_variant_count": 1, "ja3_variants": [ "989f3b10a348d73702ee4c63fc879b03" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_506513ca4efe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "506513ca4efe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-43-16-35-27-65281-5-65037-18-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790591323, "last_seen": 1791208458, "transport": "t", "ja3_hash": "96fc65dee8cb20ea9d5e91a708ffe17c", "ja3_variant_count": 2, "ja3_variants": [ "96fc65dee8cb20ea9d5e91a708ffe17c", "37adb51d36766410923e6c5d392b2247" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_5265f16c3442", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "5265f16c3442", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-65037-5-43-0-17613-65281-13-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790515791, "last_seen": 1790515791, "transport": "t", "ja3_hash": "d440e091b57bb90dbd967f58c7c69619", "ja3_variant_count": 1, "ja3_variants": [ "d440e091b57bb90dbd967f58c7c69619" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 46 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_5284d20f7339", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "5284d20f7339", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-43-35-18-11-16-17613-27-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788613696, "last_seen": 1788613696, "transport": "t", "ja3_hash": "08ca361b722e7a42a161868e9e9f4d35", "ja3_variant_count": 1, "ja3_variants": [ "08ca361b722e7a42a161868e9e9f4d35" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_53bdea693e3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "53bdea693e3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-35-11-65281-51-13-23-27-16-45-0,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790994680, "last_seen": 1790994680, "transport": "t", "ja3_hash": "36d1fe2a389443da1799aad25ea362a3", "ja3_variant_count": 1, "ja3_variants": [ "36d1fe2a389443da1799aad25ea362a3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 OPR/113.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_54c81a6289ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "54c81a6289ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-45-65037-13-23-65281-43-5-35-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790196902, "last_seen": 1790196902, "transport": "t", "ja3_hash": "e7a235bd0fc6de8ba17d48e3de4d1b81", "ja3_variant_count": 1, "ja3_variants": [ "e7a235bd0fc6de8ba17d48e3de4d1b81" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_56d13b147629", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "56d13b147629", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-35-5-0-18-43-23-27-16-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791312842, "last_seen": 1791312842, "transport": "t", "ja3_hash": "3689d21e6a38afead5adb7cf77ccd608", "ja3_variant_count": 1, "ja3_variants": [ "3689d21e6a38afead5adb7cf77ccd608" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_5868912341af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "5868912341af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-0-18-17513-35-16-10-43-27-45-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791114545, "last_seen": 1791114545, "transport": "t", "ja3_hash": "84a252e4fc1cb6062eec50974d59cc81", "ja3_variant_count": 1, "ja3_variants": [ "84a252e4fc1cb6062eec50974d59cc81" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_5f55ff25f7d3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "5f55ff25f7d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-16-43-35-23-18-45-13-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790233628, "last_seen": 1790233628, "transport": "t", "ja3_hash": "802361139b49b94e0fcabe5a260c1216", "ja3_variant_count": 1, "ja3_variants": [ "802361139b49b94e0fcabe5a260c1216" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_5f71f9687479", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "5f71f9687479", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-5-0-10-16-65281-11-13-43-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789553267, "last_seen": 1789553267, "transport": "t", "ja3_hash": "6fdc589441d112de93b961f9783c9278", "ja3_variant_count": 1, "ja3_variants": [ "6fdc589441d112de93b961f9783c9278" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_60793e3e24b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "60793e3e24b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-11-18-43-65037-0-5-16-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790644615, "last_seen": 1790644615, "transport": "t", "ja3_hash": "1563ea6f14371f23e4904da990da100c", "ja3_variant_count": 1, "ja3_variants": [ "1563ea6f14371f23e4904da990da100c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_6471376ec52a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "6471376ec52a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-23-17613-0-43-27-13-16-65281-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790517868, "last_seen": 1790517868, "transport": "t", "ja3_hash": "7f4983860754d4ad2da5702e766961f0", "ja3_variant_count": 1, "ja3_variants": [ "7f4983860754d4ad2da5702e766961f0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_6ca01b61b4de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "6ca01b61b4de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-35-43-23-16-51764-11-0-13-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790819934, "last_seen": 1790819934, "transport": "t", "ja3_hash": "17b5c9656ead5719076b5c23218126e4", "ja3_variant_count": 1, "ja3_variants": [ "17b5c9656ead5719076b5c23218126e4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_722cd7a6e829", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "722cd7a6e829", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-43-45-27-35-0-11-17613-65037-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790239764, "last_seen": 1790239764, "transport": "t", "ja3_hash": "3b78b64b968bbe078433c4e72cc47b2b", "ja3_variant_count": 1, "ja3_variants": [ "3b78b64b968bbe078433c4e72cc47b2b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_745d60ce57c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "745d60ce57c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-10-18-43-16-45-27-17613-5-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788813118, "last_seen": 1788813118, "transport": "t", "ja3_hash": "8c7dd42d36936b608312ce854eff25ab", "ja3_variant_count": 1, "ja3_variants": [ "8c7dd42d36936b608312ce854eff25ab" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_7ac645823a56", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "7ac645823a56", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-27-11-5-43-17613-16-35-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790224907, "last_seen": 1790224907, "transport": "t", "ja3_hash": "29a11a62ff58d638a2683535bf43541e", "ja3_variant_count": 1, "ja3_variants": [ "29a11a62ff58d638a2683535bf43541e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_7bb9ecec12a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "7bb9ecec12a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-65281-45-43-18-16-11-27-35-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788799950, "last_seen": 1788799950, "transport": "t", "ja3_hash": "ec8a8fa7eca883d2736b36cc7614f8f1", "ja3_variant_count": 1, "ja3_variants": [ "ec8a8fa7eca883d2736b36cc7614f8f1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_8041a0afd8ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "8041a0afd8ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-43-65037-5-35-17613-0-11-45-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790697614, "last_seen": 1790697614, "transport": "t", "ja3_hash": "de562b535d4da5c8135f40e48df6799a", "ja3_variant_count": 1, "ja3_variants": [ "de562b535d4da5c8135f40e48df6799a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_82f704cc09a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "82f704cc09a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65281-65037-17513-11-5-16-27-18-43-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791258926, "last_seen": 1791258926, "transport": "t", "ja3_hash": "57c11b44db5aef0d5419e6d30a1f7c84", "ja3_variant_count": 1, "ja3_variants": [ "57c11b44db5aef0d5419e6d30a1f7c84" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_86ee84b7f6e8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "86ee84b7f6e8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-27-13-16-0-18-43-10-5-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791165716, "last_seen": 1791165716, "transport": "t", "ja3_hash": "b99fdd2942eb29ab6d77920a8879e1d4", "ja3_variant_count": 1, "ja3_variants": [ "b99fdd2942eb29ab6d77920a8879e1d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_86f213f20ee2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "86f213f20ee2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-17513-0-23-65037-45-11-5-43-16-18,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790941762, "last_seen": 1790941763, "transport": "t", "ja3_hash": "f8512e5f82c57a1ba46a0fdcebdc53ed", "ja3_variant_count": 2, "ja3_variants": [ "f8512e5f82c57a1ba46a0fdcebdc53ed", "3d1d6bfca24e7ce9114f8dc708ae6180" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_8921b53345fb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "8921b53345fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-10-23-35-27-18-16-5-43-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789998629, "last_seen": 1789998629, "transport": "t", "ja3_hash": "97c0f4c6f55d16c9b0ab86c28a4d55fc", "ja3_variant_count": 1, "ja3_variants": [ "97c0f4c6f55d16c9b0ab86c28a4d55fc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_896b74617a5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "896b74617a5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-43-65281-65037-16-13-45-10-0-23-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791274605, "last_seen": 1791274605, "transport": "t", "ja3_hash": "1a4348e9d7dbbf22acbcd6cfff72b0cd", "ja3_variant_count": 1, "ja3_variants": [ "1a4348e9d7dbbf22acbcd6cfff72b0cd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_9110f32f0a82", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "9110f32f0a82", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-27-43-23-17613-11-18-45-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788765319, "last_seen": 1790225801, "transport": "t", "ja3_hash": "89391ca6f49100f2265703bc0e6ce3d9", "ja3_variant_count": 2, "ja3_variants": [ "89391ca6f49100f2265703bc0e6ce3d9", "dd591b0caccc18d9ebdf268eb29660cf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_92a40b79ddcb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "92a40b79ddcb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-43-35-45-10-0-16-65037-18-65281-17513,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790942444, "last_seen": 1790942444, "transport": "t", "ja3_hash": "50bc89c1cb21696f7869ffe4653347b6", "ja3_variant_count": 1, "ja3_variants": [ "50bc89c1cb21696f7869ffe4653347b6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_92e350bcc232", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "92e350bcc232", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-27-43-23-0-11-16-45-65281-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791296174, "last_seen": 1791296174, "transport": "t", "ja3_hash": "4103fe40be96fc809d90cac73252f407", "ja3_variant_count": 1, "ja3_variants": [ "4103fe40be96fc809d90cac73252f407" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_9d4d2f995502", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "9d4d2f995502", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-16-18-23-65281-45-35-11-17613-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790227668, "last_seen": 1790227668, "transport": "t", "ja3_hash": "e2521d7a58ad548503aeafb388697800", "ja3_variant_count": 1, "ja3_variants": [ "e2521d7a58ad548503aeafb388697800" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_9de5a55bffef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "9de5a55bffef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-43-65037-10-5-13-11-45-27-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788900215, "last_seen": 1788900215, "transport": "t", "ja3_hash": "97e8f511fc14aafa1054bcbda862f1f1", "ja3_variant_count": 1, "ja3_variants": [ "97e8f511fc14aafa1054bcbda862f1f1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 23 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_9de9a9e1ad3b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "9de9a9e1ad3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-35-23-13-11-17613-65281-18-43-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790258377, "last_seen": 1790258377, "transport": "t", "ja3_hash": "47b06e4c38dbab27b7b5b1366e7d979d", "ja3_variant_count": 1, "ja3_variants": [ "47b06e4c38dbab27b7b5b1366e7d979d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_a234399ea0b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "a234399ea0b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,43-11-10-65281-0-5-16-13-23-45-51-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790779039, "last_seen": 1790779041, "transport": "t", "ja3_hash": "a7a6f37ed5ccdc94efcac076c9eec440", "ja3_variant_count": 1, "ja3_variants": [ "a7a6f37ed5ccdc94efcac076c9eec440" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_a25286a7807b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "a25286a7807b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-35-43-16-65281-27-10-45-23-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790869317, "last_seen": 1790869317, "transport": "t", "ja3_hash": "a78ea260e9de91cdedf6783301ca177d", "ja3_variant_count": 1, "ja3_variants": [ "a78ea260e9de91cdedf6783301ca177d" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_abf4d888cfeb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "abf4d888cfeb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-10-5-35-45-43-27-17613-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790241794, "last_seen": 1790968613, "transport": "t", "ja3_hash": "c91e48d3baefc93cb4c15c0d5eb6d7f1", "ja3_variant_count": 2, "ja3_variants": [ "c91e48d3baefc93cb4c15c0d5eb6d7f1", "1759874cf7732578e5dd773cf99eee13" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_ad60ef693faa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "ad60ef693faa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-45-35-18-5-27-43-65281-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789759376, "last_seen": 1789759376, "transport": "t", "ja3_hash": "71f38aeff2f40adf58bc493e7331ae91", "ja3_variant_count": 1, "ja3_variants": [ "71f38aeff2f40adf58bc493e7331ae91" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_ae26a69997a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "ae26a69997a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-35-0-11-18-5-16-43-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790231832, "last_seen": 1790231832, "transport": "t", "ja3_hash": "0184f5ea740197378cc938d30d2655a5", "ja3_variant_count": 1, "ja3_variants": [ "0184f5ea740197378cc938d30d2655a5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_afeaa8411626", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "afeaa8411626", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-17613-18-43-0-35-11-65037-16-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790415884, "last_seen": 1791132326, "transport": "t", "ja3_hash": "0c201164301881712dce8299cd267da6", "ja3_variant_count": 2, "ja3_variants": [ "0c201164301881712dce8299cd267da6", "c0a79d0b2d8e0e035735399ed50042d2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_b34bc8926288", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "b34bc8926288", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-43-27-16-10-5-0-17613-65037-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790816049, "last_seen": 1790816049, "transport": "t", "ja3_hash": "07d4ea027854827e3fb82c6d8716bbdb", "ja3_variant_count": 1, "ja3_variants": [ "07d4ea027854827e3fb82c6d8716bbdb" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_ba19759e0765", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "ba19759e0765", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-0-65281-43-17613-18-45-13-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790226235, "last_seen": 1790226235, "transport": "t", "ja3_hash": "7e99e560090542e885f6c399d168f003", "ja3_variant_count": 1, "ja3_variants": [ "7e99e560090542e885f6c399d168f003" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_bc5faf27bf7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "bc5faf27bf7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-35-5-17513-23-16-18-65037-0-27-43,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790749933, "last_seen": 1790749933, "transport": "t", "ja3_hash": "9e5c733f28b94d59bf8e4e3a90025b61", "ja3_variant_count": 1, "ja3_variants": [ "9e5c733f28b94d59bf8e4e3a90025b61" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c5f86ab03df0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c5f86ab03df0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-43-10-18-13-27-17513-16-65281-51-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791289518, "last_seen": 1791289518, "transport": "t", "ja3_hash": "152c6d419840b0772dfe8154ad58d978", "ja3_variant_count": 1, "ja3_variants": [ "152c6d419840b0772dfe8154ad58d978" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c80afcb9d01f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c80afcb9d01f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-16-13-11-10-0-43-17613-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789686303, "last_seen": 1789686303, "transport": "t", "ja3_hash": "b03e5bdb3e62bfb13e43b0fd57fac9bb", "ja3_variant_count": 1, "ja3_variants": [ "b03e5bdb3e62bfb13e43b0fd57fac9bb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c8d9e32dfc3f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c8d9e32dfc3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-0-23-27-17613-43-11-35-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788778642, "last_seen": 1788778642, "transport": "t", "ja3_hash": "b27dfaba2aa05de39198a5f4c24a58c2", "ja3_variant_count": 1, "ja3_variants": [ "b27dfaba2aa05de39198a5f4c24a58c2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c94d08fa97eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c94d08fa97eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-16-23-65281-5-11-0-18-43-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788778330, "last_seen": 1788778330, "transport": "t", "ja3_hash": "ed64910369fc22f878ebadc05b0c0c0f", "ja3_variant_count": 1, "ja3_variants": [ "ed64910369fc22f878ebadc05b0c0c0f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_cbf5d407ad44", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "cbf5d407ad44", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-45-16-23-43-13-35-10-0-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790781381, "last_seen": 1790781381, "transport": "t", "ja3_hash": "87e7d435e869af1d9e4f93e37450d790", "ja3_variant_count": 1, "ja3_variants": [ "87e7d435e869af1d9e4f93e37450d790" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_cc117b114c2c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "cc117b114c2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-23-43-45-13-5-65281-65037-18-35-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791106596, "last_seen": 1791106596, "transport": "t", "ja3_hash": "51cb248214cda78f21c8887f0ead9883", "ja3_variant_count": 1, "ja3_variants": [ "51cb248214cda78f21c8887f0ead9883" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_d53a3f86ebec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "d53a3f86ebec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-16-11-18-5-17613-65037-23-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789018173, "last_seen": 1789018173, "transport": "t", "ja3_hash": "8be44019d0cf060ef514ba8b4d2292a7", "ja3_variant_count": 1, "ja3_variants": [ "8be44019d0cf060ef514ba8b4d2292a7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_d786283522ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "d786283522ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-11-10-35-5-16-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 50, "first_seen": 1787454857, "last_seen": 1791315922, "transport": "t", "ja3_hash": "bf57dec2e7a00870764f29e4d2e5a521", "ja3_variant_count": 2, "ja3_variants": [ "bf57dec2e7a00870764f29e4d2e5a521", "31ba28560180a9fb2135216a4e100a01" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 101, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 50 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_db75a43a3a00", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "db75a43a3a00", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-16-65281-0-27-35-5-13-18-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790160943, "last_seen": 1791263914, "transport": "t", "ja3_hash": "75b1682c0886f0149e721d2ba6b21b48", "ja3_variant_count": 2, "ja3_variants": [ "75b1682c0886f0149e721d2ba6b21b48", "6b2bf5d065fea9cff2ac2fa72650949b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 80 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_dc03ff9ea80c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "dc03ff9ea80c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-51764-18-35-43-27-45-11-0-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790276512, "last_seen": 1790276512, "transport": "t", "ja3_hash": "e1913cb2bacb3e967d5afb78572d8ab9", "ja3_variant_count": 1, "ja3_variants": [ "e1913cb2bacb3e967d5afb78572d8ab9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_df33fa9fde1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "df33fa9fde1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-11-0-35-10-43-13-16-18-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789663248, "last_seen": 1789663248, "transport": "t", "ja3_hash": "37efaed3db5de2a8b00cdd2dfd33a308", "ja3_variant_count": 1, "ja3_variants": [ "37efaed3db5de2a8b00cdd2dfd33a308" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_e6be585f08e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "e6be585f08e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-5-65281-65037-10-16-0-13-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790537588, "last_seen": 1790537588, "transport": "t", "ja3_hash": "32c51180f1fcedeadf187532bb834762", "ja3_variant_count": 1, "ja3_variants": [ "32c51180f1fcedeadf187532bb834762" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_e914590bca29", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "e914590bca29", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-65037-65281-5-43-45-35-10-0-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789326016, "last_seen": 1789326016, "transport": "t", "ja3_hash": "831277ba014daf3e618f69b3ca214ed1", "ja3_variant_count": 1, "ja3_variants": [ "831277ba014daf3e618f69b3ca214ed1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_eb8e8aae6a2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "eb8e8aae6a2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-16-13-5-35-45-27-10-23-18-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789657902, "last_seen": 1790231574, "transport": "t", "ja3_hash": "5c0aa93feeed11f4580124d67385808b", "ja3_variant_count": 2, "ja3_variants": [ "5c0aa93feeed11f4580124d67385808b", "cd57b19a5d076ce34c5efa4eadbb045c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f2ac47f4899b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f2ac47f4899b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-27-35-16-0-65281-45-11-17613-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788617384, "last_seen": 1789026658, "transport": "t", "ja3_hash": "e952db13f5c79b8d8667ed684e1a2b04", "ja3_variant_count": 2, "ja3_variants": [ "e952db13f5c79b8d8667ed684e1a2b04", "0b70cef999a083031b95ed9092bbf3a9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f492697151d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f492697151d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17513-23-0-10-43-65281-45-5-18-51-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790950058, "last_seen": 1790950058, "transport": "t", "ja3_hash": "e04470792aeb568d040c81cc764a22e4", "ja3_variant_count": 1, "ja3_variants": [ "e04470792aeb568d040c81cc764a22e4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f5ed932adb5b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f5ed932adb5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-16-45-13-18-35-17613-0-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788704452, "last_seen": 1788704452, "transport": "t", "ja3_hash": "f0c8de8254e6492f942736e5ab2dc420", "ja3_variant_count": 1, "ja3_variants": [ "f0c8de8254e6492f942736e5ab2dc420" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f60d493e73b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f60d493e73b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-18-17613-65281-5-13-10-23-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788974433, "last_seen": 1790042184, "transport": "t", "ja3_hash": "e477832203c86afd6e19607233bc7dff", "ja3_variant_count": 2, "ja3_variants": [ "e477832203c86afd6e19607233bc7dff", "5f76e7319867322e1012ac32eef4554f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_fd9bfc4d791b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "fd9bfc4d791b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-23-13-17613-0-43-35-65037-16-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789170587, "last_seen": 1789170587, "transport": "t", "ja3_hash": "765113a258ef48d76a5acbfdc37d9a6a", "ja3_variant_count": 1, "ja3_variants": [ "765113a258ef48d76a5acbfdc37d9a6a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_fdc520a270ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "fdc520a270ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,65281-0-11-10-35-5-16-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1790768895, "last_seen": 1791101316, "transport": "t", "ja3_hash": "78d5e506f3ae318a94eb40cc48adee1b", "ja3_variant_count": 1, "ja3_variants": [ "78d5e506f3ae318a94eb40cc48adee1b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 60 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_20343810f850", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "20343810f850", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-27-23-17613-43-18-65281-10-35-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790247361, "last_seen": 1790247361, "transport": "t", "ja3_hash": "74030a9411cbe6e736d59fce610b0692", "ja3_variant_count": 1, "ja3_variants": [ "74030a9411cbe6e736d59fce610b0692" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_224cb8d4eab3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "224cb8d4eab3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-13-18-5-10-17613-0-45-43-35-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790247052, "last_seen": 1791080392, "transport": "t", "ja3_hash": "4241cc71a12d64baa02f0c5608e29ae0", "ja3_variant_count": 3, "ja3_variants": [ "4241cc71a12d64baa02f0c5608e29ae0", "1920caf2b9c01177f71fb501968d9d2e", "e2069a960f3cbe2e77b5cdd149b4e647" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_268af3b1fe2b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "268af3b1fe2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-35-65037-10-17613-45-13-43-23-18-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788670828, "last_seen": 1788670828, "transport": "t", "ja3_hash": "28982f234eadf90df3d8594a20538432", "ja3_variant_count": 1, "ja3_variants": [ "28982f234eadf90df3d8594a20538432" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 13 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_27acb299055b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "27acb299055b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-10-17613-23-27-51764-11-5-0-43-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790948027, "last_seen": 1790948027, "transport": "t", "ja3_hash": "463f5cd5d2b9fcba6b1c362c571d9e39", "ja3_variant_count": 1, "ja3_variants": [ "463f5cd5d2b9fcba6b1c362c571d9e39" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_2cf96e366668", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "2cf96e366668", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-65281-5-18-13-35-17613-10-27-43-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788568575, "last_seen": 1788568575, "transport": "t", "ja3_hash": "2210a55d8f29476fa237e741a5bc977b", "ja3_variant_count": 1, "ja3_variants": [ "2210a55d8f29476fa237e741a5bc977b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_2f17227a75b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "2f17227a75b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-17613-65281-27-0-23-65037-13-18-43-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791137975, "last_seen": 1791233384, "transport": "t", "ja3_hash": "2228c6d226d8188dc50a4170beb479cf", "ja3_variant_count": 2, "ja3_variants": [ "2228c6d226d8188dc50a4170beb479cf", "29f1ed387d55a12d74797da7d0633730" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_34349be5a8b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "34349be5a8b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-5-65037-23-35-17613-45-43-11-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789048549, "last_seen": 1789048549, "transport": "t", "ja3_hash": "b161bd180922712cd7f3503193ba3b75", "ja3_variant_count": 1, "ja3_variants": [ "b161bd180922712cd7f3503193ba3b75" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_3d0d84176778", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "3d0d84176778", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-65281-17613-18-10-23-0-13-5-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791186123, "last_seen": 1791186123, "transport": "t", "ja3_hash": "b06e052e9a02f744b190f53c23c7d58a", "ja3_variant_count": 1, "ja3_variants": [ "b06e052e9a02f744b190f53c23c7d58a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_47357f42791c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "47357f42791c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-17613-23-65281-11-18-10-27-43-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788793301, "last_seen": 1788793301, "transport": "t", "ja3_hash": "95b03b1a11aa6c639a484f0a6c6c53b4", "ja3_variant_count": 1, "ja3_variants": [ "95b03b1a11aa6c639a484f0a6c6c53b4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_4a2875325200", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "4a2875325200", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-17613-0-45-65037-18-23-35-11-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789687306, "last_seen": 1789687306, "transport": "t", "ja3_hash": "0703401c3416791fa76ced96da2ad19b", "ja3_variant_count": 1, "ja3_variants": [ "0703401c3416791fa76ced96da2ad19b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_4bd7c67ac9cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "4bd7c67ac9cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-4832-10-18-5-17613-11-43-23-13-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788713051, "last_seen": 1788713051, "transport": "t", "ja3_hash": "53fddee5a5234fc8e97be0dfff9f9d56", "ja3_variant_count": 1, "ja3_variants": [ "53fddee5a5234fc8e97be0dfff9f9d56" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_59f978666741", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "59f978666741", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-43-5-10-65281-23-35-13-65037-0-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790265598, "last_seen": 1790265598, "transport": "t", "ja3_hash": "b3cd839e66cd5cfc44cf61d803585bd7", "ja3_variant_count": 1, "ja3_variants": [ "b3cd839e66cd5cfc44cf61d803585bd7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 27 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_605a68f2a083", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "605a68f2a083", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-5-65037-0-43-11-35-10-23-65281-27-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789879472, "last_seen": 1790568139, "transport": "t", "ja3_hash": "b90d12a0bee6b9e520e60e7ba2439ece", "ja3_variant_count": 2, "ja3_variants": [ "b90d12a0bee6b9e520e60e7ba2439ece", "20ec1bac9a4cdcfeb80c82dc73117b56" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_6faafa3fc0ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "6faafa3fc0ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-18-0-35-11-27-45-43-17613-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790205783, "last_seen": 1790244504, "transport": "t", "ja3_hash": "9f02bdbab24283ca13e7c84c9be016ca", "ja3_variant_count": 2, "ja3_variants": [ "9f02bdbab24283ca13e7c84c9be016ca", "3cd077b3ad5a53a397e33f77e3183181" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_74d4d6d2e232", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "74d4d6d2e232", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-0-65037-27-17513-43-18-13-11-35-45-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790956861, "last_seen": 1790956861, "transport": "t", "ja3_hash": "655639d89b91c7d0946655117c20c38d", "ja3_variant_count": 1, "ja3_variants": [ "655639d89b91c7d0946655117c20c38d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_7c1cb1840f01", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "7c1cb1840f01", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-13-65037-0-18-10-43-5-27-23-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788843316, "last_seen": 1788843316, "transport": "t", "ja3_hash": "5f63e55a15890df6cca972097e504648", "ja3_variant_count": 1, "ja3_variants": [ "5f63e55a15890df6cca972097e504648" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_7f5d6971f013", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "7f5d6971f013", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-65037-11-35-45-27-13-18-0-65281-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789912221, "last_seen": 1789912221, "transport": "t", "ja3_hash": "34445555d43ce81c71659feca331e1f6", "ja3_variant_count": 1, "ja3_variants": [ "34445555d43ce81c71659feca331e1f6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 7 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_93dea2ee8131", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "93dea2ee8131", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-13-0-17613-35-43-51764-10-18-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789641937, "last_seen": 1789641937, "transport": "t", "ja3_hash": "56257a2960979e47eca674879ddeda06", "ja3_variant_count": 1, "ja3_variants": [ "56257a2960979e47eca674879ddeda06" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_96adf60f901a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "96adf60f901a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-10-17613-35-65281-45-11-0-13-5-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790256353, "last_seen": 1790256353, "transport": "t", "ja3_hash": "4a6f4915f4176dabe7dc84516479f5c8", "ja3_variant_count": 1, "ja3_variants": [ "4a6f4915f4176dabe7dc84516479f5c8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_b5d0d3665e38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "b5d0d3665e38", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-23-13-65281-43-35-45-0-5-17613-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788634749, "last_seen": 1790337200, "transport": "t", "ja3_hash": "8cc39438316bacb2adf38edb7aea1eff", "ja3_variant_count": 2, "ja3_variants": [ "8cc39438316bacb2adf38edb7aea1eff", "d3e67f47b4355a6c0e9206b453c2617a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_b98e6d6adde4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "b98e6d6adde4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-45-13-65037-0-23-65281-43-35-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788874032, "last_seen": 1788874032, "transport": "t", "ja3_hash": "abc3061e737ee63f6ff8a4994455d1a0", "ja3_variant_count": 1, "ja3_variants": [ "abc3061e737ee63f6ff8a4994455d1a0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_b9ad58eb41fb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "b9ad58eb41fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-45-17613-11-65037-43-35-13-65281-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789043622, "last_seen": 1790520553, "transport": "t", "ja3_hash": "90c82a2ed7c0f530d5396d7be1e10378", "ja3_variant_count": 2, "ja3_variants": [ "90c82a2ed7c0f530d5396d7be1e10378", "369b4b19340edc16f569c63f8593ba1b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_bbb3b3c18aa5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "bbb3b3c18aa5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-11-27-10-51-65281-13-35-5-0-45-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788691431, "last_seen": 1790749677, "transport": "t", "ja3_hash": "1a01ea8c12b0c048ec0bc29183f98614", "ja3_variant_count": 2, "ja3_variants": [ "1a01ea8c12b0c048ec0bc29183f98614", "43800a79306eb6933860e3410a163516" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 9 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_bc7e2dcba23b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "bc7e2dcba23b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-27-65281-0-35-65037-23-18-13-5-43-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791142251, "last_seen": 1791142251, "transport": "t", "ja3_hash": "9c9faadadee2c55720902300f1ab62b7", "ja3_variant_count": 1, "ja3_variants": [ "9c9faadadee2c55720902300f1ab62b7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_bdb5edfdaf92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "bdb5edfdaf92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-45-17613-0-65037-43-18-23-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791084829, "last_seen": 1791084829, "transport": "t", "ja3_hash": "257f7e64ea76f084c7e40ce35efa28eb", "ja3_variant_count": 1, "ja3_variants": [ "257f7e64ea76f084c7e40ce35efa28eb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_c4dc4e121602", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "c4dc4e121602", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-13-5-27-65281-17613-10-43-35-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788916157, "last_seen": 1788916157, "transport": "t", "ja3_hash": "c2581cacdde6301913cc78f2760fa31a", "ja3_variant_count": 1, "ja3_variants": [ "c2581cacdde6301913cc78f2760fa31a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_c67bf4e3931d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "c67bf4e3931d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-13-23-27-10-45-18-11-0-65037-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788884561, "last_seen": 1790569439, "transport": "t", "ja3_hash": "a25561165ad66cba186e6322963df364", "ja3_variant_count": 2, "ja3_variants": [ "a25561165ad66cba186e6322963df364", "073d547148bfbf761fa9dfed1c2d2dd1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_c8d981156ff5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "c8d981156ff5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-35-0-13-65281-45-43-18-27-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788798875, "last_seen": 1788798875, "transport": "t", "ja3_hash": "ae2f997f6f76374c9e6ab62fdabf8658", "ja3_variant_count": 1, "ja3_variants": [ "ae2f997f6f76374c9e6ab62fdabf8658" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_caf8bae1a533", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "caf8bae1a533", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-23-10-65281-18-43-11-65037-27-5-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789703469, "last_seen": 1790752268, "transport": "t", "ja3_hash": "f8ae62c38bd7442b64ddae16afadeb75", "ja3_variant_count": 3, "ja3_variants": [ "f8ae62c38bd7442b64ddae16afadeb75", "15d0a88418bfd605a1ed86e55705cb4d", "c55c8351c5d26c168fea87ab22cda2e0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_cfe4dda37004", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "cfe4dda37004", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-45-17613-0-13-65037-18-5-65281-35-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789829932, "last_seen": 1789829932, "transport": "t", "ja3_hash": "be1b66938efc3d835fee85389bbaf6d2", "ja3_variant_count": 1, "ja3_variants": [ "be1b66938efc3d835fee85389bbaf6d2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_d4e331375a5e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "d4e331375a5e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-35-5-65037-45-0-27-11-13-65281-10-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789883791, "last_seen": 1790006767, "transport": "t", "ja3_hash": "06730deb66235433f4fdde0613e5654a", "ja3_variant_count": 2, "ja3_variants": [ "06730deb66235433f4fdde0613e5654a", "f969a9d7b06090242e7d67132957bb40" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_d71ff1212b7d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "d71ff1212b7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-10-18-23-5-27-0-17613-45-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790488639, "last_seen": 1790488639, "transport": "t", "ja3_hash": "4124aaeba00e8b8aedefa2a055f263f9", "ja3_variant_count": 1, "ja3_variants": [ "4124aaeba00e8b8aedefa2a055f263f9" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_db7b85edac3f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "db7b85edac3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-13-10-17513-27-18-23-11-35-45-0-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791260558, "last_seen": 1791260558, "transport": "t", "ja3_hash": "8791aebf65638979b04e6ee5defd2420", "ja3_variant_count": 1, "ja3_variants": [ "8791aebf65638979b04e6ee5defd2420" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_e5a3b5057b72", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "e5a3b5057b72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-43-65281-45-27-0-10-11-17613-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788678206, "last_seen": 1788678206, "transport": "t", "ja3_hash": "935d77af5505ca5a7f97207a56f69a8a", "ja3_variant_count": 1, "ja3_variants": [ "935d77af5505ca5a7f97207a56f69a8a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_e7b1aae15fe9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "e7b1aae15fe9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-13-23-35-10-17613-11-0-65037-18-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788659504, "last_seen": 1789697901, "transport": "t", "ja3_hash": "b59093a1db481443944a1e52cb8b7179", "ja3_variant_count": 2, "ja3_variants": [ "b59093a1db481443944a1e52cb8b7179", "0384d5abf9616335204fec7fe7dace7d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_e7e066439064", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "e7e066439064", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-10-27-11-13-23-0-5-65281-35-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790205269, "last_seen": 1790521315, "transport": "t", "ja3_hash": "e681c950566f79dae9d47a18c3664d62", "ja3_variant_count": 2, "ja3_variants": [ "e681c950566f79dae9d47a18c3664d62", "59baa375351f2e3f51a179a5369d7a38" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_e9b96d77b19a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "e9b96d77b19a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-43-51-65281-18-23-65037-5-0-45-10-35-13,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791143450, "last_seen": 1791143450, "transport": "t", "ja3_hash": "cdeaf879667edea872fb40365a254cc3", "ja3_variant_count": 1, "ja3_variants": [ "cdeaf879667edea872fb40365a254cc3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_f05402644bbf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "f05402644bbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-23-17613-45-65037-10-13-35-43-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790872802, "last_seen": 1790872802, "transport": "t", "ja3_hash": "2609047bd1cb32f7fb018c41f74dc695", "ja3_variant_count": 1, "ja3_variants": [ "2609047bd1cb32f7fb018c41f74dc695" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_f7afb4fa0f2e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "f7afb4fa0f2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-27-65037-11-23-5-0-65281-13-17513-45-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106738, "last_seen": 1791106738, "transport": "t", "ja3_hash": "e2e5748c85d738d524c88a0d8d166e1c", "ja3_variant_count": 1, "ja3_variants": [ "e2e5748c85d738d524c88a0d8d166e1c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_fb5b254731e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "fb5b254731e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-13-45-0-10-65281-11-43-35-51764-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791093638, "last_seen": 1791093638, "transport": "t", "ja3_hash": "7b55ec288e7e47842e1ce765c358a80c", "ja3_variant_count": 1, "ja3_variants": [ "7b55ec288e7e47842e1ce765c358a80c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_fddca07d18b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "fddca07d18b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-5-11-27-43-0-35-17613-13-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788527144, "last_seen": 1788527144, "transport": "t", "ja3_hash": "3cc9a413870e23bd88fc6a86c553ea13", "ja3_variant_count": 1, "ja3_variants": [ "3cc9a413870e23bd88fc6a86c553ea13" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_37352656bd0e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "37352656bd0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-0-65037-43-5-11-35-23-45-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790552210, "last_seen": 1790552210, "transport": "t", "ja3_hash": "579569eeb5c75d561c924f2e31f6f0b0", "ja3_variant_count": 1, "ja3_variants": [ "579569eeb5c75d561c924f2e31f6f0b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_4b807bfb6224", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "4b807bfb6224", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-65281-23-35-5-0-27-10-11-43-16-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790528048, "last_seen": 1790528048, "transport": "t", "ja3_hash": "2ac5234c53d088ed385af7fa723219db", "ja3_variant_count": 1, "ja3_variants": [ "2ac5234c53d088ed385af7fa723219db" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_4e485aa33aef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "4e485aa33aef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-18-27-65037-65281-16-45-43-0-35-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790652453, "last_seen": 1790652453, "transport": "t", "ja3_hash": "a0b43b55344d5fa6036bc4b64c6afc8e", "ja3_variant_count": 1, "ja3_variants": [ "a0b43b55344d5fa6036bc4b64c6afc8e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_61f45fc2c1c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "61f45fc2c1c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-16-5-23-18-43-65037-45-10-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790536162, "last_seen": 1790998493, "transport": "t", "ja3_hash": "7b78d303db377047b3b7d6a7697c98b8", "ja3_variant_count": 2, "ja3_variants": [ "7b78d303db377047b3b7d6a7697c98b8", "c3b8a74513ab8c945aafb54758453c49" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_a23585307138", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "a23585307138", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-27-43-16-35-10-45-13-0-65037-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790526649, "last_seen": 1790526649, "transport": "t", "ja3_hash": "45381d474b1dbed501f2b5a86a7b4c77", "ja3_variant_count": 1, "ja3_variants": [ "45381d474b1dbed501f2b5a86a7b4c77" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_b9b2042a217e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "b9b2042a217e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-43-65037-13-10-35-65281-11-16-27-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790545124, "last_seen": 1790545124, "transport": "t", "ja3_hash": "b80886b789022137d932f0caf7936d91", "ja3_variant_count": 1, "ja3_variants": [ "b80886b789022137d932f0caf7936d91" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_c47ba893ced7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "c47ba893ced7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-27-13-43-65037-45-18-10-5-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790532761, "last_seen": 1790532761, "transport": "t", "ja3_hash": "90285bd1cae89c71af68aa05c9ffa732", "ja3_variant_count": 1, "ja3_variants": [ "90285bd1cae89c71af68aa05c9ffa732" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_cfc24ce3ef1e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "cfc24ce3ef1e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-13-27-18-5-16-23-11-0-65037-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790525375, "last_seen": 1790547368, "transport": "t", "ja3_hash": "bbff9b34ae54a0c045f0f0f677e71aa7", "ja3_variant_count": 2, "ja3_variants": [ "bbff9b34ae54a0c045f0f0f677e71aa7", "2e0a950aa86466ed93804b4cdb05d2fd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_ef81948c0dac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "ef81948c0dac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-13-23-45-65281-5-16-0-35-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790989402, "last_seen": 1790989402, "transport": "t", "ja3_hash": "dc38fa98ed778b5b2adf0f3ef1430b69", "ja3_variant_count": 1, "ja3_variants": [ "dc38fa98ed778b5b2adf0f3ef1430b69" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_f82d63d7ad13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "f82d63d7ad13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-11-5-35-0-65037-23-18-27-16-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791128568, "last_seen": 1791128568, "transport": "t", "ja3_hash": "6ef052dec41366522537c2b53b8f9fdd", "ja3_variant_count": 1, "ja3_variants": [ "6ef052dec41366522537c2b53b8f9fdd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_0157ef92a341", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "0157ef92a341", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-43-51-13-5-65037-65281-0-11-45-18-10-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790942443, "last_seen": 1790942443, "transport": "t", "ja3_hash": "16f9f7c674c6b8fd681cb39a43da19e5", "ja3_variant_count": 1, "ja3_variants": [ "16f9f7c674c6b8fd681cb39a43da19e5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_05750f4ee4a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "05750f4ee4a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-16-45-18-43-23-65037-0-35-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788860935, "last_seen": 1790035331, "transport": "t", "ja3_hash": "50a260e1f4d448a893fe2fe28164835d", "ja3_variant_count": 2, "ja3_variants": [ "50a260e1f4d448a893fe2fe28164835d", "c62d93d270185b4d31855f132577e318" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_09dd927248eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "09dd927248eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-27-18-11-16-65037-45-5-43-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790996534, "last_seen": 1790996534, "transport": "t", "ja3_hash": "012474a2b43337674be7f6e2a2e219aa", "ja3_variant_count": 1, "ja3_variants": [ "012474a2b43337674be7f6e2a2e219aa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_0b990bf9eb3d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "0b990bf9eb3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-65037-10-13-65281-5-23-11-16-43-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790168187, "last_seen": 1790168187, "transport": "t", "ja3_hash": "91c60ec3fcd373175960b8e45f15aab6", "ja3_variant_count": 1, "ja3_variants": [ "91c60ec3fcd373175960b8e45f15aab6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_0f3ad4312b00", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "0f3ad4312b00", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-11-16-65037-51-13-0-17513-27-23-35-5,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791116980, "last_seen": 1791116980, "transport": "t", "ja3_hash": "5fcff411546426a783a388e09974fa6c", "ja3_variant_count": 1, "ja3_variants": [ "5fcff411546426a783a388e09974fa6c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_10007559a118", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "10007559a118", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-13-18-10-45-27-23-16-0-5-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790562003, "last_seen": 1790562003, "transport": "t", "ja3_hash": "ae4ccc5a23f250643fc43c9b458b5a97", "ja3_variant_count": 1, "ja3_variants": [ "ae4ccc5a23f250643fc43c9b458b5a97" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_136a3469aa94", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "136a3469aa94", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-35-18-51764-43-5-23-10-27-16-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790905736, "last_seen": 1790905736, "transport": "t", "ja3_hash": "8f7406b3f96cb9026619dba30dcc7370", "ja3_variant_count": 1, "ja3_variants": [ "8f7406b3f96cb9026619dba30dcc7370" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_1448735979ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "1448735979ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-16-11-13-10-18-43-17613-65037-27-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790290818, "last_seen": 1790290818, "transport": "t", "ja3_hash": "de6ad9b9ca0f7fd8f01680a5ae53ec73", "ja3_variant_count": 1, "ja3_variants": [ "de6ad9b9ca0f7fd8f01680a5ae53ec73" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_15a94bbcc816", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "15a94bbcc816", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-16-45-65037-65281-13-43-51-5-10-11-17513,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791116981, "last_seen": 1791265975, "transport": "t", "ja3_hash": "d094e3e6300243009b1d69d134253681", "ja3_variant_count": 2, "ja3_variants": [ "d094e3e6300243009b1d69d134253681", "0569b6dae694dec985dbeb036bc8f97e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_16ac493eba88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "16ac493eba88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-5-17613-35-65037-0-13-10-43-16-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789022139, "last_seen": 1789022139, "transport": "t", "ja3_hash": "38d5731a4e5549c59e86dfdf0cbf7dd4", "ja3_variant_count": 1, "ja3_variants": [ "38d5731a4e5549c59e86dfdf0cbf7dd4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_1a1bc7f7ec0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "1a1bc7f7ec0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-13-0-43-35-27-51764-5-10-23-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790465461, "last_seen": 1790465461, "transport": "t", "ja3_hash": "731069af2b647c8d987c88233be4576c", "ja3_variant_count": 1, "ja3_variants": [ "731069af2b647c8d987c88233be4576c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_1b0a684df850", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "1b0a684df850", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-43-16-17513-23-11-13-5-45-0-27-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791128039, "last_seen": 1791128039, "transport": "t", "ja3_hash": "e5c8a73dcfe056c69b88543f026d7c55", "ja3_variant_count": 1, "ja3_variants": [ "e5c8a73dcfe056c69b88543f026d7c55" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_1badfd4656e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "1badfd4656e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-10-5-13-11-43-45-16-23-17513-35-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791115071, "last_seen": 1791115071, "transport": "t", "ja3_hash": "026e753141fc6dfe244c2f4308155797", "ja3_variant_count": 1, "ja3_variants": [ "026e753141fc6dfe244c2f4308155797" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_1ca9378d59c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "1ca9378d59c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-13-45-43-10-17613-65037-16-0-35-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790402739, "last_seen": 1790402739, "transport": "t", "ja3_hash": "f30ab90ded926d60b4ba6a78729dbeda", "ja3_variant_count": 1, "ja3_variants": [ "f30ab90ded926d60b4ba6a78729dbeda" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_1cc6e63e6ce5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "1cc6e63e6ce5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-27-43-17613-18-23-65037-65281-11-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790264938, "last_seen": 1790264938, "transport": "t", "ja3_hash": "02aff68d55f019a01090e0c7ce006c98", "ja3_variant_count": 1, "ja3_variants": [ "02aff68d55f019a01090e0c7ce006c98" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_1f2bf9f9949f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "1f2bf9f9949f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-5-13-65037-16-17613-0-45-10-43-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790232207, "last_seen": 1790232207, "transport": "t", "ja3_hash": "6c0c9b343ab9b12feb3c9c81cae4eb49", "ja3_variant_count": 1, "ja3_variants": [ "6c0c9b343ab9b12feb3c9c81cae4eb49" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_21c62da62278", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "21c62da62278", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-10-17613-43-35-18-13-27-5-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789516838, "last_seen": 1791135133, "transport": "t", "ja3_hash": "90a18729c5a977556a56abce23cd7226", "ja3_variant_count": 3, "ja3_variants": [ "90a18729c5a977556a56abce23cd7226", "56f307ac85fc7b856ecef14ba0a27eb2", "d976cda27ea2a9ee35e0369d92180f3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1, "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1513h2_8daaf6152771_237b8edbb796", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "237b8edbb796", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-5-11-23-35-43-51-10-18-65281-16-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791262355, "last_seen": 1791262355, "transport": "t", "ja3_hash": "fde1d8b23ec14ff3f50e51ffae473c32", "ja3_variant_count": 1, "ja3_variants": [ "fde1d8b23ec14ff3f50e51ffae473c32" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_26659bca45b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "26659bca45b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-16-13-43-18-10-0-45-27-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788825491, "last_seen": 1790240715, "transport": "t", "ja3_hash": "f801fc42d68d733cf61c7b75a429ff2b", "ja3_variant_count": 2, "ja3_variants": [ "f801fc42d68d733cf61c7b75a429ff2b", "377222bd03110a759c18283c8d5e7f9e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_292b84349f7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "292b84349f7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-65281-27-23-43-35-10-5-0-65037-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789937402, "last_seen": 1789937402, "transport": "t", "ja3_hash": "0c0ed1bd83a5c438fa2ad8663df14ab5", "ja3_variant_count": 1, "ja3_variants": [ "0c0ed1bd83a5c438fa2ad8663df14ab5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_2decd6c1bed5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "2decd6c1bed5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-35-43-0-11-65281-10-27-65037-16-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789667820, "last_seen": 1789667820, "transport": "t", "ja3_hash": "38deea31b1c4930853d3941b39e5db4c", "ja3_variant_count": 1, "ja3_variants": [ "38deea31b1c4930853d3941b39e5db4c" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_30b0ae8403c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "30b0ae8403c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-5-16-51764-18-17613-43-0-13-27-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789644304, "last_seen": 1789644304, "transport": "t", "ja3_hash": "1ef1cc0863438eb885f414257a35962e", "ja3_variant_count": 1, "ja3_variants": [ "1ef1cc0863438eb885f414257a35962e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_319e1b2448d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "319e1b2448d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-16-65037-35-10-65281-27-45-18-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788772017, "last_seen": 1788772017, "transport": "t", "ja3_hash": "7c786f27a6992cef3e3c18ed1f5bf579", "ja3_variant_count": 1, "ja3_variants": [ "7c786f27a6992cef3e3c18ed1f5bf579" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_31cfec764849", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "31cfec764849", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-43-0-5-16-27-18-35-65281-23-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788807481, "last_seen": 1788807481, "transport": "t", "ja3_hash": "734e818a56bdc29607bf993b3c5eadae", "ja3_variant_count": 1, "ja3_variants": [ "734e818a56bdc29607bf993b3c5eadae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_36e266dff31d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "36e266dff31d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-43-45-18-65281-10-0-27-17613-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788832293, "last_seen": 1788832293, "transport": "t", "ja3_hash": "5094e81ad7e0b99ce791ac66b698cce2", "ja3_variant_count": 1, "ja3_variants": [ "5094e81ad7e0b99ce791ac66b698cce2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_371bb53416dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "371bb53416dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-27-45-16-43-13-11-65281-35-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789451324, "last_seen": 1789451324, "transport": "t", "ja3_hash": "60ebf3a2d67833e1ee39383c439dfd3e", "ja3_variant_count": 1, "ja3_variants": [ "60ebf3a2d67833e1ee39383c439dfd3e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 51 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_37352656bd0e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "37352656bd0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-35-13-43-45-11-0-65037-16-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788776645, "last_seen": 1788776645, "transport": "t", "ja3_hash": "99d67dc46fb1eb52e0677bb422a68966", "ja3_variant_count": 1, "ja3_variants": [ "99d67dc46fb1eb52e0677bb422a68966" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_3ee317798cbe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "3ee317798cbe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-23-0-10-11-35-65037-16-17613-65281-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790060421, "last_seen": 1790060421, "transport": "t", "ja3_hash": "4e2ae428a338b5001ad52d8f0c894980", "ja3_variant_count": 1, "ja3_variants": [ "4e2ae428a338b5001ad52d8f0c894980" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 23 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_41ae67c3855e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "41ae67c3855e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-27-16-65037-11-18-13-10-43-0-45-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788621938, "last_seen": 1788621938, "transport": "t", "ja3_hash": "95a7bc3d41ce203ef50efd1d0609e0fe", "ja3_variant_count": 1, "ja3_variants": [ "95a7bc3d41ce203ef50efd1d0609e0fe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 16 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_438ccc8160ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "438ccc8160ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-16-27-23-10-0-17613-11-65037-13-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790235293, "last_seen": 1790235293, "transport": "t", "ja3_hash": "6aca54e4b7669dc1f67f5aa37facfe60", "ja3_variant_count": 1, "ja3_variants": [ "6aca54e4b7669dc1f67f5aa37facfe60" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_48a2dfa7058f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "48a2dfa7058f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17513-43-13-11-16-27-0-51-23-65281-5-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791104071, "last_seen": 1791104071, "transport": "t", "ja3_hash": "59d95f9aa05900121bf85812810b88c6", "ja3_variant_count": 1, "ja3_variants": [ "59d95f9aa05900121bf85812810b88c6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_4acd94fffbbb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "4acd94fffbbb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-13-65037-0-23-65281-16-10-45-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790584108, "last_seen": 1790584108, "transport": "t", "ja3_hash": "5b2469434aa335ec79c7759dd7eb72fb", "ja3_variant_count": 1, "ja3_variants": [ "5b2469434aa335ec79c7759dd7eb72fb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_4add523fdf48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "4add523fdf48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-16-23-11-65037-17613-0-5-45-65281-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790628608, "last_seen": 1790628608, "transport": "t", "ja3_hash": "afb0f74b896cb120d8eb5e9054386232", "ja3_variant_count": 1, "ja3_variants": [ "afb0f74b896cb120d8eb5e9054386232" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 53 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_4c427b262de3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "4c427b262de3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-35-17613-27-5-65037-13-16-43-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789756205, "last_seen": 1789756205, "transport": "t", "ja3_hash": "8073ac34ff3ab0deea3aec31420894ef", "ja3_variant_count": 1, "ja3_variants": [ "8073ac34ff3ab0deea3aec31420894ef" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_4cde44821281", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "4cde44821281", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-65281-65037-5-0-18-27-17613-11-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790307870, "last_seen": 1790307870, "transport": "t", "ja3_hash": "51934723c995099624e67d764c3ab5ad", "ja3_variant_count": 1, "ja3_variants": [ "51934723c995099624e67d764c3ab5ad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_507e1ef40acb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "507e1ef40acb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-13-10-11-18-45-16-65037-35-0-17513-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791282197, "last_seen": 1791282197, "transport": "t", "ja3_hash": "46c91307a656cb6dc14f40f9c14213fa", "ja3_variant_count": 1, "ja3_variants": [ "46c91307a656cb6dc14f40f9c14213fa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_508a64778336", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "508a64778336", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-11-0-43-13-27-17613-23-45-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789169058, "last_seen": 1789169058, "transport": "t", "ja3_hash": "fe6a6057a6ce3d8d77837d0e1466545e", "ja3_variant_count": 1, "ja3_variants": [ "fe6a6057a6ce3d8d77837d0e1466545e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_50aa0eca22b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "50aa0eca22b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-0-43-65037-45-5-35-16-11-13-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788829195, "last_seen": 1790231083, "transport": "t", "ja3_hash": "5fbf8ca39f2e135289a7b868bbda5f72", "ja3_variant_count": 2, "ja3_variants": [ "5fbf8ca39f2e135289a7b868bbda5f72", "d53d2bc3db1266a8084c1308f2d56309" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1.1 Mobile/15E148 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_514943fa2261", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "514943fa2261", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788988730, "last_seen": 1788988730, "transport": "t", "ja3_hash": "0faf2a91198d40dbd58b9308f3fca2fd", "ja3_variant_count": 1, "ja3_variants": [ "0faf2a91198d40dbd58b9308f3fca2fd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_57f62028363f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "57f62028363f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-11-10-35-5-16-22-23-13-43-45-51,29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1790331220, "last_seen": 1791122312, "transport": "t", "ja3_hash": "bf84eba862e752f5ce558c4565d27602", "ja3_variant_count": 1, "ja3_variants": [ "bf84eba862e752f5ce558c4565d27602" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_5ab73ec04114", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "5ab73ec04114", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-45-18-0-16-65037-17613-27-11-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791046329, "last_seen": 1791046329, "transport": "t", "ja3_hash": "54276556f7ee334c962cc54e375eee6e", "ja3_variant_count": 1, "ja3_variants": [ "54276556f7ee334c962cc54e375eee6e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_613e8485b197", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "613e8485b197", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-65037-11-35-18-10-13-43-27-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790727985, "last_seen": 1790727985, "transport": "t", "ja3_hash": "807f97f54da89e72da5d4d4275fcc810", "ja3_variant_count": 1, "ja3_variants": [ "807f97f54da89e72da5d4d4275fcc810" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_626fb585ea94", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "626fb585ea94", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-35-18-43-16-0-11-27-65037-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790791339, "last_seen": 1790791339, "transport": "t", "ja3_hash": "abdc3ec3e793f3b1a133f5220da10381", "ja3_variant_count": 1, "ja3_variants": [ "abdc3ec3e793f3b1a133f5220da10381" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 25 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_632aef45f8fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "632aef45f8fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-65281-13-43-11-45-27-65037-23-35-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789732995, "last_seen": 1789732995, "transport": "t", "ja3_hash": "5a4242cc82cd7de608a014ad80bc3a43", "ja3_variant_count": 1, "ja3_variants": [ "5a4242cc82cd7de608a014ad80bc3a43" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 25 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_68e16b2411fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "68e16b2411fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-0-17613-43-27-10-5-65281-13-35-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789197835, "last_seen": 1789197835, "transport": "t", "ja3_hash": "90e769aee86b15c61dfc81a8aaa1e922", "ja3_variant_count": 1, "ja3_variants": [ "90e769aee86b15c61dfc81a8aaa1e922" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_6a0f4d8dd3a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "6a0f4d8dd3a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-0-11-18-13-10-23-35-65281-27-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790086696, "last_seen": 1790086696, "transport": "t", "ja3_hash": "30d634e01d53e876b296bf4fa040e784", "ja3_variant_count": 1, "ja3_variants": [ "30d634e01d53e876b296bf4fa040e784" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 23 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_6da051328960", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "6da051328960", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49195-49199-49172-49171-157-156-53-47,65281-0-11-10-35-5-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788969278, "last_seen": 1790576356, "transport": "t", "ja3_hash": "99a632928316866652915a5047a5a107", "ja3_variant_count": 1, "ja3_variants": [ "99a632928316866652915a5047a5a107" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_6e24debeae6a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "6e24debeae6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-13-17613-18-45-0-27-43-10-16-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790601774, "last_seen": 1790601774, "transport": "t", "ja3_hash": "f166dde3107030bfd6b89d25dadab036", "ja3_variant_count": 1, "ja3_variants": [ "f166dde3107030bfd6b89d25dadab036" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 4 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_6e6a4a4a64f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "6e6a4a4a64f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-16-23-65281-43-65037-45-18-17613-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788773197, "last_seen": 1788773197, "transport": "t", "ja3_hash": "f8c97366613b2bb39d0d588112b51bb3", "ja3_variant_count": 1, "ja3_variants": [ "f8c97366613b2bb39d0d588112b51bb3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_7205b620a29a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "7205b620a29a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-16-5-27-10-65281-17613-11-18-43-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789987014, "last_seen": 1790577064, "transport": "t", "ja3_hash": "3fade02e2eb8b1e4dd7a470dd045f430", "ja3_variant_count": 2, "ja3_variants": [ "3fade02e2eb8b1e4dd7a470dd045f430", "5a6bdc46c16da13ae582f52567c7d170" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 6 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_72768dcc6564", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "72768dcc6564", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-27-18-16-43-65037-17613-10-35-65281-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789747337, "last_seen": 1789747337, "transport": "t", "ja3_hash": "62308b41079bf430d7139d53d5a9bbdc", "ja3_variant_count": 1, "ja3_variants": [ "62308b41079bf430d7139d53d5a9bbdc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_78382a807abb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "78382a807abb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-43-27-23-65037-13-51764-0-11-65281-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789916699, "last_seen": 1789916699, "transport": "t", "ja3_hash": "1032ffe058c67fded148f3387cba7042", "ja3_variant_count": 1, "ja3_variants": [ "1032ffe058c67fded148f3387cba7042" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_78adb01dfd11", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "78adb01dfd11", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-35-43-65037-0-10-18-27-13-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790738634, "last_seen": 1790738634, "transport": "t", "ja3_hash": "13a8f813a50c0738210ad3d0a1bf12e1", "ja3_variant_count": 1, "ja3_variants": [ "13a8f813a50c0738210ad3d0a1bf12e1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_7b81da28a4b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "7b81da28a4b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-5-45-0-10-35-43-11-65037-27-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790251455, "last_seen": 1790251455, "transport": "t", "ja3_hash": "8567c96e95e2a77b214a3c00d04781fb", "ja3_variant_count": 1, "ja3_variants": [ "8567c96e95e2a77b214a3c00d04781fb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_7d7d8fe3affd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "7d7d8fe3affd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-51-10-13-11-16-23-43-5-18-0-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791278145, "last_seen": 1791278145, "transport": "t", "ja3_hash": "1902736775f3c00f50f6eb1ba8abbd14", "ja3_variant_count": 1, "ja3_variants": [ "1902736775f3c00f50f6eb1ba8abbd14" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_7e67dd96aba6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "7e67dd96aba6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-18-0-51-23-13-10-17513-16-65037-45-35,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791102872, "last_seen": 1791102872, "transport": "t", "ja3_hash": "294031553047c037971334fc03e92c98", "ja3_variant_count": 1, "ja3_variants": [ "294031553047c037971334fc03e92c98" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_7e731154e039", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "7e731154e039", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-35-13-65281-0-27-11-65037-16-45-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788965618, "last_seen": 1790245005, "transport": "t", "ja3_hash": "aeb74f38515c7db91329aee1be47d1c9", "ja3_variant_count": 3, "ja3_variants": [ "aeb74f38515c7db91329aee1be47d1c9", "a24d65d6706c542f02925e71005f920f", "8ae3e2634821e821028134b0349c8f12" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_7eb616465bc4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "7eb616465bc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-65281-11-17613-65037-16-10-0-5-18-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790675937, "last_seen": 1790680744, "transport": "t", "ja3_hash": "0a1062930c59ed0197f46e3dccb4ac8f", "ja3_variant_count": 2, "ja3_variants": [ "0a1062930c59ed0197f46e3dccb4ac8f", "b028ae6555c04a7f778ef58b40ca2497" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_89b57d596435", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "89b57d596435", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-45-5-65281-17613-11-43-13-35-16-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790615348, "last_seen": 1790615348, "transport": "t", "ja3_hash": "0e73e388ad25aed2e5f2207a6ffd5227", "ja3_variant_count": 1, "ja3_variants": [ "0e73e388ad25aed2e5f2207a6ffd5227" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_89e35bb783b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "89e35bb783b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-17613-16-18-13-5-10-45-27-0-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788796418, "last_seen": 1791251846, "transport": "t", "ja3_hash": "101ef22b0e8c1a343795b6aaedacb78c", "ja3_variant_count": 2, "ja3_variants": [ "101ef22b0e8c1a343795b6aaedacb78c", "f09a6157e3eb0de5a666dff6ed06ef03" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_8aced9fd2cb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "8aced9fd2cb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-10-65037-43-23-13-17613-5-11-18-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789442579, "last_seen": 1789442579, "transport": "t", "ja3_hash": "b329be24ba9f3d2c11f5caeaf27f640e", "ja3_variant_count": 1, "ja3_variants": [ "b329be24ba9f3d2c11f5caeaf27f640e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_8ad16eae882b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "8ad16eae882b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-18-27-0-43-16-45-10-65281-51-13-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791104494, "last_seen": 1791104494, "transport": "t", "ja3_hash": "698590003997a4f27324fd3b78db957d", "ja3_variant_count": 1, "ja3_variants": [ "698590003997a4f27324fd3b78db957d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_96778415096c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "96778415096c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-43-35-16-65281-18-27-0-23-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788832426, "last_seen": 1788832426, "transport": "t", "ja3_hash": "3b8f40437b6fb3754a4af80ee9cdd172", "ja3_variant_count": 1, "ja3_variants": [ "3b8f40437b6fb3754a4af80ee9cdd172" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_9acb3d2eda48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "9acb3d2eda48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-65281-0-18-45-35-16-10-23-13-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790914493, "last_seen": 1790914493, "transport": "t", "ja3_hash": "8800a7a82b1550059a5534134fa4f211", "ja3_variant_count": 1, "ja3_variants": [ "8800a7a82b1550059a5534134fa4f211" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_9b9f1383fc92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "9b9f1383fc92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-45-17513-43-65037-10-5-13-16-18-0-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791103444, "last_seen": 1791103444, "transport": "t", "ja3_hash": "0716937e3f15d543c55c9dbba0186205", "ja3_variant_count": 1, "ja3_variants": [ "0716937e3f15d543c55c9dbba0186205" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_9e1e229d5475", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "9e1e229d5475", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-65281-17513-35-5-10-27-18-0-16-43-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791141987, "last_seen": 1791141987, "transport": "t", "ja3_hash": "9b52c64a0cffe47f09b86be92e4013ae", "ja3_variant_count": 1, "ja3_variants": [ "9b52c64a0cffe47f09b86be92e4013ae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_9ebd5de6b76b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "9ebd5de6b76b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-0-27-5-11-10-35-65037-43-16-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788825875, "last_seen": 1791156270, "transport": "t", "ja3_hash": "a13e8d385b59ef13dcbb8e413822e073", "ja3_variant_count": 2, "ja3_variants": [ "a13e8d385b59ef13dcbb8e413822e073", "66117a12ad5a1e2b7f939d9ffa40763b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a1fba20c6404", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a1fba20c6404", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-17613-43-35-45-11-0-10-51764-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790593305, "last_seen": 1790593305, "transport": "t", "ja3_hash": "7ef3a13bae269be2b55a4348a4c63cd5", "ja3_variant_count": 1, "ja3_variants": [ "7ef3a13bae269be2b55a4348a4c63cd5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a23585307138", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a23585307138", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-27-5-13-11-10-16-35-65037-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791269631, "last_seen": 1791297099, "transport": "t", "ja3_hash": "6fbec0573255f5916f4ff03200b7310d", "ja3_variant_count": 2, "ja3_variants": [ "6fbec0573255f5916f4ff03200b7310d", "e718982954bac6dbdd04a291c77fce33" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a9bdf17bbfe5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a9bdf17bbfe5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-65281-17613-18-13-45-43-16-35-11-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789940843, "last_seen": 1789940843, "transport": "t", "ja3_hash": "d40b35cfa4471812ddb55b022f69913c", "ja3_variant_count": 1, "ja3_variants": [ "d40b35cfa4471812ddb55b022f69913c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 23 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_ab3e8c78e136", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "ab3e8c78e136", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-10-11-65037-18-45-65281-35-43-17513-16-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790942040, "last_seen": 1790942040, "transport": "t", "ja3_hash": "ff53c58044d2def296827c845b58e3e5", "ja3_variant_count": 1, "ja3_variants": [ "ff53c58044d2def296827c845b58e3e5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_aee3e2e2383b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "aee3e2e2383b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-16-27-18-65037-11-23-43-5-45-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788993217, "last_seen": 1788993217, "transport": "t", "ja3_hash": "6cf64b3fbf1d394285704e698987d35b", "ja3_variant_count": 1, "ja3_variants": [ "6cf64b3fbf1d394285704e698987d35b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_b1ce0a929deb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "b1ce0a929deb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-35-18-0-27-13-16-5-23-43-10-11-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791114582, "last_seen": 1791114582, "transport": "t", "ja3_hash": "7b0d048578a358cfc3e7e50629a2e558", "ja3_variant_count": 1, "ja3_variants": [ "7b0d048578a358cfc3e7e50629a2e558" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_b1f13c9f73fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "b1f13c9f73fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-35-16-51-65281-18-10-17513-13-11-43-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790942442, "last_seen": 1790942442, "transport": "t", "ja3_hash": "ca788d3ab6223aa7eed1578c080b91b8", "ja3_variant_count": 1, "ja3_variants": [ "ca788d3ab6223aa7eed1578c080b91b8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_b20fa589102b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "b20fa589102b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-0-10-13-51-11-65281-16-27-65037-5-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790750897, "last_seen": 1790750897, "transport": "t", "ja3_hash": "8c841c6e3dd9f3d084759b38ebce9f17", "ja3_variant_count": 1, "ja3_variants": [ "8c841c6e3dd9f3d084759b38ebce9f17" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_b319f795dd68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "b319f795dd68", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17513-18-27-11-43-10-35-51-13-65037-5-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791258990, "last_seen": 1791258990, "transport": "t", "ja3_hash": "cf821ca2090ced47405cfe97a13a5fe4", "ja3_variant_count": 1, "ja3_variants": [ "cf821ca2090ced47405cfe97a13a5fe4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_b9b2042a217e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "b9b2042a217e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-65037-10-11-5-18-27-13-16-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790204106, "last_seen": 1790204106, "transport": "t", "ja3_hash": "438915ea89d49230ae508d971c5fd461", "ja3_variant_count": 1, "ja3_variants": [ "438915ea89d49230ae508d971c5fd461" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_bc96ea71eb26", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "bc96ea71eb26", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-11-0-65281-13-23-17613-65037-5-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791153855, "last_seen": 1791153855, "transport": "t", "ja3_hash": "52cb66a7220051174e91fa31c60d287c", "ja3_variant_count": 1, "ja3_variants": [ "52cb66a7220051174e91fa31c60d287c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_bea6476a73be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "bea6476a73be", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-65281-23-16-13-43-18-11-0-27-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789865335, "last_seen": 1789865335, "transport": "t", "ja3_hash": "f3cf5d2910ddd1c627cf7f9f96297056", "ja3_variant_count": 1, "ja3_variants": [ "f3cf5d2910ddd1c627cf7f9f96297056" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_c11b6b55509d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "c11b6b55509d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-13-10-43-5-35-27-11-45-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790996617, "last_seen": 1790996617, "transport": "t", "ja3_hash": "42d7873b6f1f693407ee4f20f9fa1d5e", "ja3_variant_count": 1, "ja3_variants": [ "42d7873b6f1f693407ee4f20f9fa1d5e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.1.0 Safari/537.36 Edg/135.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_c1797fb52caf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "c1797fb52caf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51764-13-17613-27-65037-43-18-0-23-16-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790862614, "last_seen": 1790862614, "transport": "t", "ja3_hash": "773cd87421d6a307f889275aa9e61dd7", "ja3_variant_count": 1, "ja3_variants": [ "773cd87421d6a307f889275aa9e61dd7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_c291833c5705", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "c291833c5705", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-18-13-43-45-16-10-5-65281-51-35-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791280671, "last_seen": 1791280671, "transport": "t", "ja3_hash": "c9443af10f42b0846ef364ac30c667d7", "ja3_variant_count": 1, "ja3_variants": [ "c9443af10f42b0846ef364ac30c667d7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_c4af7d3108f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "c4af7d3108f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-5-45-27-65037-18-35-10-11-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789469866, "last_seen": 1790521598, "transport": "t", "ja3_hash": "d5efdf6a55a0c346237e3e674d8edd4c", "ja3_variant_count": 3, "ja3_variants": [ "d5efdf6a55a0c346237e3e674d8edd4c", "e2dccba04f0ba71ac404477d3cd5128f", "395d8e5265c83646f2202e6b58afdcfa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_c6332efef82b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "c6332efef82b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-11-10-35-0-43-51-65037-13-17513-45-27,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791259740, "last_seen": 1791259740, "transport": "t", "ja3_hash": "fec38f7aba8ba69c98d5cbc465ff9386", "ja3_variant_count": 1, "ja3_variants": [ "fec38f7aba8ba69c98d5cbc465ff9386" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_c79483be1dd3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "c79483be1dd3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-5-65281-43-65037-35-17613-0-11-13-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789026972, "last_seen": 1789026972, "transport": "t", "ja3_hash": "b7166d2b18c56a2038633e7486ba056a", "ja3_variant_count": 1, "ja3_variants": [ "b7166d2b18c56a2038633e7486ba056a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_cbd63d183b89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "cbd63d183b89", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-5-23-43-65281-16-35-65037-10-17613-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790760005, "last_seen": 1790760005, "transport": "t", "ja3_hash": "6fa031fd36dd409c6f3e44b4190d44fa", "ja3_variant_count": 1, "ja3_variants": [ "6fa031fd36dd409c6f3e44b4190d44fa" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_ce1f2fd49adb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "ce1f2fd49adb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-65037-35-17613-11-27-45-18-0-13-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790370017, "last_seen": 1790370017, "transport": "t", "ja3_hash": "0a3e40f6aecc82bfea6e8eff6216f907", "ja3_variant_count": 1, "ja3_variants": [ "0a3e40f6aecc82bfea6e8eff6216f907" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_cefc46783ee6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "cefc46783ee6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-27-65281-5-0-17613-45-10-35-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788988696, "last_seen": 1789009110, "transport": "t", "ja3_hash": "3edfffc4133e1708c302cb93f2ad6c91", "ja3_variant_count": 2, "ja3_variants": [ "3edfffc4133e1708c302cb93f2ad6c91", "e9649cd2f4747e3757cba0df5c0a3377" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_cf167901ab97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "cf167901ab97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-13-65037-27-35-17613-18-43-0-45-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791221603, "last_seen": 1791221603, "transport": "t", "ja3_hash": "7444d738db496a777fce14ecb6b33c19", "ja3_variant_count": 1, "ja3_variants": [ "7444d738db496a777fce14ecb6b33c19" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_d0be9338a56b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "d0be9338a56b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-18-27-0-23-16-65281-10-5-17613-43-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790203300, "last_seen": 1790203300, "transport": "t", "ja3_hash": "101b470212c427ceec7ca06868e1a4c7", "ja3_variant_count": 1, "ja3_variants": [ "101b470212c427ceec7ca06868e1a4c7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_d3565b7f22b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "d3565b7f22b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-16-65281-18-11-17613-45-27-65037-5-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790535152, "last_seen": 1790535152, "transport": "t", "ja3_hash": "e92dc898bf599a2651c381b56fcf63e6", "ja3_variant_count": 1, "ja3_variants": [ "e92dc898bf599a2651c381b56fcf63e6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_d763035bca24", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "d763035bca24", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-11-13-65281-27-5-16-35-23-65037-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789691876, "last_seen": 1789691876, "transport": "t", "ja3_hash": "2db5eed20595ed89a3239e0c060e31d8", "ja3_variant_count": 1, "ja3_variants": [ "2db5eed20595ed89a3239e0c060e31d8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_da262d4888c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "da262d4888c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-18-45-65037-5-65281-0-43-11-16-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791294374, "last_seen": 1791294374, "transport": "t", "ja3_hash": "a3c1b19bf63127d046434499ac488383", "ja3_variant_count": 1, "ja3_variants": [ "a3c1b19bf63127d046434499ac488383" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_db3a2601552b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "db3a2601552b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-65037-23-5-65281-10-17613-16-35-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790202576, "last_seen": 1790202576, "transport": "t", "ja3_hash": "ca7f646cf2a97cd0f537026144791de6", "ja3_variant_count": 1, "ja3_variants": [ "ca7f646cf2a97cd0f537026144791de6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_e216d158e138", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "e216d158e138", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-16-35-5-0-65281-27-13-18-43-10-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791114581, "last_seen": 1791114581, "transport": "t", "ja3_hash": "5cf4500d83df8d7e791416aa76b4a3a8", "ja3_variant_count": 1, "ja3_variants": [ "5cf4500d83df8d7e791416aa76b4a3a8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_ec2f78d3f639", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "ec2f78d3f639", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-27-43-16-65037-23-10-0-18-17613-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788874790, "last_seen": 1788874790, "transport": "t", "ja3_hash": "81adfafd60c0cae72cf64c557d314b4e", "ja3_variant_count": 1, "ja3_variants": [ "81adfafd60c0cae72cf64c557d314b4e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_ed77f63a2c77", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "ed77f63a2c77", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-65037-5-11-35-18-45-10-17613-16-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789829287, "last_seen": 1790185334, "transport": "t", "ja3_hash": "4e037b8551065bd739adebf62a7e8730", "ja3_variant_count": 2, "ja3_variants": [ "4e037b8551065bd739adebf62a7e8730", "fdb892c542380681d11e35ddd07fadc8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 4 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_ef81948c0dac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "ef81948c0dac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-43-16-5-65281-35-0-18-13-45-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791146868, "last_seen": 1791146868, "transport": "t", "ja3_hash": "f54b25bc8da1a377113bc4932d8df5f3", "ja3_variant_count": 1, "ja3_variants": [ "f54b25bc8da1a377113bc4932d8df5f3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_f06b984b9cee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "f06b984b9cee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-35-17513-18-27-16-43-13-51-23-0-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791261068, "last_seen": 1791261068, "transport": "t", "ja3_hash": "2ecd4dca27e10eb16a424754b14becd6", "ja3_variant_count": 1, "ja3_variants": [ "2ecd4dca27e10eb16a424754b14becd6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_f390746cd0dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "f390746cd0dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-45-51-17513-11-0-23-13-16-43-65281-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791275966, "last_seen": 1791275966, "transport": "t", "ja3_hash": "150c994726bcf052a28316cd7d64ffdf", "ja3_variant_count": 1, "ja3_variants": [ "150c994726bcf052a28316cd7d64ffdf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_f48b664772e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "f48b664772e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-0-13-23-45-27-65281-10-16-18-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790247342, "last_seen": 1790247342, "transport": "t", "ja3_hash": "5a41d086cca2c822f1ebda74ea5c48d1", "ja3_variant_count": 1, "ja3_variants": [ "5a41d086cca2c822f1ebda74ea5c48d1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_f5a1924b2b5e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "f5a1924b2b5e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-51764-0-17613-13-18-35-5-16-65281-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790086089, "last_seen": 1790086089, "transport": "t", "ja3_hash": "b753b7ca3047668165c49b6fa608774a", "ja3_variant_count": 1, "ja3_variants": [ "b753b7ca3047668165c49b6fa608774a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 26 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_f5e82552169b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "f5e82552169b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-16-18-0-11-10-65037-43-23-5-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790218769, "last_seen": 1790539300, "transport": "t", "ja3_hash": "e256296c649b3d70b5ef163f953f6958", "ja3_variant_count": 2, "ja3_variants": [ "e256296c649b3d70b5ef163f953f6958", "c03760391942fd7424e5bfb5fec17f3f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_f82d63d7ad13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "f82d63d7ad13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-43-18-16-23-27-65037-0-11-35-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789695872, "last_seen": 1789695872, "transport": "t", "ja3_hash": "ef0df8cef17e5ef07397d0347447c95d", "ja3_variant_count": 1, "ja3_variants": [ "ef0df8cef17e5ef07397d0347447c95d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_f936f1a039e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "f936f1a039e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-11-10-35-16-43-0-27-13-45-51-65037-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791125667, "last_seen": 1791125667, "transport": "t", "ja3_hash": "9a9d77e65618e07e453d1c03dae93082", "ja3_variant_count": 1, "ja3_variants": [ "9a9d77e65618e07e453d1c03dae93082" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_fa2837c659cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "fa2837c659cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-0-43-65281-45-35-16-13-27-5-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110330, "last_seen": 1791110330, "transport": "t", "ja3_hash": "acedd5762dfc91650b3e1848997a095a", "ja3_variant_count": 1, "ja3_variants": [ "acedd5762dfc91650b3e1848997a095a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_fc7d7aecc4d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "fc7d7aecc4d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-43-16-10-23-65037-5-27-0-18-11-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790941803, "last_seen": 1790941803, "transport": "t", "ja3_hash": "1536e3b0f0ee83969ce8aca29917bb5f", "ja3_variant_count": 1, "ja3_variants": [ "1536e3b0f0ee83969ce8aca29917bb5f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_ff420d6a982a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "ff420d6a982a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-45-27-35-13-17613-65037-43-5-16-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791110040, "last_seen": 1791110040, "transport": "t", "ja3_hash": "f532b2ea886e238fe9eb0d39ff4a2de7", "ja3_variant_count": 1, "ja3_variants": [ "f532b2ea886e238fe9eb0d39ff4a2de7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_0f1807484847", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "0f1807484847", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-43-13-45-23-17613-11-51764-5-10-0-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790852493, "last_seen": 1790852493, "transport": "t", "ja3_hash": "42a06b3532d3ddb6c7cf4bd5a28703e1", "ja3_variant_count": 1, "ja3_variants": [ "42a06b3532d3ddb6c7cf4bd5a28703e1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_25f0be3a1e97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "25f0be3a1e97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-35-13-27-65281-17613-5-18-0-11-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789702100, "last_seen": 1790450563, "transport": "t", "ja3_hash": "05de7f2a3e872480440c9266b1a55706", "ja3_variant_count": 2, "ja3_variants": [ "05de7f2a3e872480440c9266b1a55706", "aba3d0055624d4f159ba5b6a58fd5c60" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_26215471143d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "26215471143d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-0-11-43-35-45-17513-5-27-13-23-51-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791103442, "last_seen": 1791103442, "transport": "t", "ja3_hash": "82cfbfa618e8f3b3c7eca608a99d91da", "ja3_variant_count": 1, "ja3_variants": [ "82cfbfa618e8f3b3c7eca608a99d91da" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_2976fba711d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "2976fba711d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-43-10-18-5-45-0-11-27-17613-23-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790160091, "last_seen": 1790160091, "transport": "t", "ja3_hash": "bf10045a4a28f775bcf8d10dbd7fe3fe", "ja3_variant_count": 1, "ja3_variants": [ "bf10045a4a28f775bcf8d10dbd7fe3fe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_2b890d3065b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "2b890d3065b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-17613-27-43-0-65281-13-65037-11-10-35-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790738624, "last_seen": 1790738624, "transport": "t", "ja3_hash": "8df51989f01059daa7f46e078739cc2a", "ja3_variant_count": 1, "ja3_variants": [ "8df51989f01059daa7f46e078739cc2a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_2c4db0fc2997", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "2c4db0fc2997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-18-35-0-43-13-23-45-5-51-27-10-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790941796, "last_seen": 1790941796, "transport": "t", "ja3_hash": "afc6f95193a1d92b81b407b4167dc058", "ja3_variant_count": 1, "ja3_variants": [ "afc6f95193a1d92b81b407b4167dc058" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_3776db13d599", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "3776db13d599", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65037-65281-10-43-45-13-27-23-17613-5-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789415506, "last_seen": 1789415506, "transport": "t", "ja3_hash": "17e31c527444d2b12ff198723a53f40e", "ja3_variant_count": 1, "ja3_variants": [ "17e31c527444d2b12ff198723a53f40e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 87 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_379525006a89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "379525006a89", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-35-13-65281-0-45-51-5-17513-23-10-43-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791259739, "last_seen": 1791259739, "transport": "t", "ja3_hash": "0cd8636fad857c09e3f48bd38721f2f8", "ja3_variant_count": 1, "ja3_variants": [ "0cd8636fad857c09e3f48bd38721f2f8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_3cbc34f036de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "3cbc34f036de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-18-11-35-17613-0-5-43-23-10-65281-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788795816, "last_seen": 1788795816, "transport": "t", "ja3_hash": "3a432e2927f0bcb2d37673a2a3aac6fd", "ja3_variant_count": 1, "ja3_variants": [ "3a432e2927f0bcb2d37673a2a3aac6fd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_3fd30fc110b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "3fd30fc110b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-13-10-27-35-5-17613-51764-0-45-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790340192, "last_seen": 1790340192, "transport": "t", "ja3_hash": "ae5fa8db74c7ad54f139acd372e4146f", "ja3_variant_count": 1, "ja3_variants": [ "ae5fa8db74c7ad54f139acd372e4146f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_436de45e9bf8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "436de45e9bf8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-17613-5-0-27-45-11-18-10-35-43-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789077102, "last_seen": 1789077102, "transport": "t", "ja3_hash": "120149ee17d4f73d8a2893b35755a368", "ja3_variant_count": 1, "ja3_variants": [ "120149ee17d4f73d8a2893b35755a368" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_57850826d68e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "57850826d68e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-43-11-17613-65281-45-27-35-23-0-18-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789029152, "last_seen": 1789029152, "transport": "t", "ja3_hash": "4fce7f5f409882b7b158662be967530d", "ja3_variant_count": 1, "ja3_variants": [ "4fce7f5f409882b7b158662be967530d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_5ec6092e2d4d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "5ec6092e2d4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-0-18-5-45-35-11-65037-17613-43-23-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790242672, "last_seen": 1790363086, "transport": "t", "ja3_hash": "7f08141862acf207ba014857e1b98258", "ja3_variant_count": 3, "ja3_variants": [ "7f08141862acf207ba014857e1b98258", "4c55f7684ab72f1b835d637449a7369c", "c5eac1ea150b1f4aaf1da8e8d19fa79b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_6be373f0c26e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "6be373f0c26e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-13-45-0-43-65037-35-10-27-18-51764-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789737258, "last_seen": 1789737258, "transport": "t", "ja3_hash": "33c196d9c51ea3d6b1fa130428d94825", "ja3_variant_count": 1, "ja3_variants": [ "33c196d9c51ea3d6b1fa130428d94825" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_84573da81a30", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "84573da81a30", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-51764-35-27-45-13-17613-11-23-43-65281-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788811267, "last_seen": 1790124042, "transport": "t", "ja3_hash": "e4bde625c5815860db2b6edfaf23fac2", "ja3_variant_count": 2, "ja3_variants": [ "e4bde625c5815860db2b6edfaf23fac2", "9694b008c6bd00caf31d03231cb85916" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_8fa24f7ee5ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "8fa24f7ee5ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-13-0-35-10-5-45-43-65281-65037-17613-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1790215189, "last_seen": 1791140943, "transport": "t", "ja3_hash": "068a7039e9f360ed7f47969f3ae035b0", "ja3_variant_count": 4, "ja3_variants": [ "068a7039e9f360ed7f47969f3ae035b0", "257a4e94209b21e97504d80fac3d1745", "c58eeda131f385ad645ebc3ec76ef507", "ade7a46c689de86ff8c88c9fb588fea8" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_aa91c85dcbff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "aa91c85dcbff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-51-17513-10-13-27-23-5-43-0-11-65037-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791149956, "last_seen": 1791149956, "transport": "t", "ja3_hash": "bbe91749d5e0bc0ee10e844e9b7bda14", "ja3_variant_count": 1, "ja3_variants": [ "bbe91749d5e0bc0ee10e844e9b7bda14" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_b55edfc313ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "b55edfc313ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-43-17613-5-23-45-0-27-18-10-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789218775, "last_seen": 1791303652, "transport": "t", "ja3_hash": "914c4a954a7aab4b711d2f01b8c75ff1", "ja3_variant_count": 6, "ja3_variants": [ "914c4a954a7aab4b711d2f01b8c75ff1", "6fdb4375726597788f83ce6535e6a1a6", "ec2fda1203accbe98e3f4ed087e584d3", "9ab9be46108a2857b9089b89ac198e80", "06fd42eb21dbb5106ce0cd19d82492d3", "31ade1b746539c2a6912e7cd3ae4be6e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 16, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d151400_8daaf6152771_b5e2e20639b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "b5e2e20639b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,23-18-0-35-65037-17613-43-5-45-27-11-10-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789472895, "last_seen": 1789472895, "transport": "t", "ja3_hash": "19fabe3db3713859b5ab069976d2c084", "ja3_variant_count": 1, "ja3_variants": [ "19fabe3db3713859b5ab069976d2c084" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_d2b6939ed5a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "d2b6939ed5a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-0-27-18-11-43-5-13-65037-35-65281-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789704978, "last_seen": 1791092460, "transport": "t", "ja3_hash": "23c485ddee094070880688d7b6bdd384", "ja3_variant_count": 2, "ja3_variants": [ "23c485ddee094070880688d7b6bdd384", "366053d3e122c1eb80581f97365f976c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_d914bdf0e682", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "d914bdf0e682", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-10-23-65281-35-5-11-18-51-13-17513-0-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791151714, "last_seen": 1791151714, "transport": "t", "ja3_hash": "f1ef81ca694b6bcafcad436f4b6665ca", "ja3_variant_count": 1, "ja3_variants": [ "f1ef81ca694b6bcafcad436f4b6665ca" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_f51feea270ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "f51feea270ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-27-18-0-10-65281-17613-65037-13-43-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790074352, "last_seen": 1790074352, "transport": "t", "ja3_hash": "5724c360298248266f7249a060a4a741", "ja3_variant_count": 1, "ja3_variants": [ "5724c360298248266f7249a060a4a741" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 33 }, "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_fcceb6b2cc11", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "fcceb6b2cc11", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-13-10-51-35-23-27-65281-18-43-45-11-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790245007, "last_seen": 1791285423, "transport": "t", "ja3_hash": "25ebc18c0f21d0a2b2d0ecfebe3ba3a2", "ja3_variant_count": 3, "ja3_variants": [ "25ebc18c0f21d0a2b2d0ecfebe3ba3a2", "eace9baae5d81f69526bad857c3f6369", "36efb54f6efd276a33a6b7865374ec3e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h1_8daaf6152771_27a5679c8955", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h1", "b": "8daaf6152771", "c": "27a5679c8955", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-5-45-27-0-11-65037-13-65281-10-18-43-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790542997, "last_seen": 1790651005, "transport": "t", "ja3_hash": "6c71771f0c6ad1f07e8561b60f0591ad", "ja3_variant_count": 2, "ja3_variants": [ "6c71771f0c6ad1f07e8561b60f0591ad", "0ef83665a63f83b0ae83eeb26d80bb53" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h1_8daaf6152771_51f2d258eab7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h1", "b": "8daaf6152771", "c": "51f2d258eab7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-45-23-16-65281-13-35-0-27-43-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790523752, "last_seen": 1791128068, "transport": "t", "ja3_hash": "a4cf2d1e8c35371c63b324eebc6a9696", "ja3_variant_count": 3, "ja3_variants": [ "a4cf2d1e8c35371c63b324eebc6a9696", "fb2f285ce6cf354e8927f60a548cde48", "f541e1367f62d35d6fcfd3210a488a5c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h1_8daaf6152771_5786766816c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h1", "b": "8daaf6152771", "c": "5786766816c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-10-65037-43-0-18-13-23-16-11-27-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790546726, "last_seen": 1791285755, "transport": "t", "ja3_hash": "493aefdc0d7606b9f1c396b8aa986241", "ja3_variant_count": 2, "ja3_variants": [ "493aefdc0d7606b9f1c396b8aa986241", "748a64c251b26757f8da6b80803504ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h1_8daaf6152771_63fb81e2e0b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h1", "b": "8daaf6152771", "c": "63fb81e2e0b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-18-10-11-5-43-65281-13-35-45-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790668321, "last_seen": 1791132136, "transport": "t", "ja3_hash": "99c4b6b9ff70c7440de8233604b39e15", "ja3_variant_count": 2, "ja3_variants": [ "99c4b6b9ff70c7440de8233604b39e15", "d24a2ff39b2fdea65b34f890097384dd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h1_8daaf6152771_7f4af075a959", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h1", "b": "8daaf6152771", "c": "7f4af075a959", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-43-13-10-18-65281-0-35-16-65037-45-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790831003, "last_seen": 1791127561, "transport": "t", "ja3_hash": "58dcaaf608fdcafcb9ee21faa3d818ab", "ja3_variant_count": 3, "ja3_variants": [ "58dcaaf608fdcafcb9ee21faa3d818ab", "ed9e055ca2a91f2ea62c62e3f1fee9b6", "3c423935497703bcf027255af4308f9a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h1_8daaf6152771_cd3db9fb5bd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h1", "b": "8daaf6152771", "c": "cd3db9fb5bd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-13-18-0-65281-65037-23-45-16-5-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790720450, "last_seen": 1790992514, "transport": "t", "ja3_hash": "e54181f8b9d7dcb58c1222950f59383f", "ja3_variant_count": 2, "ja3_variants": [ "e54181f8b9d7dcb58c1222950f59383f", "5d37ef6b64d2630d263b6817da64709b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_07b7b0a49ebe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "07b7b0a49ebe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-27-43-11-65037-5-35-13-16-23-51-45-0-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791281953, "last_seen": 1791281953, "transport": "t", "ja3_hash": "275ae9c2b3c4da59132b622a37dc65c1", "ja3_variant_count": 1, "ja3_variants": [ "275ae9c2b3c4da59132b622a37dc65c1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_08908b984a28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "08908b984a28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-43-65037-23-13-65281-10-45-35-16-17613-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789026477, "last_seen": 1789026477, "transport": "t", "ja3_hash": "03f0b0862621c2daa9b3be6360e3baaf", "ja3_variant_count": 1, "ja3_variants": [ "03f0b0862621c2daa9b3be6360e3baaf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_0cf9bc031057", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "0cf9bc031057", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-11-5-45-27-23-13-35-43-65037-0-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790730757, "last_seen": 1790730757, "transport": "t", "ja3_hash": "8a4cdf5d16b14745b272bbf045d3a7ce", "ja3_variant_count": 1, "ja3_variants": [ "8a4cdf5d16b14745b272bbf045d3a7ce" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1332b722e987", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1332b722e987", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17513-0-10-43-27-51-35-16-23-11-45-65281-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791258939, "last_seen": 1791258939, "transport": "t", "ja3_hash": "3a54897dbf840c770e2e3db3aad2f268", "ja3_variant_count": 1, "ja3_variants": [ "3a54897dbf840c770e2e3db3aad2f268" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_19db514f06f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "19db514f06f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-18-23-35-10-45-5-51764-43-13-16-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790701367, "last_seen": 1790701367, "transport": "t", "ja3_hash": "5a6dbd4cda8786533357c2d92cbd98f8", "ja3_variant_count": 1, "ja3_variants": [ "5a6dbd4cda8786533357c2d92cbd98f8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 124 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1a1a03d22a80", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1a1a03d22a80", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-23-51764-65281-27-10-0-45-35-11-16-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790612055, "last_seen": 1790612055, "transport": "t", "ja3_hash": "c7465bc1544f0c3329d03347b7d02847", "ja3_variant_count": 1, "ja3_variants": [ "c7465bc1544f0c3329d03347b7d02847" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.5 Mobile/15A372 Safari/604.1": 3 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1af6631553a8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1af6631553a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,65281-0-11-10-35-5-16-22-18-23-13-43-45-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789598687, "last_seen": 1791111673, "transport": "t", "ja3_hash": "39c3927f95d037dc484a0772d6e1fce6", "ja3_variant_count": 2, "ja3_variants": [ "39c3927f95d037dc484a0772d6e1fce6", "593de49ea8d53dff94ce342c234ec230" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 43, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:157.0) Gecko/20100101 Firefox/157.0": 39 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1d4f866e2a5b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1d4f866e2a5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-65281-18-10-27-51764-13-45-0-43-23-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790795416, "last_seen": 1790795416, "transport": "t", "ja3_hash": "35b0dc7b51479d86da474b046f5b47ef", "ja3_variant_count": 1, "ja3_variants": [ "35b0dc7b51479d86da474b046f5b47ef" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1f4be03e77df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1f4be03e77df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-17513-43-13-23-16-10-65037-18-51-0-11-27,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791138681, "last_seen": 1791138681, "transport": "t", "ja3_hash": "fe15541e6cbc857793c7b6e8119377fb", "ja3_variant_count": 1, "ja3_variants": [ "fe15541e6cbc857793c7b6e8119377fb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1fc5fc5b7724", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1fc5fc5b7724", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-65281-11-27-43-23-45-10-35-0-16-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789682182, "last_seen": 1789830392, "transport": "t", "ja3_hash": "4a88e653c4fede9e6fa9248cdbaf38ee", "ja3_variant_count": 2, "ja3_variants": [ "4a88e653c4fede9e6fa9248cdbaf38ee", "4e4c3b5b68cf10a793e7529288103ef3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_20bc6c80d639", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "20bc6c80d639", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-27-16-23-10-65281-0-43-17613-11-65037-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788934368, "last_seen": 1788934368, "transport": "t", "ja3_hash": "0f53e7a533389168984f7225835ae667", "ja3_variant_count": 1, "ja3_variants": [ "0f53e7a533389168984f7225835ae667" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_2200cfdcc549", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "2200cfdcc549", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-16-65281-27-43-18-13-5-65037-17613-45-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790910269, "last_seen": 1790910269, "transport": "t", "ja3_hash": "196a7b4b0c88cb9046a72337e887086f", "ja3_variant_count": 1, "ja3_variants": [ "196a7b4b0c88cb9046a72337e887086f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_24fc7448ae61", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "24fc7448ae61", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-17613-13-0-11-35-18-43-65037-27-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788767133, "last_seen": 1789502141, "transport": "t", "ja3_hash": "25978cbbce99d2039efb8dd3827fea59", "ja3_variant_count": 2, "ja3_variants": [ "25978cbbce99d2039efb8dd3827fea59", "7b4290b083084a34ac816b26a699165c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_25248d527c53", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "25248d527c53", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-0-13-11-17613-23-35-18-43-27-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789690664, "last_seen": 1789690664, "transport": "t", "ja3_hash": "c45cbee7a8edf21231012830cf5c29dd", "ja3_variant_count": 1, "ja3_variants": [ "c45cbee7a8edf21231012830cf5c29dd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_25dbb02394af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "25dbb02394af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-27-10-65037-13-65281-23-35-0-16-5-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790775195, "last_seen": 1790775195, "transport": "t", "ja3_hash": "159d48d434fb0b5bdb946b1085c3912b", "ja3_variant_count": 1, "ja3_variants": [ "159d48d434fb0b5bdb946b1085c3912b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_2728d5a61cfd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "2728d5a61cfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-35-18-17613-16-0-11-10-65281-43-51764-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791299116, "last_seen": 1791299116, "transport": "t", "ja3_hash": "0ebeeb42e0f1eef891878f31ba3a7870", "ja3_variant_count": 1, "ja3_variants": [ "0ebeeb42e0f1eef891878f31ba3a7870" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_27a5679c8955", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "27a5679c8955", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-16-10-43-18-45-27-13-65037-23-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1791134416, "last_seen": 1791290761, "transport": "t", "ja3_hash": "95f8c6d9ba4e247c40f2fb1861310cdf", "ja3_variant_count": 3, "ja3_variants": [ "95f8c6d9ba4e247c40f2fb1861310cdf", "327c111e96974e2df632c924e97a5e50", "dc9c6bcc877d00f8522c2aa1a2e687bc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_2c4db0fc2997", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "2c4db0fc2997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-27-45-16-0-11-23-10-18-65037-5-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788783551, "last_seen": 1791274996, "transport": "t", "ja3_hash": "76d4faf1a374f40108fa191aa2183467", "ja3_variant_count": 5, "ja3_variants": [ "76d4faf1a374f40108fa191aa2183467", "408ccff2dcf4c5eedb82b36306a4a4fe", "eb898aeca257c5db3bfbcbe46ffa93b3", "d03fe5562a723463211a1f426110e798", "440d1c907c537b58200482514d1ca81a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_30058a01776b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "30058a01776b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-0-27-43-17613-18-11-16-13-10-5-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791134416, "last_seen": 1791134416, "transport": "t", "ja3_hash": "bae033741917cdf5f8b7e6a595635f81", "ja3_variant_count": 1, "ja3_variants": [ "bae033741917cdf5f8b7e6a595635f81" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_31b64f9ffad3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "31b64f9ffad3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-17613-27-35-5-11-43-23-16-65281-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789681090, "last_seen": 1790792469, "transport": "t", "ja3_hash": "26c7e9ce8cf5e560ee8b42474fed4dcf", "ja3_variant_count": 3, "ja3_variants": [ "26c7e9ce8cf5e560ee8b42474fed4dcf", "c5b34641cfeab90308952884c743334f", "0a4eec5be91996a196dddc6dfa9838d0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 9 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_342880a8e893", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "342880a8e893", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-35-10-16-0-27-65037-18-17613-43-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790801832, "last_seen": 1790910288, "transport": "t", "ja3_hash": "fb5b43ed2ae79704a0e4a521d388c876", "ja3_variant_count": 2, "ja3_variants": [ "fb5b43ed2ae79704a0e4a521d388c876", "5055cb8e80942a48393eb3eadfa19783" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_362efb825190", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "362efb825190", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-45-18-27-65281-35-0-10-13-43-51-17513-23,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790749936, "last_seen": 1791288852, "transport": "t", "ja3_hash": "1808136c0c077a4feeb766cef2e72715", "ja3_variant_count": 2, "ja3_variants": [ "1808136c0c077a4feeb766cef2e72715", "eb4c785f3b7d06a80e30a9953ee4b3a5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_389151c7e6bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "389151c7e6bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-11-65281-0-35-10-51764-45-43-65037-23-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790776754, "last_seen": 1790776754, "transport": "t", "ja3_hash": "968c76255b776d5a7bc1683c38e53a29", "ja3_variant_count": 1, "ja3_variants": [ "968c76255b776d5a7bc1683c38e53a29" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_398e419eb1ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "398e419eb1ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17513-43-0-10-35-5-27-65037-11-16-65281-45-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791023852, "last_seen": 1791023852, "transport": "t", "ja3_hash": "b122bc55e626a5b27b87bf65e9f821fd", "ja3_variant_count": 1, "ja3_variants": [ "b122bc55e626a5b27b87bf65e9f821fd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 14 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_3a9c9c8ffd95", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "3a9c9c8ffd95", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-17613-23-18-65037-13-65281-16-35-10-5-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790157012, "last_seen": 1790261238, "transport": "t", "ja3_hash": "ce53a193ca82e5f42c9f634ed8f1411c", "ja3_variant_count": 2, "ja3_variants": [ "ce53a193ca82e5f42c9f634ed8f1411c", "531734cfc1324e879102e8cdbd5aad6c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_3c25478c7562", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "3c25478c7562", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-0-18-16-11-10-65281-35-17613-45-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789921600, "last_seen": 1789921600, "transport": "t", "ja3_hash": "e157eca96f150ead7c8ac0ba53324045", "ja3_variant_count": 1, "ja3_variants": [ "e157eca96f150ead7c8ac0ba53324045" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 35 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_3c2c2e3469bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "3c2c2e3469bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-35-65037-17613-27-43-23-13-45-65281-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788780833, "last_seen": 1790823283, "transport": "t", "ja3_hash": "5245e19d5c7672aeca7f1b5f316a3671", "ja3_variant_count": 4, "ja3_variants": [ "5245e19d5c7672aeca7f1b5f316a3671", "4c29315b4c76f147fe01271dac2fa51e", "d0f428e243b0ffde2797c991ae9f3ea8", "31d8d46271bb57de49a5cd4cefa0ec1c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 10 }, "ua_disagreement": true } }, { "hash": "t13d1514h2_8daaf6152771_3ea961f334b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "3ea961f334b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17513-13-23-35-65037-27-45-16-43-18-51-10-11,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790947084, "last_seen": 1790947084, "transport": "t", "ja3_hash": "2e6b50d07d760cc32f8b145f03c1190d", "ja3_variant_count": 1, "ja3_variants": [ "2e6b50d07d760cc32f8b145f03c1190d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_419065b81354", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "419065b81354", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-16-18-23-43-17613-65037-5-35-13-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790030414, "last_seen": 1790030414, "transport": "t", "ja3_hash": "35691586647f2495fbfdae58016c5f94", "ja3_variant_count": 1, "ja3_variants": [ "35691586647f2495fbfdae58016c5f94" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_42aedd3ed6ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "42aedd3ed6ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-65281-35-17613-16-23-65037-11-18-43-45-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790168398, "last_seen": 1791110095, "transport": "t", "ja3_hash": "163800b7a6fe2aa363555b8c4492b6ca", "ja3_variant_count": 4, "ja3_variants": [ "163800b7a6fe2aa363555b8c4492b6ca", "6370f21b9473f85cf2dda11bc0676cd2", "32cdd3f1be7af6c0647edc350afbb255", "1a34945eee38db9168eff542c7078a7e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_45e3c4ab240f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "45e3c4ab240f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-65281-35-18-11-43-0-5-65037-13-27-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789235832, "last_seen": 1789235832, "transport": "t", "ja3_hash": "d1ab5a254d4d5ff33161cacec032f761", "ja3_variant_count": 1, "ja3_variants": [ "d1ab5a254d4d5ff33161cacec032f761" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_474d83e5ce4d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "474d83e5ce4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-0-65281-43-35-51764-11-10-16-5-13-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723972, "last_seen": 1788723972, "transport": "t", "ja3_hash": "20b7da36ba1531f17c19306b46d13f63", "ja3_variant_count": 1, "ja3_variants": [ "20b7da36ba1531f17c19306b46d13f63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_4a4465664e59", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "4a4465664e59", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-5-18-35-65037-43-13-27-65281-23-45-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789269650, "last_seen": 1789269650, "transport": "t", "ja3_hash": "3a3e8e5cd4b8f2051cf277b6f94f96f1", "ja3_variant_count": 1, "ja3_variants": [ "3a3e8e5cd4b8f2051cf277b6f94f96f1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 17 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_4c1352b6d50a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "4c1352b6d50a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-17513-0-16-10-45-13-5-43-27-11-18-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791285422, "last_seen": 1791285422, "transport": "t", "ja3_hash": "348bf3bc94ac12326783adb33b114e33", "ja3_variant_count": 1, "ja3_variants": [ "348bf3bc94ac12326783adb33b114e33" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_4c3e36eb8b85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "4c3e36eb8b85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-13-11-65037-35-18-17613-43-0-65281-23-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789396227, "last_seen": 1789396227, "transport": "t", "ja3_hash": "8cca44818664659bb397c8f50d910db0", "ja3_variant_count": 1, "ja3_variants": [ "8cca44818664659bb397c8f50d910db0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_4d8205f39aa6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "4d8205f39aa6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-17613-65281-43-11-0-51764-27-45-23-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789501592, "last_seen": 1789501592, "transport": "t", "ja3_hash": "73713b939a398efffa35861353d3c8e7", "ja3_variant_count": 1, "ja3_variants": [ "73713b939a398efffa35861353d3c8e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_4e4938c0b65f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "4e4938c0b65f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-45-17613-51764-27-16-11-65037-0-5-43-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790614831, "last_seen": 1790614831, "transport": "t", "ja3_hash": "b51e47c4352a79d01de492f91d4f1911", "ja3_variant_count": 1, "ja3_variants": [ "b51e47c4352a79d01de492f91d4f1911" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_4f3cc336e3ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "4f3cc336e3ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-17613-45-43-5-16-23-18-0-11-65281-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789710908, "last_seen": 1790615509, "transport": "t", "ja3_hash": "8d18d7a7240e7fa6fb702b7e39ffd395", "ja3_variant_count": 2, "ja3_variants": [ "8d18d7a7240e7fa6fb702b7e39ffd395", "01f4a34a6325cd68863cf30e818ef97e" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_5156df582fb1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "5156df582fb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-43-13-18-35-11-23-0-16-5-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789297578, "last_seen": 1791008457, "transport": "t", "ja3_hash": "6b92dc94eea5bdf62de88bace098a73d", "ja3_variant_count": 2, "ja3_variants": [ "6b92dc94eea5bdf62de88bace098a73d", "94b80e67175e02b352205ffb9be19765" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_51f2d258eab7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "51f2d258eab7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-65281-10-51-45-16-5-13-43-0-35-27-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788763910, "last_seen": 1791151485, "transport": "t", "ja3_hash": "ff5b028242233adc0c6f2034642031f8", "ja3_variant_count": 5, "ja3_variants": [ "ff5b028242233adc0c6f2034642031f8", "163334d30b759acac66983e0dc752aa2", "8a1ea8fc5ed71c2449479477dc837db8", "75df95efd20666c811a430fc01e9b36b", "f29c83f7c1a8752506257f13b9b623df" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1, "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_52eba7f6c990", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "52eba7f6c990", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-35-5-43-65281-45-0-13-18-17513-16-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791298764, "last_seen": 1791298764, "transport": "t", "ja3_hash": "f175c99dece46b2a2051133784885e73", "ja3_variant_count": 1, "ja3_variants": [ "f175c99dece46b2a2051133784885e73" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_56c108fb2cc0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "56c108fb2cc0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-43-65281-23-17613-65037-16-5-45-11-35-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789638160, "last_seen": 1789638160, "transport": "t", "ja3_hash": "de965c29e6a44db08fe64f8a7d0ff91d", "ja3_variant_count": 1, "ja3_variants": [ "de965c29e6a44db08fe64f8a7d0ff91d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_5786766816c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "5786766816c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-35-11-0-43-65037-5-18-27-16-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789275257, "last_seen": 1791127813, "transport": "t", "ja3_hash": "68ccceff0cfc1ae9a8834907565ab436", "ja3_variant_count": 2, "ja3_variants": [ "68ccceff0cfc1ae9a8834907565ab436", "57988aec5bbdc7f1040a4acc7e9669c5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_58209ee19485", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "58209ee19485", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-0-13-23-18-10-45-65037-35-43-5-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790400256, "last_seen": 1790400256, "transport": "t", "ja3_hash": "545ba20b76e51d1418e19a0400514bf0", "ja3_variant_count": 1, "ja3_variants": [ "545ba20b76e51d1418e19a0400514bf0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_59b0e2bfbd0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "59b0e2bfbd0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65037-45-65281-23-0-5-11-43-18-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789693278, "last_seen": 1789693278, "transport": "t", "ja3_hash": "5ef0f58f3d061ab3898319a939796138", "ja3_variant_count": 1, "ja3_variants": [ "5ef0f58f3d061ab3898319a939796138" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_6187e47ca8d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "6187e47ca8d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-18-43-13-10-11-27-5-45-17613-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790365723, "last_seen": 1790669346, "transport": "t", "ja3_hash": "2e04dc29908f5c865e49f5824cbc05e0", "ja3_variant_count": 2, "ja3_variants": [ "2e04dc29908f5c865e49f5824cbc05e0", "50a39765e0440da0b0369bcb01443112" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_636a2ff460f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "636a2ff460f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-65281-0-11-5-43-23-27-13-17613-18-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789052252, "last_seen": 1789052252, "transport": "t", "ja3_hash": "7860bc4b9cf41f19845caf9fe5729b47", "ja3_variant_count": 1, "ja3_variants": [ "7860bc4b9cf41f19845caf9fe5729b47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_63eb582b2506", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "63eb582b2506", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-16-18-45-17613-27-65037-43-23-13-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789811872, "last_seen": 1789811872, "transport": "t", "ja3_hash": "a0628ae4f53a3981c4e7da92b9185929", "ja3_variant_count": 1, "ja3_variants": [ "a0628ae4f53a3981c4e7da92b9185929" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_63fb81e2e0b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "63fb81e2e0b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-65281-5-16-10-13-23-43-18-45-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789523446, "last_seen": 1790365761, "transport": "t", "ja3_hash": "9df6e9ee399fd64a81227dee477645d9", "ja3_variant_count": 2, "ja3_variants": [ "9df6e9ee399fd64a81227dee477645d9", "d6e2de2d6344c2d60511f17509f74774" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_692f75fec39d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "692f75fec39d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-13-51764-18-10-17613-5-16-35-11-45-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790970412, "last_seen": 1790970412, "transport": "t", "ja3_hash": "c96e8dac642e731bb626f7d51d5d73b7", "ja3_variant_count": 1, "ja3_variants": [ "c96e8dac642e731bb626f7d51d5d73b7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_6c36ae5ad63f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "6c36ae5ad63f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-35-10-65037-0-43-5-45-51-17513-11-65281-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791132296, "last_seen": 1791132296, "transport": "t", "ja3_hash": "67d6f196de105c176702db92da0c45c0", "ja3_variant_count": 1, "ja3_variants": [ "67d6f196de105c176702db92da0c45c0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_6d588e87bffe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "6d588e87bffe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-65037,4588-29-23-24-25-514,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791147647, "last_seen": 1791147648, "transport": "t", "ja3_hash": "40c5aa5b4e9c282c3d321bf9c52c8632", "ja3_variant_count": 1, "ja3_variants": [ "40c5aa5b4e9c282c3d321bf9c52c8632" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_73cbf7a5c573", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "73cbf7a5c573", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-49172-49171-157-156-53-47,0-5-10-11-16-17-23-35-13-43-45-50-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1788075524, "last_seen": 1791297233, "transport": "t", "ja3_hash": "aa5064e82d8717fcdf164fa9d77b78bb", "ja3_variant_count": 1, "ja3_variants": [ "aa5064e82d8717fcdf164fa9d77b78bb" ], "user_agents": { "LinkupBot/1.0 (LinkupBot for web indexing; https://linkup.so/bot; bot@linkup.so)": 189, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_73f68b58e4af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "73f68b58e4af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-65037-18-10-27-11-17613-45-43-0-16-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788795476, "last_seen": 1788799295, "transport": "t", "ja3_hash": "46bdf497960bb9a7d8788affb24f1514", "ja3_variant_count": 2, "ja3_variants": [ "46bdf497960bb9a7d8788affb24f1514", "c9ae3f14e21aca24a27f85b887f8a20a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_7a831923fffc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "7a831923fffc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17513-65281-65037-23-0-16-27-13-45-43-18-10-5,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790942094, "last_seen": 1790942094, "transport": "t", "ja3_hash": "5a9e74438b0db6c1e571c9874ff2c125", "ja3_variant_count": 1, "ja3_variants": [ "5a9e74438b0db6c1e571c9874ff2c125" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_7c8059000ff8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "7c8059000ff8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-10-27-23-65281-45-43-18-35-16-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789829432, "last_seen": 1791297185, "transport": "t", "ja3_hash": "c19e310adb52dcf5a07cf28bb048d3a2", "ja3_variant_count": 4, "ja3_variants": [ "c19e310adb52dcf5a07cf28bb048d3a2", "70976336d36e1ffa94fa2a81607fad6a", "0790ca31030226a09aa2c6272befbde7", "2a78feaff50e5aa6199167b4538f9f5c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_7e5aed647656", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "7e5aed647656", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-65281-43-0-16-13-51764-45-27-11-5-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791122618, "last_seen": 1791123319, "transport": "t", "ja3_hash": "043bd1052732a20273319f26579d610b", "ja3_variant_count": 2, "ja3_variants": [ "043bd1052732a20273319f26579d610b", "3eee5125f1a83da162de0d0cdfcd7418" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_7f4af075a959", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "7f4af075a959", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-43-65281-18-27-5-0-11-45-13-35-51-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791139419, "last_seen": 1791139419, "transport": "t", "ja3_hash": "f412ed31cb052c385ca7a6b28f0fd2da", "ja3_variant_count": 1, "ja3_variants": [ "f412ed31cb052c385ca7a6b28f0fd2da" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_7f5581f3f044", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "7f5581f3f044", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-10-16-23-45-11-13-27-18-65281-17513-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789224355, "last_seen": 1789224355, "transport": "t", "ja3_hash": "3759d068d6b13600fd3272af231df098", "ja3_variant_count": 1, "ja3_variants": [ "3759d068d6b13600fd3272af231df098" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_80f5501927c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "80f5501927c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-27-16-45-17613-23-18-11-43-0-5-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788454159, "last_seen": 1790188060, "transport": "t", "ja3_hash": "3765716bcf2aaadf8c26574ebf4a0210", "ja3_variant_count": 2, "ja3_variants": [ "3765716bcf2aaadf8c26574ebf4a0210", "bfdfa69ef7cf12d18b594e4336caa3df" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 43 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_813ab7433aa2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "813ab7433aa2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-27-43-18-17513-5-16-13-10-35-45-11-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791132691, "last_seen": 1791132691, "transport": "t", "ja3_hash": "31e44101c217b6e67159cde1b899034d", "ja3_variant_count": 1, "ja3_variants": [ "31e44101c217b6e67159cde1b899034d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_850de29fb30b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "850de29fb30b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-0-27-16-35-17513-65281-10-45-65037-18-43-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791142796, "last_seen": 1791142796, "transport": "t", "ja3_hash": "9f3f1ced9c48640c9fd2998560a2768f", "ja3_variant_count": 1, "ja3_variants": [ "9f3f1ced9c48640c9fd2998560a2768f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_865757d90d4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "865757d90d4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-5-27-13-10-43-16-17613-35-45-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789200140, "last_seen": 1791021423, "transport": "t", "ja3_hash": "5bcdc75224e4cb86c24c293480e945aa", "ja3_variant_count": 3, "ja3_variants": [ "5bcdc75224e4cb86c24c293480e945aa", "74b6f8c2250ef4af5e1c9d7b3ad74f34", "367b6ed4384ed176420d71e313204930" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_86767b78d6b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "86767b78d6b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-5-0-65037-17513-16-65281-23-43-27-10-11-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791103544, "last_seen": 1791103544, "transport": "t", "ja3_hash": "f8787512e8faee500ffe60501f1a8ee4", "ja3_variant_count": 1, "ja3_variants": [ "f8787512e8faee500ffe60501f1a8ee4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_884db413776a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "884db413776a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-35-5-11-43-45-18-17613-65037-16-23-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790687878, "last_seen": 1790687878, "transport": "t", "ja3_hash": "2e4f7daf1738e478495cbb855fd75edc", "ja3_variant_count": 1, "ja3_variants": [ "2e4f7daf1738e478495cbb855fd75edc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8c454e6c488f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8c454e6c488f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 68, "first_seen": 1787726584, "last_seen": 1790917322, "transport": "t", "ja3_hash": "1aa04f421fd20265d395398fdc1d1d23", "ja3_variant_count": 2, "ja3_variants": [ "1aa04f421fd20265d395398fdc1d1d23", "187137a9915871bcf05509b22adf6537" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 84, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 37, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 92, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 1199, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 38 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8db96647b8c7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8db96647b8c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-45-65037-11-23-18-10-35-65281-17613-0-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1790013392, "last_seen": 1790784513, "transport": "t", "ja3_hash": "0ce76bbcd2cee7d80691c1840008dbbf", "ja3_variant_count": 5, "ja3_variants": [ "0ce76bbcd2cee7d80691c1840008dbbf", "f3468acab7790e25e26d6f8e7bcc5ae8", "10150ed73386159a2010be34d2ca9714", "c75c0d05e9a6828a157ae98054611e26", "15c46114735d11c2458fa1791d73cd02" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_9015387edb43", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "9015387edb43", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-51764-65281-16-0-35-65037-18-10-45-23-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789582324, "last_seen": 1789582324, "transport": "t", "ja3_hash": "f2437466f626e816a5316ee15ce33f9d", "ja3_variant_count": 1, "ja3_variants": [ "f2437466f626e816a5316ee15ce33f9d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_90dc8a8d6910", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "90dc8a8d6910", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-35-23-51-43-0-16-11-10-17513-5-65281-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790946271, "last_seen": 1791259890, "transport": "t", "ja3_hash": "a4c4f29cafee336211899d11912b0c36", "ja3_variant_count": 2, "ja3_variants": [ "a4c4f29cafee336211899d11912b0c36", "fe0f256ebb1f72908b79b6bbfc780a3d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_9245dac68252", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "9245dac68252", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-51764-17613-43-65037-35-11-13-27-0-10-16-51,514-4588-24-23-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789387668, "last_seen": 1789387668, "transport": "t", "ja3_hash": "9841fd4d17bb9d0192b1860ba1a0d2b8", "ja3_variant_count": 1, "ja3_variants": [ "9841fd4d17bb9d0192b1860ba1a0d2b8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_92622c545fa6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "92622c545fa6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-35-18-27-11-65037-16-45-23-43-65281-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788763981, "last_seen": 1791056110, "transport": "t", "ja3_hash": "697860f34549d922c4d0e7c648c5f5f0", "ja3_variant_count": 6, "ja3_variants": [ "697860f34549d922c4d0e7c648c5f5f0", "635c6e02627f24d5db2435f3d425a1f5", "18943563a2d0a88ea86b4ee5533c8ddc", "2e19542146f8fe74b681de67e13dae7a", "23746bacc7d8118f9e1aa8aea1175f5f", "65879add1ca6d80fa5c93680092286ea" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_93cd10c2e207", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "93cd10c2e207", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-11-10-35-5-16-22-18-23-13-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 63, "first_seen": 1787499439, "last_seen": 1791320934, "transport": "t", "ja3_hash": "b02badf706ed5d554852e0e875725f7c", "ja3_variant_count": 1, "ja3_variants": [ "b02badf706ed5d554852e0e875725f7c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_985d6b6ad2d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "985d6b6ad2d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51764-13-65037-16-0-11-17613-65281-18-43-35-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789912447, "last_seen": 1789912447, "transport": "t", "ja3_hash": "206065595478d0ad1bd9bff24c62f173", "ja3_variant_count": 1, "ja3_variants": [ "206065595478d0ad1bd9bff24c62f173" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_99442b7dc9c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "99442b7dc9c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-17613-0-45-5-11-35-10-16-23-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790266536, "last_seen": 1790266536, "transport": "t", "ja3_hash": "423fa4c65726ca6bfaeed3f5a1461a10", "ja3_variant_count": 1, "ja3_variants": [ "423fa4c65726ca6bfaeed3f5a1461a10" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_9a1dbddbdfdc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "9a1dbddbdfdc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-65037-43-51764-27-5-16-0-65281-23-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790524401, "last_seen": 1790524401, "transport": "t", "ja3_hash": "8e4069ccbb1172a04b3fcaad58a2c25a", "ja3_variant_count": 1, "ja3_variants": [ "8e4069ccbb1172a04b3fcaad58a2c25a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_9d692b05e0ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "9d692b05e0ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51-45-27-11-0-16-5-10-35-65281-23-43-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791142071, "last_seen": 1791142071, "transport": "t", "ja3_hash": "a1982e8cb188db8a40e0776885273bb6", "ja3_variant_count": 1, "ja3_variants": [ "a1982e8cb188db8a40e0776885273bb6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_a27d67f4421e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "a27d67f4421e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-65037-0-16-17513-23-5-35-45-51-13-27-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791103545, "last_seen": 1791105973, "transport": "t", "ja3_hash": "5f787d9c66e8d64c136347826980826e", "ja3_variant_count": 2, "ja3_variants": [ "5f787d9c66e8d64c136347826980826e", "9e4ed704cedd10a8ec3c5b588373d5df" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_a65c741dc333", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "a65c741dc333", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-45-13-10-5-16-65281-0-11-43-65037-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789744528, "last_seen": 1789744528, "transport": "t", "ja3_hash": "dea7a5f1b635ee21b77d5775dfa052a1", "ja3_variant_count": 1, "ja3_variants": [ "dea7a5f1b635ee21b77d5775dfa052a1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_a9bc28779ae8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "a9bc28779ae8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-65037-45-11-65281-43-0-27-35-23-13-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789190602, "last_seen": 1789190602, "transport": "t", "ja3_hash": "81316e82d8d0e5db8cd69d9074169042", "ja3_variant_count": 1, "ja3_variants": [ "81316e82d8d0e5db8cd69d9074169042" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_aaa5fd0a57d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "aaa5fd0a57d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-18-0-11-10-5-43-27-23-13-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789688981, "last_seen": 1790244507, "transport": "t", "ja3_hash": "d494419764432e2a5fee485f0662679f", "ja3_variant_count": 2, "ja3_variants": [ "d494419764432e2a5fee485f0662679f", "21f165607b7a60f65f4266ac72340baf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_aae909b7a6e3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "aae909b7a6e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-23-18-43-5-10-0-27-11-65037-17613-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788582200, "last_seen": 1790970023, "transport": "t", "ja3_hash": "439be6aceef73c48a009caa83ce7732a", "ja3_variant_count": 3, "ja3_variants": [ "439be6aceef73c48a009caa83ce7732a", "6e183b327d58ab5be55879a9b7fa877d", "106e2c9296ee7a636272e043b90cb795" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_adc3312f7993", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "adc3312f7993", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-23-17613-18-13-5-45-16-0-65037-27-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790879667, "last_seen": 1790879667, "transport": "t", "ja3_hash": "94f3b7e0a87b17ac1c969da5b51ea2d6", "ja3_variant_count": 1, "ja3_variants": [ "94f3b7e0a87b17ac1c969da5b51ea2d6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_af25c18464fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "af25c18464fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-5-16-0-18-43-65281-23-17613-35-65037-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788535347, "last_seen": 1789518370, "transport": "t", "ja3_hash": "a32f87e0a9a26d094c2d81de65b695ce", "ja3_variant_count": 2, "ja3_variants": [ "a32f87e0a9a26d094c2d81de65b695ce", "5158ddd54173111fc158d72fd95bf04a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_b18b2910b97b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "b18b2910b97b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-65281-16-45-0-18-65037-11-13-10-35-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790903704, "last_seen": 1790903704, "transport": "t", "ja3_hash": "f2cc1a8189fbc879cb0c9dd3d6c55075", "ja3_variant_count": 1, "ja3_variants": [ "f2cc1a8189fbc879cb0c9dd3d6c55075" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_b3aa51c49899", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "b3aa51c49899", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-5-13-16-45-35-11-23-65281-0-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788797776, "last_seen": 1790964367, "transport": "t", "ja3_hash": "442884c3a57e040deab2c32a215b99b6", "ja3_variant_count": 4, "ja3_variants": [ "442884c3a57e040deab2c32a215b99b6", "28f6a9ea0f3892c94268382120c8e799", "ab1c5d5a5b2bcba655b2e0460c58a30f", "fb48dcb6ca31613f0bb40850d7c1814c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_b8fcc8ee221f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "b8fcc8ee221f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-13-10-43-16-27-18-17613-65281-0-45-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789789513, "last_seen": 1789789513, "transport": "t", "ja3_hash": "f1f6e843bd249e0f36c29386551d54e7", "ja3_variant_count": 1, "ja3_variants": [ "f1f6e843bd249e0f36c29386551d54e7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36 OPR/101.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_bce322f8abc7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "bce322f8abc7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-45-43-65037-11-5-0-17613-10-65281-27-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788805604, "last_seen": 1789421777, "transport": "t", "ja3_hash": "f4f6af799e4cccb46f2f4ea019acb0fd", "ja3_variant_count": 2, "ja3_variants": [ "f4f6af799e4cccb46f2f4ea019acb0fd", "cc7daabbfd4e1bd12ccc2d935cb93105" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_be1965d35c81", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "be1965d35c81", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-13-11-35-18-17513-10-65037-5-65281-16-0-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791131005, "last_seen": 1791131005, "transport": "t", "ja3_hash": "5e858050254eb95450898e1355f3ce39", "ja3_variant_count": 1, "ja3_variants": [ "5e858050254eb95450898e1355f3ce39" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_c0ac541475af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "c0ac541475af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-13-23-27-43-65037-11-0-16-45-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791162605, "last_seen": 1791162605, "transport": "t", "ja3_hash": "a012eb467ed7e309bb387e6c22f5d50c", "ja3_variant_count": 1, "ja3_variants": [ "a012eb467ed7e309bb387e6c22f5d50c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_c20a0b8dfe0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "c20a0b8dfe0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-45-35-13-0-16-65281-5-18-23-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790188296, "last_seen": 1790188296, "transport": "t", "ja3_hash": "5eeb0cd8680893a5680674b422c034b4", "ja3_variant_count": 1, "ja3_variants": [ "5eeb0cd8680893a5680674b422c034b4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_c55f5d51fd72", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "c55f5d51fd72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-27-17613-0-43-13-10-23-16-35-45-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790260024, "last_seen": 1790260024, "transport": "t", "ja3_hash": "280a08f2f514e6c451243e4e0406de75", "ja3_variant_count": 1, "ja3_variants": [ "280a08f2f514e6c451243e4e0406de75" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_c5b669d7a290", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "c5b669d7a290", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-13-45-11-23-16-27-51-18-5-0-65281-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790931489, "last_seen": 1791125390, "transport": "t", "ja3_hash": "9c95651341401b5c6620b75e7f2c3c0a", "ja3_variant_count": 2, "ja3_variants": [ "9c95651341401b5c6620b75e7f2c3c0a", "63ef2bf6b01d8150009b4bac5669e0d3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_c8190dc0ea5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "c8190dc0ea5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-18-13-5-45-17613-27-10-23-43-65037-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790730220, "last_seen": 1790730220, "transport": "t", "ja3_hash": "eabbf99fa8cf5596883642391861a1c4", "ja3_variant_count": 1, "ja3_variants": [ "eabbf99fa8cf5596883642391861a1c4" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_cd3db9fb5bd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "cd3db9fb5bd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-35-43-16-13-10-5-65281-18-51-11-45-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790942442, "last_seen": 1791106863, "transport": "t", "ja3_hash": "b676b17f541fdbe64df2dcc7245f85ce", "ja3_variant_count": 2, "ja3_variants": [ "b676b17f541fdbe64df2dcc7245f85ce", "d418cce9080c23894d5c630082aaa484" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_cd7bdcbb6e84", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "cd7bdcbb6e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-45-35-5-11-23-51-17513-27-65281-0-10-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790944038, "last_seen": 1790944038, "transport": "t", "ja3_hash": "a99bbbb13a608c49ce1f42f90124bca6", "ja3_variant_count": 1, "ja3_variants": [ "a99bbbb13a608c49ce1f42f90124bca6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d0956fc89721", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d0956fc89721", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-23-16-45-43-11-65037-5-27-0-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789218775, "last_seen": 1790114052, "transport": "t", "ja3_hash": "a2c46d6d3e57f2f855339cc7a2f9a985", "ja3_variant_count": 2, "ja3_variants": [ "a2c46d6d3e57f2f855339cc7a2f9a985", "e0ffa99676a0f1ae22c7a1852baeb06b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d0a515fc23e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d0a515fc23e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-18-5-11-27-65281-45-23-35-0-16-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1790038103, "last_seen": 1791040177, "transport": "t", "ja3_hash": "cf2c3011b8faec4c9d33d405afe21b37", "ja3_variant_count": 5, "ja3_variants": [ "cf2c3011b8faec4c9d33d405afe21b37", "3bec6bf2d5b5c1ee0ec5b3d2724af4a4", "586868f9cb7a7769e0d17c7bf8abc1e6", "32b333019fdd718a2d09c34a6b2ff944", "3ac7870cb8f3cdf8bc4a92add7fb1af3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 93, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d4b83fd0d28b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d4b83fd0d28b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-27-0-10-65281-11-23-5-17613-16-45-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791032351, "last_seen": 1791112537, "transport": "t", "ja3_hash": "5091dc5da992cc0595631f3246b5b63f", "ja3_variant_count": 2, "ja3_variants": [ "5091dc5da992cc0595631f3246b5b63f", "567b5d5fc87072a398559a138b5c5062" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d53ef77a7cb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d53ef77a7cb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-5-16-65037-17613-65281-27-0-11-13-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788572615, "last_seen": 1790202094, "transport": "t", "ja3_hash": "3b1b7f33b9db6531e252319f1f73e359", "ja3_variant_count": 2, "ja3_variants": [ "3b1b7f33b9db6531e252319f1f73e359", "49177d1434d8316acd6f355647523826" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d58b6e6bdb17", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d58b6e6bdb17", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-18-45-65281-27-16-23-0-65037-5-13-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790210584, "last_seen": 1790210584, "transport": "t", "ja3_hash": "c0aa60b05deef3e3055764e87fc87def", "ja3_variant_count": 1, "ja3_variants": [ "c0aa60b05deef3e3055764e87fc87def" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d5d19a128d03", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d5d19a128d03", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-5-27-65037-11-23-43-51764-18-65281-13-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790791957, "last_seen": 1791120885, "transport": "t", "ja3_hash": "04ff756075e398ea8a076e210eb9b3c4", "ja3_variant_count": 2, "ja3_variants": [ "04ff756075e398ea8a076e210eb9b3c4", "40e955905d69339b97916ac6fa687e75" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d776d99b8999", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d776d99b8999", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-17613-10-11-43-0-13-23-16-45-65037-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788849013, "last_seen": 1788849013, "transport": "t", "ja3_hash": "7cf01c4502e3abebc6b9c1a178f64a1b", "ja3_variant_count": 1, "ja3_variants": [ "7cf01c4502e3abebc6b9c1a178f64a1b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_db767b499e3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "db767b499e3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-5-13-23-17513-16-0-10-43-35-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791119796, "last_seen": 1791119796, "transport": "t", "ja3_hash": "e747ace7126dc0b5db9bd45ab661f9ed", "ja3_variant_count": 1, "ja3_variants": [ "e747ace7126dc0b5db9bd45ab661f9ed" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_df425e601b1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "df425e601b1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-13-18-16-45-65281-17613-43-0-27-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788760890, "last_seen": 1791269855, "transport": "t", "ja3_hash": "43b8954355396148fbeae4a874ff2e60", "ja3_variant_count": 4, "ja3_variants": [ "43b8954355396148fbeae4a874ff2e60", "81e698e8b7c0489ac466a402db219ed8", "147302701d21e58a6d4cc0dccf9b082d", "6540f9c47fd9b3b0455ca1097834c6d4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e0b8af989198", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e0b8af989198", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-11-18-27-5-0-17613-45-10-35-65281-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790219899, "last_seen": 1791111439, "transport": "t", "ja3_hash": "cd2c7cac528f3ed61c123c475b835ee2", "ja3_variant_count": 3, "ja3_variants": [ "cd2c7cac528f3ed61c123c475b835ee2", "a7b42a1ac7d275d8a44154ff2d9bc189", "a82c0479aede31fd658aef5c6f3e0273" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e344b0713dc8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e344b0713dc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-0-45-43-23-65037-51764-18-16-13-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723975, "last_seen": 1788723975, "transport": "t", "ja3_hash": "e8c55506b8723554201e4b0766bff714", "ja3_variant_count": 1, "ja3_variants": [ "e8c55506b8723554201e4b0766bff714" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e356b77a17f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e356b77a17f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17513-27-35-0-13-45-43-10-23-65281-5-16-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791107527, "last_seen": 1791107527, "transport": "t", "ja3_hash": "404007668d2d2c1f97818e72ed656db1", "ja3_variant_count": 1, "ja3_variants": [ "404007668d2d2c1f97818e72ed656db1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e4114975bb68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e4114975bb68", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-35-16-45-65037-5-0-23-10-17613-43-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790037799, "last_seen": 1790970016, "transport": "t", "ja3_hash": "0177d4904b353954cffe428c4585ea51", "ja3_variant_count": 3, "ja3_variants": [ "0177d4904b353954cffe428c4585ea51", "862543bbc13753e0afb092eaf7fadb60", "8ac03f930e467d19a742091c098f58a5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.1 Safari/537.36 Edg/135.0.1": 2 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e6531b609eba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e6531b609eba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-5-16-27-10-35-18-0-13-43-23-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788619025, "last_seen": 1791240850, "transport": "t", "ja3_hash": "9cb9d08c72d075ce0078ecf7204b81cf", "ja3_variant_count": 3, "ja3_variants": [ "9cb9d08c72d075ce0078ecf7204b81cf", "4fca32ed6e1a160ccbfc2ba0c1463a4f", "a017a2d758e238464ef2b16a0f4bfad4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e6e287f79e91", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e6e287f79e91", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-16-17613-0-11-65281-65037-45-35-18-43-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788815247, "last_seen": 1789829346, "transport": "t", "ja3_hash": "c97630f3c23c6234e5229453abcf8bba", "ja3_variant_count": 3, "ja3_variants": [ "c97630f3c23c6234e5229453abcf8bba", "697d7347a18e8b06856101780be4e3a4", "b902d2704afa35e5fe6bf9dbbeac34c8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e771cc5dc58e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e771cc5dc58e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-23-35-65037-5-27-43-17613-16-0-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789027875, "last_seen": 1790749935, "transport": "t", "ja3_hash": "9e1f30d40e38651be142eadc964ba4b9", "ja3_variant_count": 2, "ja3_variants": [ "9e1f30d40e38651be142eadc964ba4b9", "7c67d9664a0d23695f3b8d86c69420fb" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f46fc8c2f2dc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f46fc8c2f2dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-45-10-5-43-13-11-0-51-16-27-23-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790712281, "last_seen": 1791290770, "transport": "t", "ja3_hash": "bcbcd7007b0664dc7c18b8d945b88177", "ja3_variant_count": 2, "ja3_variants": [ "bcbcd7007b0664dc7c18b8d945b88177", "8c8cea4e0a59ea64ceaa21813f9f9ca1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f4f0fb6c2e78", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f4f0fb6c2e78", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-11-18-17613-10-27-23-16-13-0-65281-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788782444, "last_seen": 1791222074, "transport": "t", "ja3_hash": "45a81e97cd2d18642eb65884987aee47", "ja3_variant_count": 4, "ja3_variants": [ "45a81e97cd2d18642eb65884987aee47", "371daf4e63787f8d49be964e676dbea6", "f1a4bfb964cf8837d62cccf9e28c6831", "8158c5dbebf8b99a3197bc1524541b4b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f50a2d4aa895", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f50a2d4aa895", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-65037-18-0-27-11-13-23-16-10-17613-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789189098, "last_seen": 1789189098, "transport": "t", "ja3_hash": "52fb0e80cbf81248a7620a7d5a98d10b", "ja3_variant_count": 1, "ja3_variants": [ "52fb0e80cbf81248a7620a7d5a98d10b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 242 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f924904747ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f924904747ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 81, "first_seen": 1787631593, "last_seen": 1791349081, "transport": "t", "ja3_hash": "3e9b20610098b6c9bff953856e58016a", "ja3_variant_count": 2, "ja3_variants": [ "3e9b20610098b6c9bff953856e58016a", "87a6e6799ead1f216ceb3988e4b7a0dd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 54, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 36, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_faa038b2a4d3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "faa038b2a4d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-10-35-43-18-65037-17613-27-16-45-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790698094, "last_seen": 1790698094, "transport": "t", "ja3_hash": "c4498bab3a9bd4c3fba40e544c15ead7", "ja3_variant_count": 1, "ja3_variants": [ "c4498bab3a9bd4c3fba40e544c15ead7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_fbd25e66d252", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "fbd25e66d252", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-35-10-16-11-65281-17613-65037-45-51764-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790656943, "last_seen": 1790656943, "transport": "t", "ja3_hash": "4ac78a2ee529d988b97e9e864efa9e11", "ja3_variant_count": 1, "ja3_variants": [ "4ac78a2ee529d988b97e9e864efa9e11" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_fc755a7714b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "fc755a7714b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-17613-5-45-10-23-18-43-13-65037-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790321143, "last_seen": 1790321143, "transport": "t", "ja3_hash": "16ceaac920a0e969857dc4bdf9b5a1ce", "ja3_variant_count": 1, "ja3_variants": [ "16ceaac920a0e969857dc4bdf9b5a1ce" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_fcf0266dd014", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "fcf0266dd014", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-43-65281-17513-0-16-11-27-10-65037-5-51-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791121249, "last_seen": 1791121249, "transport": "t", "ja3_hash": "ac1245ee44735f1d32ca1fc022fb22b5", "ja3_variant_count": 1, "ja3_variants": [ "ac1245ee44735f1d32ca1fc022fb22b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_fdea054b141e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "fdea054b141e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-17613-16-45-23-0-65281-43-65037-27-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789027837, "last_seen": 1791251621, "transport": "t", "ja3_hash": "28f1efb810525c21e7b227d219091bc0", "ja3_variant_count": 3, "ja3_variants": [ "28f1efb810525c21e7b227d219091bc0", "b90709dbd7605b89c6e58c64296755f2", "780b6e5a889761239303b4df5d3e6d9c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1514ht_8daaf6152771_73cbf7a5c573", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514ht", "b": "8daaf6152771", "c": "73cbf7a5c573", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-11-16-17-23-35-13-43-45-50-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789539259, "last_seen": 1790769829, "transport": "t", "ja3_hash": "4c29139ef11717f4ea726dc6572387ed", "ja3_variant_count": 1, "ja3_variants": [ "4c29139ef11717f4ea726dc6572387ed" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36/Nutch-1.23-SNAPSHOT": 8 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_038797f4dd52", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "038797f4dd52", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-10-51-65037-23-35-43-13-17513-5-11-65281-45-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790949885, "last_seen": 1790958020, "transport": "t", "ja3_hash": "6eb2513f97fd4efc1c865f7a64afe566", "ja3_variant_count": 2, "ja3_variants": [ "6eb2513f97fd4efc1c865f7a64afe566", "c8315ba30c79989b02b2e3acff211d54" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_171db593f1f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "171db593f1f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-18-10-51-5-27-43-65281-17513-35-23-0-13-16,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791135593, "last_seen": 1791135593, "transport": "t", "ja3_hash": "47f0754ef3aaa322be1e72f6f1c215e2", "ja3_variant_count": 1, "ja3_variants": [ "47f0754ef3aaa322be1e72f6f1c215e2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_3ea848142ccb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "3ea848142ccb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-0-65281-10-11-35-23-43-27-5-13-18-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789361007, "last_seen": 1791234383, "transport": "t", "ja3_hash": "aff30c7c91484365eadcc91f9e2ac911", "ja3_variant_count": 2, "ja3_variants": [ "aff30c7c91484365eadcc91f9e2ac911", "5165922019718c0cf8fa84f78acd85f0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_539a4f23109b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "539a4f23109b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-18-65281-10-17613-5-23-43-0-51764-45-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790735092, "last_seen": 1790735092, "transport": "t", "ja3_hash": "205ee146aab721cc513dd79ad1169486", "ja3_variant_count": 1, "ja3_variants": [ "205ee146aab721cc513dd79ad1169486" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_8802cfb92a1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "8802cfb92a1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-13-23-17613-43-11-18-5-10-65281-35-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788998453, "last_seen": 1791245091, "transport": "t", "ja3_hash": "9e826a43ce1a8e210d593cf2b505b9de", "ja3_variant_count": 11, "ja3_variants": [ "9e826a43ce1a8e210d593cf2b505b9de", "1dd1b3441a580708e83319c811b0e8ab", "732604fb5819a7d7be033aeb642475c5", "9e522eb40aa5b44a7be47326919ad15c", "9a1117ee18cf0ab8b5c8d7375b8a2d65", "59ae169ab6051cef733310ebbd239796", "85e3bde0a2b011e00a1f2488331ed6e4", "5d4360a4357abcf36889e028f6cec8c9", "940f99f268c1067d744dee10ca37d1dc", "8ee4e0edc4e2a366aa4947bc757a48ae", "f373af9dbd6e756d405e483d08327268" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_8b387726ad91", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "8b387726ad91", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-11-23-13-35-65037-45-10-5-0-17613-43-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789603656, "last_seen": 1791264135, "transport": "t", "ja3_hash": "634a5acb2d35f05b0628c5a0fcfefb1d", "ja3_variant_count": 2, "ja3_variants": [ "634a5acb2d35f05b0628c5a0fcfefb1d", "cf5e440f20a88cc193516a75ed26e64e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 11 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_923f26044972", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "923f26044972", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17513-45-51-13-23-10-35-11-18-27-0-43-65281-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1790942040, "last_seen": 1791283810, "transport": "t", "ja3_hash": "3188a228a8408d59cd493b9be35f1129", "ja3_variant_count": 6, "ja3_variants": [ "3188a228a8408d59cd493b9be35f1129", "94c9bfd32ec5569a4769deb43edc2213", "1cf7d3eb4d909af09896537614957457", "07fac942376cc95917114cd30fa4a11a", "8f2e6297cbd4a9c84a383101b1a94e74", "5b04e9974606dadf55369aab630c36a6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_9743f096c268", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "9743f096c268", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-23-27-5-11-18-17613-45-13-43-51764-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789649705, "last_seen": 1789649705, "transport": "t", "ja3_hash": "41e10ca857eb930563957b61c05fc6c9", "ja3_variant_count": 1, "ja3_variants": [ "41e10ca857eb930563957b61c05fc6c9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_a9b214fcfaef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "a9b214fcfaef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-13-10-18-17613-43-65037-35-27-51764-5-0-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789652049, "last_seen": 1789652049, "transport": "t", "ja3_hash": "3a2d0e73d46efb58af90e470d719cd22", "ja3_variant_count": 1, "ja3_variants": [ "3a2d0e73d46efb58af90e470d719cd22" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_c9b03e83d227", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "c9b03e83d227", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-45-17613-51764-10-43-65037-18-35-65281-13-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788948600, "last_seen": 1788948600, "transport": "t", "ja3_hash": "7b15e1e63c90b9d8468e8c8ad1da1c7d", "ja3_variant_count": 1, "ja3_variants": [ "7b15e1e63c90b9d8468e8c8ad1da1c7d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_f856b9a3e94f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "f856b9a3e94f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-17613-0-27-45-23-10-65281-35-43-13-18-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788481094, "last_seen": 1789750609, "transport": "t", "ja3_hash": "1a9c7d5a98d1267a5b4ad1ff54e6d953", "ja3_variant_count": 3, "ja3_variants": [ "1a9c7d5a98d1267a5b4ad1ff54e6d953", "222657af2177f044416502328b5fd988", "0c08b31b39b4fdb36be24c0104779059" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d1515h1_8daaf6152771_5563d4852cd1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h1", "b": "8daaf6152771", "c": "5563d4852cd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-23-45-43-16-65281-11-0-18-5-51-13-35-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 284, "first_seen": 1790522618, "last_seen": 1791288440, "transport": "t", "ja3_hash": "c34015e413caf00bfec5060ab8835c2a", "ja3_variant_count": 284, "ja3_variants": [ "c34015e413caf00bfec5060ab8835c2a", "09525bc04e42706ba3c1789411e5c12f", "809ae155eb00b7d9ee220cfe8c91f080", "177a778ca14ebb68a6dbe933e5b0f1c6", "504f357e0f704e514a0e589e13c7047d", "0c244c5192213c0b9b558d4eef32da29", "a0fcd40cd76d9e0309db8d2c990a4d83", "88e5e1aff89ce606108e56f14920dd48", "a5af967a723e8ef0a3e164784a300514", "43bf45e6e1e01f841269a9d1f137296a", "12bdb87a49483bd2570fbd0916035c79", "d77a35ef44a02f8109a6caf37c31d353" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 115, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36": 124 }, "ua_disagreement": false } }, { "hash": "t13d1515h1_8daaf6152771_f1525dfe0d74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h1", "b": "8daaf6152771", "c": "f1525dfe0d74", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-18-35-0-43-10-65281-11-23-13-5-45-65037-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 625, "first_seen": 1790465558, "last_seen": 1791354721, "transport": "t", "ja3_hash": "82748941920d816990ef8f0d20a9574c", "ja3_variant_count": 625, "ja3_variants": [ "82748941920d816990ef8f0d20a9574c", "8c75b472753181e5bcd56b1e3d5a6ad2", "d9c2a1894fdbff812e03fb8d6ba77d6c", "6054c022b5a4c3655eb26cbedfcd9d4b", "db4d7634cedba9c03cdf38ec15d02f70", "fa5563f1dc793f68042801e444b01afe", "020b39e22e7e56b073d0c106ba6e9b08", "34a3a8147172d7fbc4750ce120cc70cd", "22ed155aa6e145e1d64fb45196b32af6", "b2762cc6f63b3db56914961e7c8cb121", "7527e953100948fae3f7b8c66c28c0f2", "86921756d89b41bd17e3ed9a9f301a0e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 64, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 71, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 99, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 89, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 61, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 60, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 94 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_02f1fabc2700", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "02f1fabc2700", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-45-0-43-10-17613-35-5-16-65281-18-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788761039, "last_seen": 1791254100, "transport": "t", "ja3_hash": "f6f43dabbdc18cba982d86e2a8f24378", "ja3_variant_count": 11, "ja3_variants": [ "f6f43dabbdc18cba982d86e2a8f24378", "f64c3a0d7be338cfecb35855192c671c", "4cd24c70b0dbc4eaf8a7a640e4804d86", "a983a9f34c0f3547ddac114a948c2aa1", "6e1176cdbd7a2883ed82aa8bd9d6dee8", "925d5699b6bbe66429eddf1f5f261a35", "54fd2b4bcd5444bbbd23e6938dc99b1c", "762a1799eb50daacb17f8959340d9848", "68f3fc0b5b2be9a428f0282e16498525", "cb3883899a94464253778a8464afd458", "9447c4456e95eaa02413972f71537afb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0 Safari/537.36 Edg/130.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_038797f4dd52", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "038797f4dd52", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-17513-10-0-11-16-5-51-35-23-43-45-27-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791151326, "last_seen": 1791151326, "transport": "t", "ja3_hash": "69d98e2260d26ed4a0fe20cc288d30b6", "ja3_variant_count": 1, "ja3_variants": [ "69d98e2260d26ed4a0fe20cc288d30b6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_0614fb339857", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "0614fb339857", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-18-23-5-17613-16-27-0-45-65037-11-13-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790820597, "last_seen": 1791229710, "transport": "t", "ja3_hash": "9dbafd6d436c6c921f654518a66cd0a4", "ja3_variant_count": 2, "ja3_variants": [ "9dbafd6d436c6c921f654518a66cd0a4", "8d1c6afa57987189fe5dd0a4f836aa0b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_10e451ee1749", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "10e451ee1749", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-35-43-5-65037-11-65281-10-23-45-27-0-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788776207, "last_seen": 1791248959, "transport": "t", "ja3_hash": "a0bcafcabfa1b5b613475a22362d0849", "ja3_variant_count": 14, "ja3_variants": [ "a0bcafcabfa1b5b613475a22362d0849", "ac92505edb032f17fcab2014d640b8c4", "4738f58e347d9a97b2d11d5f8132e0dd", "d73282ad55a7ef2c4711e641a1533e97", "8ffec1d4d0a3cd2d9dd4d933562dafac", "bd5b0693558aff80d24d043836b99b07", "3252b332e2af9bb389c4bf7256a672b7", "f15495fac543b75526bff8e1277880fb", "1ebbf30405dff96e2fe6cc2e95385e4b", "093056530a473d555c1c780dcc0578b5", "07d0074decb76e9b35911334fb367688", "b4f3c9ecf9d9e35eddc08e4699650510" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 15, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 13, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": true } }, { "hash": "t13d1515h2_8daaf6152771_171db593f1f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "171db593f1f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-10-27-65037-17513-13-5-16-45-35-0-23-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789929666, "last_seen": 1791272809, "transport": "t", "ja3_hash": "44581aa20c5e8ee9367238148069d2ef", "ja3_variant_count": 4, "ja3_variants": [ "44581aa20c5e8ee9367238148069d2ef", "785198a865bf9af67ee93cdfb69355d3", "b2395eb8334e6cd59cb88e420847e218", "c8343e08f214186e4812a4747a3f9094" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_1e2be553066d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "1e2be553066d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-11-51764-5-43-13-65037-0-35-45-65281-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724233, "last_seen": 1788724233, "transport": "t", "ja3_hash": "bceccfcbf5f8d68dab0376df069df91a", "ja3_variant_count": 1, "ja3_variants": [ "bceccfcbf5f8d68dab0376df069df91a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_1f46b1bd86c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "1f46b1bd86c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-23-27-5-0-35-10-45-43-17613-65037-18-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790029173, "last_seen": 1790029173, "transport": "t", "ja3_hash": "4c64ef45865081bd447201eb460b97b0", "ja3_variant_count": 1, "ja3_variants": [ "4c64ef45865081bd447201eb460b97b0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_20ba22b4d1c7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "20ba22b4d1c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-0-18-45-10-65281-17613-35-11-43-4832-16-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386540, "last_seen": 1789386540, "transport": "t", "ja3_hash": "b8bd1f0f2eb233e3ea79ece3a878d8fb", "ja3_variant_count": 1, "ja3_variants": [ "b8bd1f0f2eb233e3ea79ece3a878d8fb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 73 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_21c46195413c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "21c46195413c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-27-35-43-16-5-51764-18-45-10-11-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723945, "last_seen": 1788723945, "transport": "t", "ja3_hash": "b19b5d9251535ff69b791fddc3c15788", "ja3_variant_count": 1, "ja3_variants": [ "b19b5d9251535ff69b791fddc3c15788" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_22abae82ea78", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "22abae82ea78", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-45-5-11-35-23-18-51764-0-65281-10-17613-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790548081, "last_seen": 1790548081, "transport": "t", "ja3_hash": "559864c9bbf0107a2c622b67831c2340", "ja3_variant_count": 1, "ja3_variants": [ "559864c9bbf0107a2c622b67831c2340" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_26ef7d1cfc0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "26ef7d1cfc0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-0-43-5-13-11-45-18-65037-10-16-23-17513-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1791103546, "last_seen": 1791269597, "transport": "t", "ja3_hash": "ee08d7c6fe77f8849ba14fe89f0a96be", "ja3_variant_count": 4, "ja3_variants": [ "ee08d7c6fe77f8849ba14fe89f0a96be", "9b46e1d2391275bd01c4803841fad360", "fbbcbc4f659978cd18f3afa3fbdc04e0", "d51289171ccff75c7be903dedf4519a4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 41 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_2b60c0550859", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "2b60c0550859", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-11-65281-17613-43-51764-65037-23-13-18-5-0-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811262, "last_seen": 1788811262, "transport": "t", "ja3_hash": "ff4bab102a20e3bff9f80e6c0b553be8", "ja3_variant_count": 1, "ja3_variants": [ "ff4bab102a20e3bff9f80e6c0b553be8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_2f4667ad99a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "2f4667ad99a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-0-11-17613-27-35-18-65281-16-45-10-51764-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789918125, "last_seen": 1789918125, "transport": "t", "ja3_hash": "5095e7749413258891efc2b3970377c0", "ja3_variant_count": 1, "ja3_variants": [ "5095e7749413258891efc2b3970377c0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_3292241287c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "3292241287c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-51764-17613-10-27-45-5-0-18-23-16-43-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791154660, "last_seen": 1791154660, "transport": "t", "ja3_hash": "d0022616f2c827e5296a3a5a88fe3035", "ja3_variant_count": 1, "ja3_variants": [ "d0022616f2c827e5296a3a5a88fe3035" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_32db7dcf895c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "32db7dcf895c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1788768241, "last_seen": 1790441046, "transport": "t", "ja3_hash": "a0d884cd3d06dc822dc54c133404637f", "ja3_variant_count": 1, "ja3_variants": [ "a0d884cd3d06dc822dc54c133404637f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 2, "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 24 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_32f48254f361", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "32f48254f361", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-65037-18-45-13-11-16-5-51-35-43-27-17513,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789124468, "last_seen": 1791118857, "transport": "t", "ja3_hash": "906a1ab3e9242d98794b12ddc7c75174", "ja3_variant_count": 4, "ja3_variants": [ "906a1ab3e9242d98794b12ddc7c75174", "aad1eeccec23185a4baedc4dffb06c29", "4fbc96a26a04f54186b6093da96813b4", "5ad65bc1576b570ddeabe535f62eb359" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_38903ea11ca7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "38903ea11ca7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-11-23-18-17613-35-45-65281-43-16-51764-65037-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790077059, "last_seen": 1790077059, "transport": "t", "ja3_hash": "be801d9bc1c371776b8e9e5a3aa04f82", "ja3_variant_count": 1, "ja3_variants": [ "be801d9bc1c371776b8e9e5a3aa04f82" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_39f5dd78de51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "39f5dd78de51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-0-5-65281-17613-23-18-11-45-65037-35-43-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788570640, "last_seen": 1790074354, "transport": "t", "ja3_hash": "b5ec2c0e3b208f44f986c37e6ac4b341", "ja3_variant_count": 2, "ja3_variants": [ "b5ec2c0e3b208f44f986c37e6ac4b341", "19058c0fcf6cc280b5268bce45b23c02" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 21 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_3a80aaee01b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "3a80aaee01b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-11-65037-65281-23-18-16-51764-10-45-27-0-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789658367, "last_seen": 1789658367, "transport": "t", "ja3_hash": "138d5b60d9408114c425f4981e63a9b6", "ja3_variant_count": 1, "ja3_variants": [ "138d5b60d9408114c425f4981e63a9b6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_3e7b93394cf9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "3e7b93394cf9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-18-35-43-11-51-5-65281-17513-10-27-16-0-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791102831, "last_seen": 1791151097, "transport": "t", "ja3_hash": "53b522133584722fd92d0a9ef54209bc", "ja3_variant_count": 2, "ja3_variants": [ "53b522133584722fd92d0a9ef54209bc", "343e351a2ebe9d30a01c751236ba7aab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_40375c35c247", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "40375c35c247", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-10-65281-43-11-13-5-45-16-27-23-65037-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750606, "last_seen": 1789750606, "transport": "t", "ja3_hash": "921f28261a34f47343d78b5f66795579", "ja3_variant_count": 1, "ja3_variants": [ "921f28261a34f47343d78b5f66795579" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_41b2e7d342e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "41b2e7d342e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-18-16-11-65281-13-5-43-45-0-23-51764-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790941890, "last_seen": 1790941890, "transport": "t", "ja3_hash": "d7240d3a1583ac9399308c5f8990ca35", "ja3_variant_count": 1, "ja3_variants": [ "d7240d3a1583ac9399308c5f8990ca35" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_43b9d5534890", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "43b9d5534890", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-43-10-5-45-35-23-18-16-13-17613-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1788653517, "last_seen": 1791285734, "transport": "t", "ja3_hash": "4aa830b6fab3a3f23142f956b5f74a71", "ja3_variant_count": 9, "ja3_variants": [ "4aa830b6fab3a3f23142f956b5f74a71", "08935afd4d127ef92f06a0e9d660775e", "7e270a86e4b87a1d49cc759699887939", "5b8423c5520274c867833742a0a22da3", "8c2f35005afc0c988ed034b55436f446", "d503355df53acfbb0e74bf1360932029", "223665217cf5d1e54c6a16e20eb0fa3a", "079adcec5a6eb713b721e2f91026d140", "2d40417b21ef81db2c7bf8ea85c06296" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_4c909bc2ba1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "4c909bc2ba1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,65281-11-10-35-5-22-18-23-13-43-45-51-0-16-65037,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790254101, "last_seen": 1790254101, "transport": "t", "ja3_hash": "c196622174f1993400b6a0d020887241", "ja3_variant_count": 1, "ja3_variants": [ "c196622174f1993400b6a0d020887241" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_51534a0af191", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "51534a0af191", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-11-43-23-16-65281-5-27-13-18-17513-10-51-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790943400, "last_seen": 1791118725, "transport": "t", "ja3_hash": "f3a7d8871fe5ed7ec5cef2faa2308fcd", "ja3_variant_count": 3, "ja3_variants": [ "f3a7d8871fe5ed7ec5cef2faa2308fcd", "ce99107e4bfda8bba3bb98f2d64705a8", "8a77b7167fc7d6bb2ebd511f1cd5ce2b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_52173c677ea8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "52173c677ea8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-23-65037-11-65281-16-51-0-18-5-43-45-27-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791261445, "last_seen": 1791261445, "transport": "t", "ja3_hash": "04d96ce8ee831e78a037a9c1757c1466", "ja3_variant_count": 1, "ja3_variants": [ "04d96ce8ee831e78a037a9c1757c1466" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_534d800ff8ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "534d800ff8ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-17613-65281-13-35-0-10-11-23-65037-43-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789051053, "last_seen": 1789051053, "transport": "t", "ja3_hash": "c43308510307e290839d45d516bd7b35", "ja3_variant_count": 1, "ja3_variants": [ "c43308510307e290839d45d516bd7b35" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_53e84133a6ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "53e84133a6ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-5-18-17613-27-16-51764-35-65037-0-10-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791112536, "last_seen": 1791112536, "transport": "t", "ja3_hash": "971dcd9da3e20447af024bbd5f873949", "ja3_variant_count": 1, "ja3_variants": [ "971dcd9da3e20447af024bbd5f873949" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_58797015d43b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "58797015d43b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-45-11-17613-27-13-23-65037-35-10-16-65281-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788772001, "last_seen": 1791241345, "transport": "t", "ja3_hash": "8afd2e09001a234f00b3ecd0e6c08879", "ja3_variant_count": 16, "ja3_variants": [ "8afd2e09001a234f00b3ecd0e6c08879", "5bfffbc2aa3a8e6586990fa624e79533", "fcb95ee5a968d2a4b9406ffb8945a9c7", "ca1a1d44ab74ece043b5956d3740f6df", "1e2ff800bb90ffd7e8e3807e543edbe3", "e787cfa101379d9a5a549be677c45e4c", "c1ce0a4b67bb7b2d7add21d47527f704", "d90a1261f5c3c5bfad4f2841d72dd0ac", "cfed93633d7f45dd7aaeb98abd27cf3f", "d2bf1a69c4cd6d486d2fc025b07c5845", "d01cb944ccafe9b609d43ebd02127eb5", "9a220bfa073c66f631ad541fb6b4b120" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": true } }, { "hash": "t13d1515h2_8daaf6152771_5ad411fbfabb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "5ad411fbfabb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 419, "first_seen": 1787668795, "last_seen": 1791005614, "transport": "t", "ja3_hash": "fa563217f31b34f217647ea3f3c35fc3", "ja3_variant_count": 3, "ja3_variants": [ "fa563217f31b34f217647ea3f3c35fc3", "de0ccdd4315ca1a05383e7f1dc3498f4", "b1814247ef25522b302946c6ace66e01" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 2138, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 4, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 10, "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0": 92, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 97, "Mozilla/5.0 (Android 13; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_5c6abbd646b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "5c6abbd646b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-27-18-17613-45-10-16-0-13-23-5-35-51-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790647668, "last_seen": 1790647669, "transport": "t", "ja3_hash": "f06c4018204d3228d6985ae79c74dbe4", "ja3_variant_count": 2, "ja3_variants": [ "f06c4018204d3228d6985ae79c74dbe4", "46327632139954ffc231794260c09bfc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/154.0.0.0 Mobile Safari/537.36": 8, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 132 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_6c7aa49898fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "6c7aa49898fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-65281-18-17613-13-35-0-11-23-27-43-5-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790456817, "last_seen": 1790456817, "transport": "t", "ja3_hash": "e4e29d612b60d1a0f5a2518b6b0e3784", "ja3_variant_count": 1, "ja3_variants": [ "e4e29d612b60d1a0f5a2518b6b0e3784" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_704a515ad61d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "704a515ad61d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-5-51764-27-45-65037-43-10-18-35-11-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789584040, "last_seen": 1789584040, "transport": "t", "ja3_hash": "3ed7338dbee0953859950984bb922383", "ja3_variant_count": 1, "ja3_variants": [ "3ed7338dbee0953859950984bb922383" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_70d536bff17c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "70d536bff17c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-0-35-10-18-27-43-65037-45-13-11-16-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790758776, "last_seen": 1790758776, "transport": "t", "ja3_hash": "4b21c4381c17faf510bd5aad8a4008d1", "ja3_variant_count": 1, "ja3_variants": [ "4b21c4381c17faf510bd5aad8a4008d1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 6 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_772d8e8a7b71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "772d8e8a7b71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-45-35-0-17613-5-11-43-23-65037-18-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788670687, "last_seen": 1788670687, "transport": "t", "ja3_hash": "8c285ab1a93808acab8874aed30c8196", "ja3_variant_count": 1, "ja3_variants": [ "8c285ab1a93808acab8874aed30c8196" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_7f70b7c03564", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "7f70b7c03564", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-27-18-65037-65281-0-5-16-23-17513-43-10-45-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791108371, "last_seen": 1791281697, "transport": "t", "ja3_hash": "c70d03dd138451e1627c3148ed3a2595", "ja3_variant_count": 2, "ja3_variants": [ "c70d03dd138451e1627c3148ed3a2595", "38dbadd7bdd7d64de0226c2ac94a1ddf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_7fad7699c860", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "7fad7699c860", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-10-35-43-17613-65037-18-27-0-23-45-5-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 16, "first_seen": 1788777274, "last_seen": 1791254653, "transport": "t", "ja3_hash": "59e3d158762344a59b1924fd9737cd46", "ja3_variant_count": 16, "ja3_variants": [ "59e3d158762344a59b1924fd9737cd46", "ad243265fa984cefcb216fb6d22abb54", "dff7c6b54fdecb9afcafb6c63d6c3704", "18fbc5db9a20ea5b64b108c1e4d0b943", "7b10b565a4338c590de7bb7548537eb8", "66499b0bf6340b148aebab8d3623b986", "c2a5cbccdc7d5110e42d810504e2c32b", "1e4b79be50790233cfe77588453e31fc", "bb82ac7041e5de1da6d28bffc587fde9", "1ebd16ec4b39396011e3c424962fb48b", "a195a673b3e5864775715161700ae45a", "1c40425f84dd7080f1731bfd970daa88" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 1, "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.6.2 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_8112c01908d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "8112c01908d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-27-65281-65037-13-45-43-23-17613-10-0-51764-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789669087, "last_seen": 1789669087, "transport": "t", "ja3_hash": "e249cda419a8b9fcd01618dbfee77234", "ja3_variant_count": 1, "ja3_variants": [ "e249cda419a8b9fcd01618dbfee77234" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_8371a4953894", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "8371a4953894", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-27-65281-17613-10-0-43-11-13-18-35-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789471563, "last_seen": 1789471563, "transport": "t", "ja3_hash": "fdb187aa180919d8d9e33135541ddde4", "ja3_variant_count": 1, "ja3_variants": [ "fdb187aa180919d8d9e33135541ddde4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_83b48b7f7715", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "83b48b7f7715", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-45-65037-0-35-11-5-10-27-23-17513-51-43-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791280367, "last_seen": 1791280367, "transport": "t", "ja3_hash": "43a5af96ec64212a203fa6334c89000d", "ja3_variant_count": 1, "ja3_variants": [ "43a5af96ec64212a203fa6334c89000d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_84a745f3a544", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "84a745f3a544", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-45-17613-16-27-10-0-11-18-65281-51764-43-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789711528, "last_seen": 1791032431, "transport": "t", "ja3_hash": "fc9384b9215041e7122c0e0b392340bb", "ja3_variant_count": 2, "ja3_variants": [ "fc9384b9215041e7122c0e0b392340bb", "378515243f20c687b1739c3901b3e220" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_8bc8bf5dedff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "8bc8bf5dedff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-18-17513-0-5-23-10-65281-45-35-11-13-16-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790948942, "last_seen": 1791132488, "transport": "t", "ja3_hash": "141b79decbfc3b91a5410fe5e9fd0317", "ja3_variant_count": 3, "ja3_variants": [ "141b79decbfc3b91a5410fe5e9fd0317", "7ac04fc950edcdf7b33b84e5d5781624", "7f2bf5ec3c001c3c9fad2d65efb5caa5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_8ca0f9894149", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "8ca0f9894149", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-0-16-35-11-27-51-5-43-10-23-45-18-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790647669, "last_seen": 1790647669, "transport": "t", "ja3_hash": "ecd3e2bf8b8023b4a4a1558309668278", "ja3_variant_count": 1, "ja3_variants": [ "ecd3e2bf8b8023b4a4a1558309668278" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_926958cebc68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "926958cebc68", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-17613-0-51764-16-27-43-23-45-65037-10-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791017322, "last_seen": 1791017322, "transport": "t", "ja3_hash": "a7d65a6ec469c1e5e65d0887c2c544d5", "ja3_variant_count": 1, "ja3_variants": [ "a7d65a6ec469c1e5e65d0887c2c544d5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_9c4f4d4610bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "9c4f4d4610bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-65037-35-10-13-43-5-18-23-17613-0-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788765343, "last_seen": 1790778034, "transport": "t", "ja3_hash": "a7926636d0f1a01b095efbcdbc4c18aa", "ja3_variant_count": 10, "ja3_variants": [ "a7926636d0f1a01b095efbcdbc4c18aa", "5f9e66123c61a5e5377c7e5e4e6c1ee9", "7a09318b563cac11c2b006d3717eb1c7", "6503d1df0cbdebc49065d9977b496c0d", "a5fae39c2b553337d4b2f1620aeec0ec", "b8495e35b5b2f5e54281f786f979cc09", "c69f8f254000a5821a91ef44e6758130", "702f26e04ec050bdbdbdd6bab5210a83", "3bbb5a736d3b361ee64c760ed46f3f85", "d36f7080ce0bb0a2c1918a24c831eb99" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a2bca2d53066", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a2bca2d53066", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-10-23-13-11-35-17613-0-18-45-65037-16-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788761394, "last_seen": 1791299699, "transport": "t", "ja3_hash": "bd5b755acda1c08f09bcf6f0480ee15f", "ja3_variant_count": 8, "ja3_variants": [ "bd5b755acda1c08f09bcf6f0480ee15f", "60a7c7642fb3529d2ff94ad30d3f65e6", "faef57264da3eaab275e79c2846cd776", "a1496647502c516ab7d5eaf379a1a5ed", "cfb3a1a515ebb4216b03f29a2f0f155b", "1fdb6fdfff5e2daccf010073e0c097e8", "d4c8ad8f35da2f77b94be08d753458d3", "7c832f6ef50d6deec67c5ca1101d01ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a64930e2b849", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a64930e2b849", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-23-10-5-43-18-13-11-45-17613-27-0-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790106452, "last_seen": 1790651507, "transport": "t", "ja3_hash": "fdab38a6a16238f6c089c58a1b54dc44", "ja3_variant_count": 2, "ja3_variants": [ "fdab38a6a16238f6c089c58a1b54dc44", "4f786649d61dd862584bfafc44c6f29a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a8a156b43da0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a8a156b43da0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-17613-27-45-0-23-11-43-16-5-35-18-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788705284, "last_seen": 1790905266, "transport": "t", "ja3_hash": "d0679a432fd273cde88f5688ebd9d7f5", "ja3_variant_count": 10, "ja3_variants": [ "d0679a432fd273cde88f5688ebd9d7f5", "4093785c279c5a0bc4f7a3415717e7fa", "2689fad3f4918ca38287d12487094ce9", "bcc218907ff58a9cc9db06e779e4867c", "7c94d17b3065528ed437e6c8c68e07b6", "b177edce23fddd20e4a833b031a30845", "2c7264c228a8687231e88a7f386b0f3f", "6b237624b053c110721fa3a98f1498ab", "ac94b6fadde6094d2315c5111aa68326", "29beae79ac702695636940d5be87f731" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 35, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a91912ca989d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a91912ca989d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-18-11-51-17613-10-13-16-5-35-45-65281-43-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790651507, "last_seen": 1790651507, "transport": "t", "ja3_hash": "ade236901b322bc3d25c969cc0b07b97", "ja3_variant_count": 1, "ja3_variants": [ "ade236901b322bc3d25c969cc0b07b97" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_aa9906861c8c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "aa9906861c8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-23-16-17513-35-51-5-43-27-0-18-45-65281-13,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790750474, "last_seen": 1790750474, "transport": "t", "ja3_hash": "0355d20b26b4ea1d286b3000989c0b14", "ja3_variant_count": 1, "ja3_variants": [ "0355d20b26b4ea1d286b3000989c0b14" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_ac0b52a0ce45", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "ac0b52a0ce45", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-13-27-23-35-65037-11-10-43-16-45-0-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791225781, "last_seen": 1791225781, "transport": "t", "ja3_hash": "917558a2dcfbfdc66455e059e39c2e7a", "ja3_variant_count": 1, "ja3_variants": [ "917558a2dcfbfdc66455e059e39c2e7a" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/154.0.8037.55 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_aedf68495527", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "aedf68495527", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-45-28-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788768240, "last_seen": 1788768240, "transport": "t", "ja3_hash": "bc87c51ff553fe2847b65cd13bd7ba23", "ja3_variant_count": 1, "ja3_variants": [ "bc87c51ff553fe2847b65cd13bd7ba23" ], "user_agents": { "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_b088141deb13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "b088141deb13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-18-65281-16-5-27-23-35-11-45-17513-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 300, "first_seen": 1788628525, "last_seen": 1791327016, "transport": "t", "ja3_hash": "6ce79781ca515e612862952961750f17", "ja3_variant_count": 9, "ja3_variants": [ "6ce79781ca515e612862952961750f17", "5302f47017a7311d5131bc7f4e486f39", "b24b2457a5813a215a237dca11f8e56a", "67bb70782ee0ca22f932c319789c96b3", "7185399b4e28c0ff570e97a5a9acedd5", "182df799c043ca31650395010053e6d9", "e2d9108f8b28704da663ec5848e8c230", "eca8ab166c18644955bc8280bf27b9d1", "d4a62770650492ebd2fff4f6bfdf2895" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3843.181 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.2686.154 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.2436.95 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_b7937e5a4377", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "b7937e5a4377", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-11-5-18-43-23-13-65281-17613-27-0-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788603271, "last_seen": 1790596780, "transport": "t", "ja3_hash": "a999b65816a9df2160d3c36dd2bebf46", "ja3_variant_count": 10, "ja3_variants": [ "a999b65816a9df2160d3c36dd2bebf46", "1f0d049bcb0562f548ecef58a9ebf562", "1d2a5ad50ea7d055879f1913715f55bc", "44144805efff200ae483debb0a5cf269", "b85107729a847142591ed76b8997241c", "72ba386b87ddde2efb6c405315eaa58c", "47585d2d903e0462810f7ffdd5d949eb", "bacf2dcc687716b8062357d0d685274e", "375e5dd0bc5c8cfc3b17e0cd882084fb", "aff8b3c8ac67aaad3105778afd2def8c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 21, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 11, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36": 27, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_b81810227705", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "b81810227705", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-51764-65281-5-23-13-17613-11-18-0-65037-35-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789002583, "last_seen": 1789002583, "transport": "t", "ja3_hash": "5fc2e66697fb9d683b941f46a01368b6", "ja3_variant_count": 1, "ja3_variants": [ "5fc2e66697fb9d683b941f46a01368b6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_bb79f62c46b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "bb79f62c46b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-13-17513-23-16-27-18-10-45-43-65037-11-5-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1790941758, "last_seen": 1791283336, "transport": "t", "ja3_hash": "2fe3ad2df923ce8d220f2c8887ee7e85", "ja3_variant_count": 9, "ja3_variants": [ "2fe3ad2df923ce8d220f2c8887ee7e85", "3772562a9bac765f6950f047f81063de", "287dae0a28e5c56a83e17585a7eb5948", "a666eb160c71ce99ec645187506d5c7d", "63a3495947b518a3fa3a260d1c8d6061", "e2b66209f8543ea3e24e5e79dc09e164", "35a1ad611e2238650503be24a82ef93e", "44cdbb863b7018e9193e844a552447f3", "d3f147523e31231bf2bc01060e57a6de" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_c60aa3edd9fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "c60aa3edd9fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-35-45-0-43-5-11-51764-13-65281-16-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788899605, "last_seen": 1788899605, "transport": "t", "ja3_hash": "e025488411e886105e6950a8564d338d", "ja3_variant_count": 1, "ja3_variants": [ "e025488411e886105e6950a8564d338d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_c8a289f108f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "c8a289f108f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-5-43-65281-27-11-10-45-35-16-51764-65037-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791032594, "last_seen": 1791173071, "transport": "t", "ja3_hash": "1310e025f27527dd99e5751cb359d606", "ja3_variant_count": 2, "ja3_variants": [ "1310e025f27527dd99e5751cb359d606", "6956394a6d1533199ed1cd4bc4c907e8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_cb35a023dc6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "cb35a023dc6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-18-16-27-11-5-65037-35-23-17613-43-10-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788891782, "last_seen": 1788891782, "transport": "t", "ja3_hash": "1c705c5a256ccb2ef786c15346935a64", "ja3_variant_count": 1, "ja3_variants": [ "1c705c5a256ccb2ef786c15346935a64" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_d3255bf01b10", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "d3255bf01b10", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-5-18-35-17513-16-65037-27-10-43-45-51-23-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791259891, "last_seen": 1791259891, "transport": "t", "ja3_hash": "66df6259aea01f6e85f9075b948e99f1", "ja3_variant_count": 1, "ja3_variants": [ "66df6259aea01f6e85f9075b948e99f1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_d9468ea36dce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "d9468ea36dce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-10-17513-18-35-65037-11-16-23-0-43-45-27-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791107222, "last_seen": 1791107222, "transport": "t", "ja3_hash": "1e366c68446e7d4a11f964a41717fd1b", "ja3_variant_count": 1, "ja3_variants": [ "1e366c68446e7d4a11f964a41717fd1b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_d991d86c8acb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "d991d86c8acb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-18-0-16-10-27-45-43-17613-13-5-23-65281-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791169811, "last_seen": 1791169811, "transport": "t", "ja3_hash": "a5c5d02f83e8468cf363f26c75debc59", "ja3_variant_count": 1, "ja3_variants": [ "a5c5d02f83e8468cf363f26c75debc59" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_da45a1e39f65", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "da45a1e39f65", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-11-23-45-16-17613-65281-13-35-51764-10-65037-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791123791, "last_seen": 1791123791, "transport": "t", "ja3_hash": "c37518aab0e225b55a703e25b3cb83b7", "ja3_variant_count": 1, "ja3_variants": [ "c37518aab0e225b55a703e25b3cb83b7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_db4bfe4fefd5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "db4bfe4fefd5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-11-65281-17613-23-16-0-43-27-5-13-65037-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790794693, "last_seen": 1790794693, "transport": "t", "ja3_hash": "8c6304c80854891b7b0a470ff2f948b3", "ja3_variant_count": 1, "ja3_variants": [ "8c6304c80854891b7b0a470ff2f948b3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_e5b8056a35aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "e5b8056a35aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-16-43-65037-35-27-17613-11-45-5-13-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790856389, "last_seen": 1790856389, "transport": "t", "ja3_hash": "cdaad958fb5e6b93fffa4bd8098f197f", "ja3_variant_count": 1, "ja3_variants": [ "cdaad958fb5e6b93fffa4bd8098f197f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_ecfb0be84e87", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "ecfb0be84e87", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-65281-11-13-17613-23-65037-27-43-16-45-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789671490, "last_seen": 1789671490, "transport": "t", "ja3_hash": "14ccf1f8dad03513e2d0c39b57f2728d", "ja3_variant_count": 1, "ja3_variants": [ "14ccf1f8dad03513e2d0c39b57f2728d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_ef31dfb68ce0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "ef31dfb68ce0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-27-43-51-5-65037-0-18-16-11-23-45-65281-35-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791109562, "last_seen": 1791109562, "transport": "t", "ja3_hash": "49d591f26e84169160d2ca236099ae4b", "ja3_variant_count": 1, "ja3_variants": [ "49d591f26e84169160d2ca236099ae4b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_ef8c11bf4bb0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "ef8c11bf4bb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-16-65281-17613-35-10-65037-27-13-23-0-18-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789197828, "last_seen": 1789197828, "transport": "t", "ja3_hash": "01f74587b6ddd1b69e85223444a7e266", "ja3_variant_count": 1, "ja3_variants": [ "01f74587b6ddd1b69e85223444a7e266" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 11 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f1525dfe0d74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f1525dfe0d74", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-18-10-65037-5-27-35-13-16-0-11-43-65281-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788704055, "last_seen": 1791055318, "transport": "t", "ja3_hash": "4b0119c67fe48cbb05de85ac174068a5", "ja3_variant_count": 15, "ja3_variants": [ "4b0119c67fe48cbb05de85ac174068a5", "d5b52c30c9cd8b64b52a5de78dcdf11d", "bedf08aa8c934a6fce37ac0e70d80318", "069df91b1cac2b7b8e0b754e920dbe5a", "052c126645a4e98fb513803f59367c2a", "f87ffe04949b93fb39cd8155d67898f7", "0900f26221e51c659f36beffc04b0dbd", "b1448a26f4b111c5447351c6a78a6053", "5642ee22c8d5856a37f5d39e5f7cef44", "b1f7b303f29d8638e0d8ae9832a2ea11", "9eaa45a7b1d28166397037c5c8906372", "1843ed63b9f0e663baeafeb591756481" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1515h2_8daaf6152771_f202aa6f8efc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f202aa6f8efc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-16-10-18-35-13-0-27-45-65281-65037-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790637389, "last_seen": 1790637389, "transport": "t", "ja3_hash": "e6877556c0422679f55b81a05e60ff31", "ja3_variant_count": 1, "ja3_variants": [ "e6877556c0422679f55b81a05e60ff31" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 28 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f386164fe7ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f386164fe7ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-23-13-17613-35-10-11-65281-16-43-45-51-5-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791236480, "last_seen": 1791236480, "transport": "t", "ja3_hash": "135814de8c9fa0ea1b3b3417c987e465", "ja3_variant_count": 1, "ja3_variants": [ "135814de8c9fa0ea1b3b3417c987e465" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 15, "Mozilla/5.0 (Linux; Android 17; SM-F971U Build/CP2A.260605.016; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/153.0.8010.36 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f39212c3b29f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f39212c3b29f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-0-16-13-11-17613-5-65281-45-18-27-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789116593, "last_seen": 1789116593, "transport": "t", "ja3_hash": "b2c46b7afc44754326eca25b43ef5aff", "ja3_variant_count": 1, "ja3_variants": [ "b2c46b7afc44754326eca25b43ef5aff" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 34 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f4a97128a4a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f4a97128a4a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-16-45-13-10-23-18-65037-27-0-43-17613-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788762047, "last_seen": 1791259542, "transport": "t", "ja3_hash": "a6d8f00a4ac2a85a0003c7e268fbb97a", "ja3_variant_count": 16, "ja3_variants": [ "a6d8f00a4ac2a85a0003c7e268fbb97a", "d36886319ef7bb71cc7124855e2dc143", "148f6910d3aeba22e16cf58631a4fb17", "cb17dcf8c5089164482ba7d308f4f748", "7fb8bd8a0575c418032a71a26c12810f", "c75e510976b960664d6ea281d002fda4", "64a7dae6ba8b63b9f3bf5acda096a32f", "e67c1124924d4e5d0c7d702092d3e17e", "811e8c6249738ae8aac420dc34f4476f", "999ea11b5e6107864afe3b227b20fb4a", "f8f5a2343d7e771f2524d3068b1b6bf5", "cfc705f2e4707d40c8dbbfa1579cfee2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5, "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)": 3, "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anthropic.com)": 2, "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1515h2_8daaf6152771_f54af37c9939", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f54af37c9939", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-65281-43-16-11-27-0-17613-65037-23-13-5-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789516990, "last_seen": 1789516990, "transport": "t", "ja3_hash": "6314badadbfb7acda50cf172b1b7176c", "ja3_variant_count": 1, "ja3_variants": [ "6314badadbfb7acda50cf172b1b7176c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 34 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f5ea9f08be72", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f5ea9f08be72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-49172-49171-157-156-53-47,0-5-10-11-16-17-23-35-13-43-45-50-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2433, "first_seen": 1788075559, "last_seen": 1791363250, "transport": "t", "ja3_hash": "b765f4534bce3740f769b0254478e9bd", "ja3_variant_count": 1, "ja3_variants": [ "b765f4534bce3740f769b0254478e9bd" ], "user_agents": { "LinkupBot/1.0 (LinkupBot for web indexing; https://linkup.so/bot; bot@linkup.so)": 13757, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.116 Safari/537.36": 34, "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.17 (KHTML, like Gecko) Chrome/11.0.654.0 Safari/534.17": 1 }, "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f92dce234eb4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f92dce234eb4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-18-13-45-35-27-16-65037-5-10-43-17613-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 17, "first_seen": 1788784471, "last_seen": 1791294250, "transport": "t", "ja3_hash": "06a53ca0f87d360fc328ff243dcd646d", "ja3_variant_count": 17, "ja3_variants": [ "06a53ca0f87d360fc328ff243dcd646d", "41fdc6bef096f5d7f83cb72464624c8e", "d08ae359551651570c5b9690f9d28f93", "3c3416ec0042c43a5af3b80b7f124f83", "fa948bbb112012383efa712040e1e5e9", "889229c909d6f8018ee50b60b0f4dc45", "53a1b3b77e9fcdc2a4521cb03ed6e2d3", "20f5b177356403dd1e69b3cf75fd6fdd", "c0cc39e9862cdac6a5ca450ad2ea6a97", "43f236b0585f9aad00fa4833070a0bdc", "a7c684c207e69ed6cb5b5b1fb433c3c0", "2000999433e325eaeebb49e3f4fd537a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": true } }, { "hash": "t13d1515ht_8daaf6152771_5563d4852cd1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515ht", "b": "8daaf6152771", "c": "5563d4852cd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1898, "first_seen": 1787715184, "last_seen": 1791330713, "transport": "t", "ja3_hash": "b32309a26951912be7dba376398abc3b", "ja3_variant_count": 1, "ja3_variants": [ "b32309a26951912be7dba376398abc3b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36": 336, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36": 321, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36": 335 }, "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_4e38b1ce0f88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "4e38b1ce0f88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-65037-17613-11-0-35-27-13-10-18-45-43-51764-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790596083, "last_seen": 1791208420, "transport": "t", "ja3_hash": "4a66dc89abb5f2db73523930c88cbb8f", "ja3_variant_count": 2, "ja3_variants": [ "4a66dc89abb5f2db73523930c88cbb8f", "40f2b26837cc66f511f44bf7a16d0995" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_e1bd3cb71b7f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "e1bd3cb71b7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65037-13-43-4832-23-27-18-10-45-17613-11-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788722666, "last_seen": 1788722666, "transport": "t", "ja3_hash": "4a70b4ef544ab282227489ca4e0fafcc", "ja3_variant_count": 1, "ja3_variants": [ "4a70b4ef544ab282227489ca4e0fafcc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h1_8daaf6152771_038aa86713e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h1", "b": "8daaf6152771", "c": "038aa86713e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-23-65037-10-0-43-27-51764-18-35-11-16-65281-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1791330103, "last_seen": 1791331011, "transport": "t", "ja3_hash": "48a37905be20b45ff3455d562629eb01", "ja3_variant_count": 15, "ja3_variants": [ "48a37905be20b45ff3455d562629eb01", "0eb07294425ab9335b4507693425f433", "f60262e76f7b2f6d9a6c138aca58ba8a", "ad13343afd3ee6ab2e7da50a04a99d0d", "089347c45af8d0720fff2626233dfa6c", "2e8a8f982b87ffbb888d31e971bb848d", "30919058660240481e30b28f7d85d815", "b5ebd05e45380629cf5c40234f668795", "cc18da8a7b8fde58e9b20db6e03e1283", "59a74e49dd0f9db65c8d785c64653202", "44c524905575f329d6ae939e72605478", "a15c3873f64a960c645ee20753d8d0d5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 4 XL; Build/UD2A.230413.239) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 11; CPH2065; Build/RQ2A.200114.34) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 11; 12T; Build/RD2A.200221.192) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; Pixel 8a; Build/QQ1C.201007.248) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 13; 13 Pro; Build/TQ2A.221201.78) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; Pixel 7 Pro; Build/QQ1B.201125.178) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 14; Pixel 9; Build/UQ1A.230702.231) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 12; Pixel 7 Pro; Build/SD2A.211024.130) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 14; SM-G986B; Build/AP2A.241211.128) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; 14 Ultra; Build/QQ1B.200910.48) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 11; Pixel 7 Pro; Build/RQ3A.200808.123) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 13; SM-G975U; Build/TQ2B.220605.81) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h1_8daaf6152771_a26ff6e16f2a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h1", "b": "8daaf6152771", "c": "a26ff6e16f2a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-27-65037-45-5-23-16-65281-51-43-13-35-0-10-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 113, "first_seen": 1790522909, "last_seen": 1791300485, "transport": "t", "ja3_hash": "87e71ffc1aa8dd234f0c16a87d9eb782", "ja3_variant_count": 113, "ja3_variants": [ "87e71ffc1aa8dd234f0c16a87d9eb782", "d0e8ea9b0ef2339fb9789aaaa8569773", "14c7aaeb51d7c68d2722cf42eb51c5df", "bdeb7c1337d7b1b8d78c74aeec26c541", "e55e971001761aca3aaf7d2251da9e66", "2303185b086b0817bbfbb71f5fb3fb93", "8ad33b4607af56db6d05974bd06af7da", "1e1d858a97512138bfead487a6ea93d1", "642e756df8ca7fb0fc2654e623ffecf1", "a807eb022c23b259d691b3ec5b0a37b2", "c1c928d5038d62ce5b58fb0825533e26", "c23047999958f2bb86300a02e1654cb7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 28 }, "ua_disagreement": false } }, { "hash": "t13d1516h1_8daaf6152771_db113fc12e09", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h1", "b": "8daaf6152771", "c": "db113fc12e09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-0-23-35-51-16-43-65281-18-13-27-5-65037-45-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 30, "first_seen": 1790473776, "last_seen": 1791337805, "transport": "t", "ja3_hash": "8c57285bbd52e084145bed3236f6fdc0", "ja3_variant_count": 30, "ja3_variants": [ "8c57285bbd52e084145bed3236f6fdc0", "0406910396bf9954148c0f21d7cc26f6", "06c0cb437658b26c1e1559812e263022", "3f1eb64de0b8e7578d2540485605c34d", "20be196caad3e24921b79493e8ab9285", "3d0ee6c913b567bd60d669d914fa8cdc", "b5b2f6015723c670e767b646b787f5b8", "e55bb7c0248ee6c3582a0c48d7e89755", "57a4451b0f9a92abc41dec951773201d", "963af80aed94e6a3454640299834429e", "09a654a076bc718f00aab96660514e39", "ac0f8271ede013aa4408f355e4e2352c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_02e122b4eadb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "02e122b4eadb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613-65281-10-27-35-5-23-43-13-18-11-65037-16-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 728, "first_seen": 1788441802, "last_seen": 1791359182, "transport": "t", "ja3_hash": "f984bd5bc7358922cde86ed4471a2e89", "ja3_variant_count": 719, "ja3_variants": [ "f984bd5bc7358922cde86ed4471a2e89", "4b100c9b24a0645b553a805d69688700", "fe3bbc45e1dc803ecb1a59cc52ca08c9", "7c13cd9a5fd3f9f9fddb5dc3e273c4d6", "659decaadee3df116167ff96e8e17a17", "4f37d99a32575ace0267175284aac3bb", "a113fb17c2fd106939fde5a05f46dd5e", "bb3c65e858b832e34e55334ebae814c2", "c51d124670072d99d1e068d27473bf75", "fdb319daa54736e4cda4a7a275b1f965", "e0f6fa21a9a233bebb64cbc20508f6b5", "0ed682d581f9587f6d930a2597891d81" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 165, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 546, "\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 172, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 485, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36 OPR/101.0.0.0": 25, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 100, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 267, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 2, "RootEvidence/1.0": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 55, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 OPR/135.0.0.0": 30, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 75, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 82, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.7922.34 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 AVG/151.0.0.0": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 52, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 69, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3002.57 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3297.78 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3713.110 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.7.8 Mobile/15E148 Safari/604.1 Brave": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; ClaudeBot/1.0; +claudebot@anthropic.com)": 9, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Safari/605.1.15": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 10 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_04a67e4592c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "04a67e4592c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-17613-11-27-35-10-13-0-45-51764-65281-23-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1791100460, "last_seen": 1791301526, "transport": "t", "ja3_hash": "64d0d7cf22143c81dfca35898d75ff4c", "ja3_variant_count": 4, "ja3_variants": [ "64d0d7cf22143c81dfca35898d75ff4c", "0c049637c41ebf87f18d86b2f07d2d4d", "9ae0eccc02c8c494065fc9389d07d2ed", "e330e94d59565a8fc1713807920f75e1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_0602f039c590", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "0602f039c590", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-5-43-65281-45-23-51-11-65037-35-13-16-27-10-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 156, "first_seen": 1788442007, "last_seen": 1791361272, "transport": "t", "ja3_hash": "1e48e70fcfe94567375f0e338ff399f0", "ja3_variant_count": 156, "ja3_variants": [ "1e48e70fcfe94567375f0e338ff399f0", "f9d32bd59df100d2ef726c0b780ecc58", "921f69b80b54bc27a1ee4c894852ac56", "836c3ae298c29a7bf0b2c39fc0d4d524", "45fa0985e6f327efc722e114ba1547ea", "28a3161b9db80639e55487ed33069d7d", "80d0a0c78e0522277e65b89f32c6c847", "f371d0ce07ebafef3bd8648d0a1c88b5", "581647f3cd5425e162e7e401041eb17e", "4336c176d85ec7f48e4e5411629a64c3", "3ef542bc308a4124badadbf95b0e5297", "f19b487f845e6043e139c3ed87d031fa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 654, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 31, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 413, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 482, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 85, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 57, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)": 18, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 23, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.64 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_1_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.64 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_0ec096184319", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "0ec096184319", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-11-27-5-16-65281-13-0-18-10-35-65037-17613-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788856457, "last_seen": 1789584036, "transport": "t", "ja3_hash": "967760f3270c989716507114c1c23c4e", "ja3_variant_count": 2, "ja3_variants": [ "967760f3270c989716507114c1c23c4e", "ab01556a08e3450ed4c2ce1acc8ad97f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_15cbe55535f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "15cbe55535f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-45-11-51764-65281-13-18-17613-65037-27-0-35-43-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790802092, "last_seen": 1790802092, "transport": "t", "ja3_hash": "0ed637703cd2371a63a1e6866da4f788", "ja3_variant_count": 1, "ja3_variants": [ "0ed637703cd2371a63a1e6866da4f788" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_32da71d0a2c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "32da71d0a2c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-65281-18-5-10-27-11-35-43-16-23-51-13-0-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 129, "first_seen": 1788455474, "last_seen": 1791341230, "transport": "t", "ja3_hash": "32c7352710a4fbcdcfdc1c627963d0f1", "ja3_variant_count": 129, "ja3_variants": [ "32c7352710a4fbcdcfdc1c627963d0f1", "bee98fe9ab94711c9d0f7abc8a7e492c", "cf10ccedf3cd73db09bc5024d049ccee", "b9e1af3ad112f578046a6cef6b57d3f1", "9e318023a75e6bd73ac3b65378de4fd4", "5fb83dca41bac868a882f6be49877163", "4bc4303f4bf87948518ed36662c3b159", "29c8f758f73742817e5e823c68c86d68", "4f5516fe7087a005fd2863926c79a58d", "68e46cf8e2d0818223c8b8c4a2188af5", "d3cb2f35637bf1cca1bc410d4103d0e2", "858d1e0e0c6e57bf408a52dee9f45f44" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 359, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 402, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 120, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 267, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36 EdgA/155.0.0.0": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 9, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_4841f551cf07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4841f551cf07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65281-35-43-13-16-65037-18-23-0-51764-10-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790610078, "last_seen": 1790610078, "transport": "t", "ja3_hash": "200ecf847917d25e7b87b066ef800a05", "ja3_variant_count": 1, "ja3_variants": [ "200ecf847917d25e7b87b066ef800a05" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_494fa9cd0083", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "494fa9cd0083", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788288340, "last_seen": 1790441044, "transport": "t", "ja3_hash": "3826b2ac983301e19e6e089549bbde34", "ja3_variant_count": 1, "ja3_variants": [ "3826b2ac983301e19e6e089549bbde34" ], "user_agents": { "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 2, "Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_4af6b3281435", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4af6b3281435", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 64, "first_seen": 1788867259, "last_seen": 1791198974, "transport": "t", "ja3_hash": "598872011444709307b861ae817a4b60", "ja3_variant_count": 45, "ja3_variants": [ "598872011444709307b861ae817a4b60", "0d65ca0a2241ca77b3b1ccfbb5971bdd", "65421c6c8137c13952046994829e6963", "e7e45e497ed9e83bf97598bdedc35ff5", "85c818c09ad9e345bbccf2f7cee191a5", "0c0950cd5a192a51599fb0fc2254240f", "511aa27d82b234acc3589e7418558575", "d46c78c47a8913f1d964100da95c26d2", "6838bf5e810a38816a6d94462975ba13", "61e051b6965552b09b7e62d7be2ff47a", "8202e61fb01384e9af4f4b654ed7e519", "77fba0b8e09d39e72cfd1633e3f927cd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Linux; U; Android 16; zh-cn; PKM110 Build/BP2A.250605.015) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/115.0.5790.168 Mobile Safari/537.36 HeyTapBrowser/": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 45 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_4b219a676311", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4b219a676311", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-65037-11-13-65281-23-0-27-45-43-51764-10-5-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1791021459, "last_seen": 1791169796, "transport": "t", "ja3_hash": "2cf51530df5b692378a0d06492e756e5", "ja3_variant_count": 3, "ja3_variants": [ "2cf51530df5b692378a0d06492e756e5", "807a0ddb1fa0a144c1a660429dd7d146", "fa6c70d952dfcebaddd7ccb2f286dede" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_4c0486d9e623", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4c0486d9e623", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-11-10-17613-45-35-43-13-27-0-23-18-51764-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790698952, "last_seen": 1791035358, "transport": "t", "ja3_hash": "10097eb9c1e7ec587e4f087292a621e8", "ja3_variant_count": 2, "ja3_variants": [ "10097eb9c1e7ec587e4f087292a621e8", "9c246a1cfb3d43eab94d45fd44cf3073" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_4e18006c8ffd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4e18006c8ffd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-5-17613-43-11-65281-45-18-51764-27-23-35-13-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788739401, "last_seen": 1788739401, "transport": "t", "ja3_hash": "5d4b505b870f817dfe7d9dc0f24f0b3c", "ja3_variant_count": 1, "ja3_variants": [ "5d4b505b870f817dfe7d9dc0f24f0b3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_4e72810074ef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4e72810074ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-13-51-23-10-43-27-16-17613-5-18-65281-45-0-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 145, "first_seen": 1788442006, "last_seen": 1791361945, "transport": "t", "ja3_hash": "993682c360bc91f291ff2cbee5647c61", "ja3_variant_count": 145, "ja3_variants": [ "993682c360bc91f291ff2cbee5647c61", "d8f15a63c1d9a9cc0f4ca20daac3055f", "7e16f8385aa6aece5abedcd5ab9f6e0a", "8f05b62c61474667bc6fa1740a9ea61f", "a952685cf23d07bcb7132d31b645eb59", "76a0c078cd50379043960bf262bf7747", "3c0e8d84d0f1984679baa4f9ef01d510", "e01e463f4f45ccddeb387cc08b0b46e2", "c89eb7653c1aadf294f253fcc063acad", "ca9c0ff5db8cf06d369eccaba2f83ece", "a35b9ea0cd3366af54b497ebd057eabd", "52701efb332904256991554e422daaa0" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 27_2_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/154.0.8037.55 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 760, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 208, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 25, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 228, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 281, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 34, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 27_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/154.0.8037.55 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 24, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 75, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 61, "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36 EdgA/155.0.0.0": 50 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_50ad9413a53b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "50ad9413a53b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17513-43-35-45-23-51-18-13-11-0-10-65281-5-27-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790292059, "last_seen": 1791312545, "transport": "t", "ja3_hash": "9b3d24e6f1e524f494c29ef246517229", "ja3_variant_count": 4, "ja3_variants": [ "9b3d24e6f1e524f494c29ef246517229", "0d52df47dc99f1f01b010bbd9f17629b", "98d6495a6b7b5c3abf6bf6c0d5f85eb8", "add01da2cc2b5e8d1377970a8b8680d2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_60ca7a570977", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "60ca7a570977", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-16-65281-18-51764-23-5-65037-35-27-0-13-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790698170, "last_seen": 1790698170, "transport": "t", "ja3_hash": "47a6968efd4f512bae0c2dbf7139faf2", "ja3_variant_count": 1, "ja3_variants": [ "47a6968efd4f512bae0c2dbf7139faf2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 40 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_62043c603853", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "62043c603853", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-16-35-27-11-51764-5-65281-45-13-65037-18-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790317527, "last_seen": 1790317527, "transport": "t", "ja3_hash": "3a8d65243bfd6e358ccba3bedc358832", "ja3_variant_count": 1, "ja3_variants": [ "3a8d65243bfd6e358ccba3bedc358832" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_6697e4fcbfde", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "6697e4fcbfde", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-16-18-45-10-65037-35-5-43-27-17613-65281-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788723983, "last_seen": 1790978932, "transport": "t", "ja3_hash": "96adbea7725e2eb2b214ad860a9323e5", "ja3_variant_count": 5, "ja3_variants": [ "96adbea7725e2eb2b214ad860a9323e5", "bc9212a67c89cd88017732df2eee8b35", "f338e476e09e52573ce17198f8bfaebb", "e5995020f9feca6f8a322fa73ef18b8f", "50ce51154f639e6488cd9fa1684e8664" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_73a26f977696", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "73a26f977696", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-16-5-65037-10-51764-27-43-23-35-13-0-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789578321, "last_seen": 1789578321, "transport": "t", "ja3_hash": "bb15a5497506a151d1fd68c472dcb686", "ja3_variant_count": 1, "ja3_variants": [ "bb15a5497506a151d1fd68c472dcb686" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_769ac737886a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "769ac737886a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-43-65281-0-16-27-11-5-65037-17613-45-51-35-13-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 112, "first_seen": 1788487189, "last_seen": 1791361167, "transport": "t", "ja3_hash": "7304d91080d6e0de8dc90eaf0be5716a", "ja3_variant_count": 112, "ja3_variants": [ "7304d91080d6e0de8dc90eaf0be5716a", "4ed22f36c733aa693bd32e4636002f93", "95006520c34ccc3bf31ee851240d2c8f", "26f178615335dc851de15b21a6045b7e", "5c972226f43a8d6e6a6211f3aab1a688", "ef1b23de8c5f30c27958a62b8386525e", "eba3de46b9c96922e8c8952ea4cf4c3b", "d16638ffb3878405c56bcabb86fec884", "4980bf94a6f58f97f83556adf56f8d50", "0530142a70847bf562e053dc6d1bdf72", "f135fe2305883489a00a185a154c8537", "a6c5ac7b0aa200546ff8897587c6edf1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 409, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 405, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 24, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 242, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 55, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 199, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_7a05a2f3bbf0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "7a05a2f3bbf0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-65037-0-23-65281-17513-45-35-5-27-43-51-16-18-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1791109074, "last_seen": 1791277258, "transport": "t", "ja3_hash": "e10277f00128701d959bc94033c1a7b3", "ja3_variant_count": 4, "ja3_variants": [ "e10277f00128701d959bc94033c1a7b3", "fe572f92be8d71d74e836bb45a7e3869", "7080c8f84e354ddd4a7aa87b655268a6", "0d8017fb8cf6b05f430906575725ada3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_7b0b2a9ab28f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (7b0b2a9ab28f) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "7b0b2a9ab28f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-65037-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788958145, "last_seen": 1790758028, "transport": "t", "ja3_hash": "f9d2f6d8695242a9a1545f8be02e52c4", "ja3_variant_count": 2, "ja3_variants": [ "f9d2f6d8695242a9a1545f8be02e52c4", "70bc8224f497e5e56b6b3aeeaa56d0f8" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1516h2_8daaf6152771_7c1bbe18ec64", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "7c1bbe18ec64", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51764-13-43-5-10-16-27-45-11-18-0-65037-35-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790712068, "last_seen": 1790713967, "transport": "t", "ja3_hash": "317b5ddca71dfdbf6e8abb233c7c70ca", "ja3_variant_count": 2, "ja3_variants": [ "317b5ddca71dfdbf6e8abb233c7c70ca", "bdfa623117ce0423eb3cbb80839b3bf8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_7cc2a71fb2f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "7cc2a71fb2f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-11-0-45-35-65037-51-23-16-17613-18-43-10-5-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 130, "first_seen": 1788455488, "last_seen": 1791361266, "transport": "t", "ja3_hash": "36e4c1344540a92810756667931ee13c", "ja3_variant_count": 130, "ja3_variants": [ "36e4c1344540a92810756667931ee13c", "ca5629bce034eb9f60b9ddd338c377b9", "388a66eef22a6c18d66e4ea0d9720203", "ac35598db94668dd98fcea5ecd3027c1", "ea239ece823e07c045f5b1d6c1d74bd0", "c2545e30ef3502584da03e85787aa57f", "81e0191006e2f4a4f380fda55a32ed2e", "09fa13f84dc94ca564e4c5b71e250695", "474ffe8579ace97ff7fa62e4fc04c366", "4352d92888eb8ba577be11f3d1f2670e", "2ef11e39ab6b637fe0c5e9f4b10de097", "9a9dc28ce1c256db8310d7b2550741ae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 351, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 134, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/153.0.8010.24 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 51, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 290, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_7e448db9ea6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "7e448db9ea6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 39, "first_seen": 1787727403, "last_seen": 1790440207, "transport": "t", "ja3_hash": "a1d7243639bf3eccacd288639c620582", "ja3_variant_count": 1, "ja3_variants": [ "a1d7243639bf3eccacd288639c620582" ], "user_agents": { "Mozilla/5.0 (Android 17; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 9, "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 4, "Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 12 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_895d4bafc6d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "895d4bafc6d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-16-27-35-51-45-17613-65281-23-65037-43-13-5-0-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 135, "first_seen": 1788453620, "last_seen": 1791361252, "transport": "t", "ja3_hash": "2a6f64d79c82d4c1f4c8977cb5b61332", "ja3_variant_count": 135, "ja3_variants": [ "2a6f64d79c82d4c1f4c8977cb5b61332", "5a212dd75f075a64c0df4dcd62a122c3", "f5cb06dc97f444b7af48928580a9223e", "7b5eeadb575bab99df8b72c63991bcbe", "ab951735a63538698c4552b2567195b7", "0387ba9f4b3ac22acd61d13e5851cc98", "1a4df6341d4af9b3884d04a1de47c48d", "cdb0b88f1feb882e1f3944b7cc9782d1", "19807505e6c1003445afb0f08adcff59", "d70384119b21174ce33d3acb1539f83c", "d485617da1b3523049ce925f42bc2cde", "3a6cf9cef4e60555bab9327b70dc147d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 690, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 21, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 50, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 357, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 121, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 107, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 Edg/155.0.0.0": 25, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)": 30, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 7 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_8e37aa83b3bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "8e37aa83b3bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-65037,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 203, "first_seen": 1787527270, "last_seen": 1791337028, "transport": "t", "ja3_hash": "d4db205a0e09a5483ae292af1424960f", "ja3_variant_count": 4, "ja3_variants": [ "d4db205a0e09a5483ae292af1424960f", "e5e6f8c2d91420315471d8db1c9fe55d", "81b9ecf7788a9f3a6f081d3d9337e77f", "dd333e8c5db515491bfa87b75be35fdd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 73, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 379, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 243, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 59, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 48, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 270, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_8e5b76e5a467", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "8e5b76e5a467", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-16-23-10-5-18-27-35-11-65037-65281-45-51-17613-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 129, "first_seen": 1788460068, "last_seen": 1791361167, "transport": "t", "ja3_hash": "9a657d5530659796b7d82704bce8bd65", "ja3_variant_count": 129, "ja3_variants": [ "9a657d5530659796b7d82704bce8bd65", "f3bcae1fe320abec83e9e0704ef13310", "3c784ebc06492735ac812618a54169e0", "055a1e429878e9e18b31c40e38ad5b21", "b9d4e606a6c89c97094ddd22f8663ba2", "ca0f9b04f6018d3d14d7b4aad030a876", "9d1ebc11d69214a7438199674dbd8a2e", "3c0c54f91d8a41379eab43ce01de2611", "559b69a6636e9fb70a984d3b216188e8", "fa0fc64749e41e0190a37f97ffbd2a3f", "6978e71934df651c3df5f23a52bc20c7", "296525356212b69c1399ff2a1fe1677e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 56, "Mozilla/5.0 (iPhone; CPU iPhone OS 27_0_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/155.0.8059.24 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 272, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 35, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 113, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 232, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 54, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 7, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 OPR/102.0.0.0": 26, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 30, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.36 Mobile Safari/537.36": 40, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_959f154ec0c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "959f154ec0c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-17613-0-5-35-16-51764-13-18-65037-43-23-65281-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790708167, "last_seen": 1791209003, "transport": "t", "ja3_hash": "e43cbce4c8e817e85e87cca8352b46d0", "ja3_variant_count": 3, "ja3_variants": [ "e43cbce4c8e817e85e87cca8352b46d0", "d3e09708f3214bf2c7225ef3aa82ecfd", "7cdd5e30db4a8bd591dc08fe562bf110" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_988f958b8b9a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "988f958b8b9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-18-51764-5-45-13-27-43-16-0-65281-10-35-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790517365, "last_seen": 1790517365, "transport": "t", "ja3_hash": "666a39f68463fe7d5b82f34bd7d2523f", "ja3_variant_count": 1, "ja3_variants": [ "666a39f68463fe7d5b82f34bd7d2523f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_9fd9352597e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "9fd9352597e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-43-5-23-35-13-65281-16-65037-18-51-10-11-17513-27,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10399, "first_seen": 1787458454, "last_seen": 1791363335, "transport": "t", "ja3_hash": "1d9a054bac1eef41f30d370f9bbb2ad2", "ja3_variant_count": 10165, "ja3_variants": [ "1d9a054bac1eef41f30d370f9bbb2ad2", "64aff24dbef210f33880d4f62e1493dd", "a19ab9f02aacf42deddc1f2acb3d3f63", "2980c146323dfd9d97ddd8bd42945167", "82aea6f85bc8dff898ed7ec2764603ea", "6ab9c211ef18fb0614293c44e0b0324a", "4f6eb2b4a236c6c19fd4fe63a6185ec5", "c10e01c821089e009f01e4b5403f1f9c", "0f6d094e48f15ba0e253d34c5f6eede9", "937e19454b762db22243e7c8cdfff7ea", "35fa3ba907b97554647858ab2a0c1be0", "72dbb96fd91145d1eacc403e97488d55" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 2817, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 287, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 563, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 141, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 572, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 547, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.110 YaBrowser/26.6.4.110.01 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 554, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 419, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 579, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 382, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 599, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 605, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.169 YaBrowser/24.7.8.169.00 SA/3 Safari/537.36": 72, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 636, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 178, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 302, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/": 30, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 22, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3074.89 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.2457.169 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3427.23 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 15, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36": 45, "Go-http-client/2.0": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 UnveilPhishingML/1.0 (+https://sitereview.unveiltech.com/)": 59, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 32, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 10; SM-G981A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Mobile Safari/537.36 EdgA/80.0.361.48": 2, "Mozilla/5.0 (Linux; arm_64; Android 15; 2505DRP06G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.94 YaBrowser/25.4.5.94.01 Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.78 Safari/537.36": 18, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0": 14, "quillbot.com": 40, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.2884.170 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3667.49 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.2915.179 Safari/537.36": 2, "pc": 5, "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 33, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 26, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.29 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 26, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.199 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 psi-exam-extension/3.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.1 Safari/21622.2.11.11.9 ReadKit/3.4.2": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.6128.234 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:146.0) Gecko/20100101 Firefox/146.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 OPR/107.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 16; V2337A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.200 Mobile Safari/537.36 VivoBrowser/30.7.0.0": 2, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Avast/142.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.7101.200 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.1.2 Safari/603.3.8": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.261 YaBrowser/25.4.0.261.00 SA/3 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/124.0 Mobile/15E148 Safari/605.1.15": 1, "Mozilla/5.0 (Windows NT 10.0; Win54; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.6077.142 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3326.95 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2969.101 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 24, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.6248.48 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.6637.174 Safari/537.36": 5, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/532.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.109 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_a352db0a00b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a352db0a00b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-43-5-0-51764-65037-35-11-45-13-17613-65281-27-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788738597, "last_seen": 1788738597, "transport": "t", "ja3_hash": "893ba6c6d862cb542d9606ffa0845976", "ja3_variant_count": 1, "ja3_variants": [ "893ba6c6d862cb542d9606ffa0845976" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_a3f154f6d871", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a3f154f6d871", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-27-16-65281-51764-17613-11-23-43-0-13-18-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790596084, "last_seen": 1791035965, "transport": "t", "ja3_hash": "7a39319811f903389c4073ed56cced47", "ja3_variant_count": 2, "ja3_variants": [ "7a39319811f903389c4073ed56cced47", "f6b428fed0a16539f568c5cd484b2b86" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_a7826127fcf8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a7826127fcf8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2714, "first_seen": 1787444156, "last_seen": 1791353765, "transport": "t", "ja3_hash": "cd08e31494f9531f560d64c695473da9", "ja3_variant_count": 900, "ja3_variants": [ "cd08e31494f9531f560d64c695473da9", "a0128617b92ab8a01b2abf64cf17c13a", "7206b8a892ef1d869482cc67d856f285", "817b27e883403beb98efa553a19d3cc0", "5389adff80177e904d2600bdd4a88ef5", "90adc28a7b619732ebda7fcd2484cec3", "be89a8d36cc5355f9a0e850e02e2b427", "303f404d5b428cf65aacaee53f0810c6", "41958473318c768d6b9d3fd6a09885bf", "ab14fa6d5a2aac91f6419bc10e2b3254", "7d320833e45a3086e11011cb61868396", "aab18dde6dfd787f4b0841f0a65bd574" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36": 411, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 448, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 281, "Mozilla/5.0 (Linux; Android 11; Pixel 5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.53 Mobile Safari/537.36": 57, "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Mobile Safari/537.36 T7/6.3": 10, "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Mobile Safari/537.36 MicroMessenger/7.0.1": 33, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36": 42, "Mozilla/5.0 (Linux; U; Android 16; zh-cn; PKM110 Build/BP2A.250605.015) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/115.0.5790.168 Mobile Safari/537.36 HeyTapBrowser/": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36": 1, "Go-http-client/2.0": 3, "Mozilla/5.0 (Linux; Android 11; Redmi Note 8 Pro Build/RP1A.200720.011; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/89.0.4389.72 MQQBrowser/6.2 TBS/045913 Mobile ": 22, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/111.0.5553.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15": 6 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_b1b3b2b16393", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "b1b3b2b16393", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-17613-45-18-5-23-10-65281-51764-0-43-16-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790808620, "last_seen": 1791122810, "transport": "t", "ja3_hash": "61d7e907bef775caf12001d2798aabaf", "ja3_variant_count": 2, "ja3_variants": [ "61d7e907bef775caf12001d2798aabaf", "4a67996ed98764efb5f9aa841c5de1c1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_b56d5ab84258", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "b56d5ab84258", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-17613-65037-10-65281-35-16-43-13-11-27-45-0-23-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 121, "first_seen": 1788452606, "last_seen": 1791361965, "transport": "t", "ja3_hash": "6af65d4a36395b514f82354d2b702046", "ja3_variant_count": 121, "ja3_variants": [ "6af65d4a36395b514f82354d2b702046", "a1b37eec290ff5f10b34447dc2631f88", "3e48022d0669914a11f33de7585fad25", "7d5716625372b722ce45743124a7d511", "ec78373a1078e0c67c7d65f43f95030e", "f7e990ce476ea65e579dc8cc507273c0", "29ead844b7d65ee26344dbe4f8a921b3", "8fbef5a044a11071ce32cfeb051cf406", "bd37be9eb82b75c707f8eea9d82cfb48", "e8f14ff6d6d9c2ca6cfcd5a42c720f75", "050543d1b54e3bb7ad7c1e0e77e34992", "409a8f399775de5540cc5b43d26a39c5" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 27_0_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/153.0.8010.24 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 35, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 433, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 306, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 234, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 56, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.64 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 7, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.7.8 Mobile/15E148 Safari/604.1 Brave": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 58, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 25, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/153.0.8010.24 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_ba9857c3d86d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "ba9857c3d86d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-0-23-35-13-5-10-16-18-51-45-43-27-17513-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1788428277, "last_seen": 1790272348, "transport": "t", "ja3_hash": "9186fd35ff7abcf3642772aeb9b70c0c", "ja3_variant_count": 2, "ja3_variants": [ "9186fd35ff7abcf3642772aeb9b70c0c", "dd6d65e88aa332b6357fe2971ce06366" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_be8faeeb33c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "be8faeeb33c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51764-23-65037-10-45-13-18-43-16-0-27-5-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788459808, "last_seen": 1788459808, "transport": "t", "ja3_hash": "a3f7dd14bc52b8eb4db04bb746b964f2", "ja3_variant_count": 1, "ja3_variants": [ "a3f7dd14bc52b8eb4db04bb746b964f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_ca3670f0f22f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "ca3670f0f22f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-43-35-65281-65037-0-23-10-17613-51764-27-11-16-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790778987, "last_seen": 1790778987, "transport": "t", "ja3_hash": "7d374f47a05bcc4efba4bffd238c5e96", "ja3_variant_count": 1, "ja3_variants": [ "7d374f47a05bcc4efba4bffd238c5e96" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_caa4d4c0a4b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "caa4d4c0a4b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51764-27-13-0-45-65037-65281-11-43-23-17613-35-18-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790827889, "last_seen": 1790827889, "transport": "t", "ja3_hash": "59cc77dc571cfe235d23b4b3a05c799f", "ja3_variant_count": 1, "ja3_variants": [ "59cc77dc571cfe235d23b4b3a05c799f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_cb37a4f7dd6b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "cb37a4f7dd6b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-17613-18-5-13-65037-51764-16-45-65281-0-11-43-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789214314, "last_seen": 1789214314, "transport": "t", "ja3_hash": "3da10bf4ad5f00c87124eb23884e4b39", "ja3_variant_count": 1, "ja3_variants": [ "3da10bf4ad5f00c87124eb23884e4b39" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_cf40f6954b0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "cf40f6954b0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-65037-13-0-5-45-65281-16-43-17613-23-51764-18-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790615561, "last_seen": 1790615561, "transport": "t", "ja3_hash": "b2b108ad6d4a12b0ccca3b94d8b8baed", "ja3_variant_count": 1, "ja3_variants": [ "b2b108ad6d4a12b0ccca3b94d8b8baed" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_da4543880567", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "da4543880567", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-35-43-5-27-11-65037-51764-17613-45-65281-13-18-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791035761, "last_seen": 1791035761, "transport": "t", "ja3_hash": "f912e00f00cd9f4456812b08582757e7", "ja3_variant_count": 1, "ja3_variants": [ "f912e00f00cd9f4456812b08582757e7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_e25d9245df4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "e25d9245df4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-65037-18-45-17613-43-16-0-51-35-10-23-13-27-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 138, "first_seen": 1788442001, "last_seen": 1791361268, "transport": "t", "ja3_hash": "b6f99e435a4087e1b66088988f660b47", "ja3_variant_count": 138, "ja3_variants": [ "b6f99e435a4087e1b66088988f660b47", "892518a05cd6435abac6489b4b57166e", "2b7a80433c374e58e3620a0a8fb4d5ba", "7c11d3e4a9c90b8fffce450526a34011", "39e8d24fadf8d0243e26217e4f0ccddc", "2c6356a3037a000a5f5e219f353f034f", "9af6d688c1a575ebb6ee637875012060", "ebdeb706f59215aa4e3f90407f1cb8c4", "e52282dad0c13c1ca7904dc846535f19", "9c8982acf44b760a9884b3f929616333", "b139697cc4f65ab53af1d60461aefb85", "470176d8eacc6e460e11a2240cc3e317" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 874, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 170, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 141, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 89, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 41, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_e549116f6328", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "e549116f6328", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-16-23-45-13-65037-43-51-27-5-0-18-17613-35-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 131, "first_seen": 1788442008, "last_seen": 1791361946, "transport": "t", "ja3_hash": "f38914fad795553b07f9b757111c745e", "ja3_variant_count": 131, "ja3_variants": [ "f38914fad795553b07f9b757111c745e", "f398ab9a5370a87a487d1229f7f51c37", "190a0aa633e15dc862ffbd7bf4dde1c1", "90e0d3e943831ec5fc0d19aba55c7790", "a3f38507caba4d159c5693279704045a", "45b011ea12a04bf0c242f05cabce2b2c", "268627e2e0d764f286cf7868532bdcb1", "9d82e3567fda7bb1d8fb4ec3b2a0a50a", "2d0375d8ce6ea8a66a0c115b12fe5b12", "a5b85bbce2a9f6cc2370a5f686ca2946", "5250d0237ca0b953b971eafd1a3ea5e3", "7b5973666955081a45001b0259a2a11f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 975, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 152, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 145, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 299, "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)": 20 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_e655f92f5bb7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "e655f92f5bb7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-43-5-10-16-35-0-65281-23-13-65037-17613-45-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789671196, "last_seen": 1789679046, "transport": "t", "ja3_hash": "fc1cd0bc061364ef2ac5c0e2beec9154", "ja3_variant_count": 2, "ja3_variants": [ "fc1cd0bc061364ef2ac5c0e2beec9154", "b7c299928ce705f04d22ee8a562b4148" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_ea66517e8205", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "ea66517e8205", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-35-45-65037-0-16-17613-51764-13-65281-11-43-27-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790460215, "last_seen": 1790948099, "transport": "t", "ja3_hash": "e23383ee9f9c9cc06873d5197cc96e62", "ja3_variant_count": 4, "ja3_variants": [ "e23383ee9f9c9cc06873d5197cc96e62", "5db8c1ffe3f88741da6a721e18c865c9", "d1bc0d4ee336b251ffb63125e8fcd162", "1e7bfe7fa24c63696ea9632ea6b253a2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_eaa228a20f83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "eaa228a20f83", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-51764-45-16-18-10-11-35-5-27-65281-65037-13-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788948718, "last_seen": 1788948718, "transport": "t", "ja3_hash": "7fddf475cb89bcc4a50af7e13fb92f8a", "ja3_variant_count": 1, "ja3_variants": [ "7fddf475cb89bcc4a50af7e13fb92f8a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_f135f22e6141", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "f135f22e6141", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-45-65281-35-51-18-43-5-10-65037-16-0-27-23-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 119, "first_seen": 1788487186, "last_seen": 1791331731, "transport": "t", "ja3_hash": "9c1e646139c8bdd2e7f88d2260ad55ee", "ja3_variant_count": 119, "ja3_variants": [ "9c1e646139c8bdd2e7f88d2260ad55ee", "6d7f8c9394f59c76727e783555911fca", "ff1abe24dc0407319638cfc252f545cd", "41f85ede7bac45d5aaba8d7507626840", "0d5cf3c7d2f735ded0fd8d7fce953bfe", "2dfdfc777083a84a58d47024fa378335", "699326f034a311229bb68daa465080fa", "c9dec788b7664bf1ff893da85b6b8da5", "0beaaaf2aacae79af3c47d3cdae71bbf", "b7813eaae09072bad8e1a3fcdbd8039e", "c0a2eb906c679c46238be8b99ce587f6", "9f15298a5b6cedd82918e18c223d2b16" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 138, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 168, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 62, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 158, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS/153.0.4234.46 Version/26.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 29, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.36 Mobile Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 Edg/155.0.0.0": 37, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 16 }, "ua_disagreement": true } }, { "hash": "t13d1516h3_8daaf6152771_db113fc12e09", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h3", "b": "8daaf6152771", "c": "db113fc12e09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-51-18-11-43-5-16-0-65037-27-10-45-23-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1787623431, "last_seen": 1790614886, "transport": "t", "ja3_hash": "74e530e488a43fddd78be75918be78c7", "ja3_variant_count": 1, "ja3_variants": [ "74e530e488a43fddd78be75918be78c7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3580.28 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.2519.166 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3358.64 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_022358f51d42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "022358f51d42", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-16-43-5-51-65281-18-4832-35-45-13-65037-27-10-17613-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 36, "first_seen": 1788481953, "last_seen": 1789754323, "transport": "t", "ja3_hash": "3881800f8af5cd4aef5a521a4331b8fb", "ja3_variant_count": 36, "ja3_variants": [ "3881800f8af5cd4aef5a521a4331b8fb", "d9078c835a14bddc3d459c2ca9f582da", "fdc2ac9a6c411dbdffc2440c21fea2fd", "9ed84bb6707cac6e7193527410261657", "aae6488056af1f4b13d3a96b6e0e2545", "2e95e5ad878fc2f9539550f9e652c3c5", "62609eb05c9d01da0bfe679b147ab687", "5d07b2c2d2ea802ec08070649cc65fee", "fe6d50ab5eee697cfb8865bd6323fe42", "8c509af0c2a5543d2b7c9f19617e006a", "e5329a42ea7199278f521f0aab2a9723", "6806591141e275abb39fe778bc61d780" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_04eccc9c959e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "04eccc9c959e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-0-51-5-13-16-10-35-65281-27-11-45-65037-23-18-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 55, "first_seen": 1788511542, "last_seen": 1791293860, "transport": "t", "ja3_hash": "f4d7382c1f767b6d18a69b1cf7518c52", "ja3_variant_count": 55, "ja3_variants": [ "f4d7382c1f767b6d18a69b1cf7518c52", "5c20f1a4f0cb3f92374e32681226c7fd", "80858971625fb3a006a81358f8ff20db", "4432bed9773cf221b614391899ff5cfc", "a07b78cede884374fc95fdc599d152f4", "f1c6ebe546092cf8741173f737136735", "dab3f7e1af3bc3ad339ea0e63be2763b", "56e552731127f50e928c6c7b026a2056", "dac279a234607bc58186304e5591d992", "80bc288d804d5dee53c9ed4bd5269ba8", "7d4562f5bb7e7de6f84f8c3866144285", "b8d959b3a61561e65cae8362eb4a58c2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1188, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 383, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 46, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_0509f9346a55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "0509f9346a55", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-11-27-51-18-13-43-0-45-16-23-5-4832-35-10-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789063953, "last_seen": 1791207016, "transport": "t", "ja3_hash": "9c25e26d1026219b1e45200d067530bd", "ja3_variant_count": 4, "ja3_variants": [ "9c25e26d1026219b1e45200d067530bd", "ccf6d7f3375110f3a4914914cd786a40", "36ab3fe99d0e300fee7ac271075aa2f6", "40ebd355bf846f341cb3322048d2d4b3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/156.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_073be89ffb9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "073be89ffb9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-13-43-11-51-45-10-65037-23-18-17613-4832-27-16-65281-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788810970, "last_seen": 1790777235, "transport": "t", "ja3_hash": "5375afa40bd9d964d1ac10eb32a8479d", "ja3_variant_count": 3, "ja3_variants": [ "5375afa40bd9d964d1ac10eb32a8479d", "52580021726603ce6d86de38a734fd9a", "ff4b53972b7f0cefe602517d81dfb509" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_0833919f2636", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "0833919f2636", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-10-35-27-17613-4832-11-51-43-13-65037-18-0-45-16-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790163707, "last_seen": 1790163707, "transport": "t", "ja3_hash": "d27ee1c9ebbbbe616a24fb792e12a70f", "ja3_variant_count": 1, "ja3_variants": [ "d27ee1c9ebbbbe616a24fb792e12a70f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_1085e5058244", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "1085e5058244", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-51764-65281-65037-43-17613-45-13-35-16-51-27-11-10-0-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 160, "first_seen": 1788454345, "last_seen": 1791362221, "transport": "t", "ja3_hash": "a29b0596e7f0e74d1304d18648e0e77d", "ja3_variant_count": 160, "ja3_variants": [ "a29b0596e7f0e74d1304d18648e0e77d", "ddb195f19eb9aea9a73f8580b1155ba8", "54c2e066b3aa273e41a75170efe169b9", "b8f2f0503aa76f2c016b9801aed04409", "817a379294ebf9bc163f9b6b9550ec5a", "20339c1e282710425297dd83a49d039d", "8ee0153c4314eb97d966c134507ce33b", "beae43064d4059b3966e7d9726decf29", "7256236cd1cf91125a2ee933c379dff9", "dce864787e3825a2371c63c8c05b0b68", "8bceefec1c60a8e043230ab41d166ae7", "51433fbde2065e30c0ceb26c9c3c76ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 101, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 67, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 86, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 68, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 49, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 80, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 31, "Mozilla/5.0 (compatible; Qwantbot/1.0; +https://help.qwant.com/bot/)": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15": 27, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 35, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 57, "PromptingBot/1.0.0": 26 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_10fccb135769", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "10fccb135769", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-16-43-11-0-17613-27-10-18-13-45-65281-51-23-65037-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 58, "first_seen": 1788455481, "last_seen": 1791236583, "transport": "t", "ja3_hash": "22889e09e590d817b6687baefe422a13", "ja3_variant_count": 58, "ja3_variants": [ "22889e09e590d817b6687baefe422a13", "6d237253379b663acef81d26629762e3", "cc612f7b721fad9441b14510423e4de1", "369b0062e583a2faed36a102f6431ae1", "45f1115a8925a1568c627552995d51d6", "2b6127f0c7cda75fd121d680869883f7", "5ac5f4e88586ed1055c04c0975524990", "b7b3c0065c2d3a86d4d61c8d8f736632", "0e30bd8bdf99d2e0f42fb003c5002e52", "d159cb1eb7ee4e3e2185110bd490fbb6", "12420c4eaa1ecfe153a5f8641bc0a669", "0807b334231948f39eb6b932a4365762" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 187, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2001, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 8, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_139a3ec9cd93", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "139a3ec9cd93", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-35-65037-5-27-18-45-10-51-13-16-65281-11-0-23-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 50, "first_seen": 1788670099, "last_seen": 1791319388, "transport": "t", "ja3_hash": "a9b6e5714a2896ca9faa7f6204c2e53c", "ja3_variant_count": 50, "ja3_variants": [ "a9b6e5714a2896ca9faa7f6204c2e53c", "91889b07c8b5ab5069adbc865dae014f", "53e689a95047fea3035ff01efb56ecbf", "e77b6bfb0a08498f35efddc587fed823", "35e8c01cfd50cf3aefc5bb5eb195e8da", "e5fd364cf0305ae47a50c561fc83274d", "c40fa3fb2cec141bb89fe43342c0b266", "e4eed662636a1b1b8033bf118b923f4b", "92815f8041ba8669892dff0cc8358e5e", "1badd6f9b25d47913ace6b0cdedfcd2c", "ac5634ca5fe6a0ff44ad9fb60b25dd12", "a182fb183654504e4265d74a7332cdeb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 693, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 25, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 47, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 103, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_14573bdbf458", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "14573bdbf458", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-51-27-5-13-10-18-0-43-35-65037-16-17613-45-11-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 47, "first_seen": 1789337483, "last_seen": 1791148470, "transport": "t", "ja3_hash": "cde4177bdcef37a41f4c93d7591541bd", "ja3_variant_count": 47, "ja3_variants": [ "cde4177bdcef37a41f4c93d7591541bd", "1c830b56b920efb2c83f3a05f6f63da5", "708965b85fe280c7743871aa7d447e77", "a32c1b5307b6f0d2ad98d06e63a3e47d", "1a8ce731054d651d65ce01da3abd28ea", "9a13a1981db466300da51e3fac150f3e", "00eb85821c4f454db47ac4b79c0d585c", "f740c758fb745cff62ff6349cc4754fc", "8c1846cfd394a3e0b58798f2f4f0c30e", "4c549c6017c8788aa6e4ed145010296f", "6fd6fb77b7db3ac87c0d6b07f21d2b5e", "31e9fa149ecd3aa3c20156b000fe5ae8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1250, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 301, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 10, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_187fd8edc401", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "187fd8edc401", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-16-18-65037-0-4832-17613-23-43-35-11-27-10-13-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789701004, "last_seen": 1789701004, "transport": "t", "ja3_hash": "7eae7864c6ced2d1a0c4325ecc6d53a2", "ja3_variant_count": 1, "ja3_variants": [ "7eae7864c6ced2d1a0c4325ecc6d53a2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_1d18168c06b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "1d18168c06b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-18-65281-0-65037-10-27-51-43-11-5-45-23-16-35-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 54, "first_seen": 1788764479, "last_seen": 1791323302, "transport": "t", "ja3_hash": "fedf2739db6eb79d0368b8c65fef0ccb", "ja3_variant_count": 54, "ja3_variants": [ "fedf2739db6eb79d0368b8c65fef0ccb", "08db6e0d25a40df0272f403627647764", "82c12b7e0d6380fb29ba9bff322d2bdd", "5041aff2c9e630d1b7e9e34086259cf6", "33997da55bea7262761d5cc6edcaf67c", "35c954b17e6263c08e6de14f0902d94f", "cd5a07cc64e45c2a35de65482d1c3c97", "9f04414e8ea306d77ee0b89a0583ad6c", "b91924d83fdbaba063d4f48b41dfc7bc", "6385aed98e685aed62452549f5a8adb2", "729d1a16b776fadb50ff466ef9227fff", "7e1b49f5e8553939cae40391e5fc23dd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 766, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 348, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 295, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_1f5be7abbb88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "1f5be7abbb88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-18-17613-51-65281-16-10-35-5-45-27-0-13-11-65037-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 54, "first_seen": 1788511537, "last_seen": 1791312492, "transport": "t", "ja3_hash": "a05773bf0dbd9bbf83ad3b5c2c61593b", "ja3_variant_count": 54, "ja3_variants": [ "a05773bf0dbd9bbf83ad3b5c2c61593b", "6418c760d2f4cd1ce711da7ad111cb52", "1810ac9300edad5b37075eeb2a74010d", "b6d9b8cbab5f0e5e949b0c42d223736d", "1085a9e3b5450a03bec942474551449e", "e73f1fae9131ee4b26e23c97a6563614", "78b604f0289ded7957d763262fe24611", "e81db86fda6e6677951ac63f69a92b01", "6e62b8ed5309535b78cd2bf6887bac74", "0462b41c14394b5e5d32adf227c789ce", "e6069d77df238edd72d1a4edf40cc20c", "3ffa7c37ec17a79f9cbb0fc6152317b2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 627, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 165, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 28, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 OPR/102.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/137.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_1fda708985f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "1fda708985f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-18-23-13-51764-17613-11-51-65037-43-35-65281-10-27-16-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 179, "first_seen": 1788447434, "last_seen": 1791361993, "transport": "t", "ja3_hash": "657065e1c677539c0a704b281b892b7b", "ja3_variant_count": 179, "ja3_variants": [ "657065e1c677539c0a704b281b892b7b", "b5c6ec0143a8f74b8b783bcee4e60bd3", "3724c54c154c3ffd8c712145642e65f0", "ad097185967f6bc175ec5ae52ed9aa5d", "387868e74a20a68bb71f513d0b32cfdb", "2799d3bd515674b2a8d16e3ff727eebb", "6d6b16ec42d37ae7d3c01ebec9d09394", "d9cbe2cb9d0274dc7c90e01c7d2d2586", "10eee4b459ff46617d60204de8ae727e", "86bc21701fa9de54f6314d5a40bc9649", "5d5792cfa87d325334bb57a9b22510d4", "34617a1823f66eb639ad42c3f3f4c3e0" ], "user_agents": { "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 99, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 42, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 147, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 66, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 96, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 71, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 116, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 46, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 7 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_28e24ad211ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "28e24ad211ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-10-5-18-45-23-65037-43-11-16-35-65281-51-27-0-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 154, "first_seen": 1788508342, "last_seen": 1791361995, "transport": "t", "ja3_hash": "783fd2bc812d743984d30ec237050fdc", "ja3_variant_count": 154, "ja3_variants": [ "783fd2bc812d743984d30ec237050fdc", "846fcaf1027143633dc2e58978b04478", "5742dd96885b6aad7679072054bf44ce", "8ca120cc4a4930b810f5335c96589580", "1a7cdf94afdcff655b93dca8d44c2014", "f2bd9d0db7cb8c39040c0633bfb57cc2", "a93758e88bdead9509d0a747fb48558e", "12c4149288710855ad63587693ca9a9a", "9f1f6365a97167bfdee86a0bc5821219", "4472676e804e1a51643b37ad52ad5030", "35eb1066eb60db4fc32d9a07193d685c", "b8444c6a8e5d7c1bf0607da9344a9604" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 102, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 39, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 77, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 95, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 61, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 67, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 42, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 60, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 5 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_2f8731a6a4b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "2f8731a6a4b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-10-35-5-51764-17613-45-43-13-18-27-51-65037-0-11-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 153, "first_seen": 1788442953, "last_seen": 1791361977, "transport": "t", "ja3_hash": "2079b884187d19272627eb3dfa4e16db", "ja3_variant_count": 153, "ja3_variants": [ "2079b884187d19272627eb3dfa4e16db", "84ddb4961f1d606233bea744a431bd4c", "c4abc57e203530cbdc5031e4e9cc9aeb", "dac30ba22c0c123a285eb1faf6e3e9a1", "7156e26c012a5dc2cddde8f9cc7c2e12", "4d2412b335515f4e66a3a72d2601942b", "8665550842f0ee705dda7ab9a65d1280", "7e94e8e1744201f1efdc285fd9144218", "f1880dd08b5e9d3e82e3c770219d4e75", "af85e2f5ac4e1170788457f3742c0c3f", "71c927c6129a0ee028255fcb6cbecd48", "4884e737821f046f5af73c7c81e94e62" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 130, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 74, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 73, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 23, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 70, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 41, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 8, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 40, "PromptingBot/1.0.0": 25, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 60, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 10 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_32e4bfa1f4af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "32e4bfa1f4af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-65281-27-35-11-43-17613-51-13-23-16-65037-5-10-18-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 38, "first_seen": 1788511543, "last_seen": 1791155529, "transport": "t", "ja3_hash": "41af9b78fa8dde6d3f46b0f9f3c8df22", "ja3_variant_count": 38, "ja3_variants": [ "41af9b78fa8dde6d3f46b0f9f3c8df22", "3de06e60adafa4a4d4285536dfd6a9d1", "0097940b27dc11d298d514c262791167", "63b075ed74ac63b0688fd9faeeefd5a3", "020aa5da1f416de69bc2004263d9c1a5", "49489f926d1e63d9376cc3cd2f3db4b2", "9ec4d1b73e1560f3accba8d327c2a7d4", "6b20ba95a657646ee9896c5ed8a07e8a", "4ed2720def31e55a42be8c28ce38d2cb", "5aa9854cf865224214b9cfede8b95abb", "0055f583b8d340347b1c2506692fd781", "e2ba6ff9a88d53af98a83dda17f5ca46" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 893, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 155, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_336658276580", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "336658276580", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-23-51-10-11-43-13-51764-45-16-35-17613-18-65037-65281-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 39, "first_seen": 1789028204, "last_seen": 1790851795, "transport": "t", "ja3_hash": "01fbeec8253e560deceffda9aabb7979", "ja3_variant_count": 39, "ja3_variants": [ "01fbeec8253e560deceffda9aabb7979", "d3b24c7e37cf9b231788aa26aa466844", "5300d961a51f56138a724ed39068309e", "04be2b53ddbf734e46a750e430f8ddbd", "f056c88e3c8e9b833f7e3fba94b5db3b", "44d69e26bda93f4a127a02aebd17dbc6", "db7e7134f988b7744e3b00b3f663164f", "719632553f8c8e9afae4111bab5ee67c", "ea1d9e0f40698abd9bea8d8236703073", "0a360eeff432dcd98c31159bd5891cd6", "4f75ffc19196fe8fcdc07f3dbe0881aa", "bf38407ea157750037145fa4d8799057" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 83 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_4103a46087ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "4103a46087ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-65281-23-16-43-45-65037-35-18-0-11-51-13-5-17613-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 63, "first_seen": 1788455484, "last_seen": 1791280675, "transport": "t", "ja3_hash": "8186e54f7efd6023c0952c6a212f75af", "ja3_variant_count": 63, "ja3_variants": [ "8186e54f7efd6023c0952c6a212f75af", "435b643d81f17e4846a3cb4e992ee5df", "30b52e91e0e58ade6acfb9d6f4e91151", "3fd0d6283fc50d9aced130627a1388d8", "5e8a78a6b5d139bc75afcc2dfbbfd3f5", "6656acf9e158f5c640229ff7a7a1b9d2", "37753ff3e0c19e2f2c9264ff4c0f4868", "acbbea42fb148f9289d838b53d750639", "460944cbcb2469d6e8940fe75484f0d0", "a3aa06815f2668134d151bca7425f66f", "3f05896c68106b2d38d1b22a0dc46147", "242dc0afe3ae6b87b31c85a2998c890b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 938, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 387, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_4a49abb6c414", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "4a49abb6c414", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-45-10-27-17513-5-0-23-51-11-65281-43-18-16-65037-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 33, "first_seen": 1788815819, "last_seen": 1790579108, "transport": "t", "ja3_hash": "a32482833666660bce79d2a5b6a31e91", "ja3_variant_count": 33, "ja3_variants": [ "a32482833666660bce79d2a5b6a31e91", "a3b09dae2534662c98420a6ebe34e920", "a8f539a1ddbfba16f0fb588dc1affe5e", "d14c630c79579b55a78180ecc8d37b66", "38e5cdd872926d7802b80600e7957fcf", "9f03f8796c3c141a528d75f807b1fcfd", "e131e8408d51950f5d997b41ab83a54f", "df80657eb0b5632eeb4bf8f2e371b9de", "79e269766f33a98c42ad6733055136ce", "085fe00887c083c599db2df9d7c7e1d7", "07f2f008cc97d87f071f0c5508123a33", "f62b269347c2574d60c3a9fd82644a59" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0": 109, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_4aacc9508e76", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "4aacc9508e76", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-27-5-0-11-51764-13-51-23-17613-65281-35-43-65037-10-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 166, "first_seen": 1788508341, "last_seen": 1791361973, "transport": "t", "ja3_hash": "b722399d70a4f511fc1e25e32e5e196d", "ja3_variant_count": 166, "ja3_variants": [ "b722399d70a4f511fc1e25e32e5e196d", "bf76cbfa40fde72eef2f2b2c5cd1ace6", "82abc5957591869056e21edb2a9be71b", "86950f11de9150a3d5848524cf8f43ec", "90b48e624eece73458a964254aae4b35", "2bfb8944d137a4e1e3667c9126514e1b", "90e8f77abbdf332e94db0a16dfca8f42", "94dffc62c0b0c931f9b4d79340e43ec1", "851a0608d67bc5d68b96739d438af298", "d6119f1c4ef41fa4e87f2f700efc339f", "d62d4cc9665b6615e2907ee44bfd4842", "28aacf66f0cbd224645072472c6b65fa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 122, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36": 52, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 67, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 83, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 95, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 25, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 103, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 48, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 71, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2, "PromptingBot/1.0.0": 23, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 9 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_4c8d7e2cb076", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "4c8d7e2cb076", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51764-35-45-0-16-18-65281-27-17613-65037-23-5-10-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 149, "first_seen": 1788508371, "last_seen": 1791361996, "transport": "t", "ja3_hash": "fdb1c7c74c9c74f2a659decc42a7a3a8", "ja3_variant_count": 149, "ja3_variants": [ "fdb1c7c74c9c74f2a659decc42a7a3a8", "00ba14bdc7b5a4c4954a899bcb32480f", "8ee0927dd0bd7a515a2bf380037c9838", "e29a50f14cb253711c5772b38f060bb2", "f59b35fc37a253e4eb0f34c52e3f456c", "cc990cb9272d8f2e23c3533046b7a8f3", "b33781b6bd6bae2e42485c5f9f135228", "36da6c2aa9ccbe8b3593bed39dc68f36", "866565dd99e7424130a8e480568aff32", "d2ab315c1b1553001b6c2d9582a4bc94", "2ee54be15096d6dbd8d028f99bd40ad2", "b4c16e2901f273887b9b2bb98a612f8b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 52, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 32, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 56, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 77, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 15, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 84, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 63, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 25, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 32, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 12 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_5a02ae809b14", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "5a02ae809b14", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-5-51-11-23-51764-65037-65281-17613-27-16-13-10-45-43-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 142, "first_seen": 1788442949, "last_seen": 1791362222, "transport": "t", "ja3_hash": "48dbc95778b746ee40e12e01beab5baa", "ja3_variant_count": 142, "ja3_variants": [ "48dbc95778b746ee40e12e01beab5baa", "1ce89f3ee6fd81f979199a02315d7310", "bc77955ac35b3865076a0249bae8043d", "4df87533cc067183e472c78ab71305ec", "6026a9e53cd1a9c044b5aa9f815cb34f", "f710800ca5f88201d4464d7db34ab2ec", "e401972756c0d2bc41aba41aa2b56528", "daeded2fca2b42ac82e28b599b5cf394", "7efa540c33a6f7b95a30517ef8f487c1", "33b33aed904be174dde9e904cdfe9e78", "2cb40db1ab0855084bd028f1c40c7c45", "90a3d070cb2b0e231d54dc65af516cf7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 15, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 36, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 70, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 125, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 150, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 27, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_5b41ea1559b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "5b41ea1559b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-13-18-27-43-5-17613-16-35-45-10-65037-65281-11-0-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 59, "first_seen": 1788455476, "last_seen": 1791263133, "transport": "t", "ja3_hash": "0097a8a57ffac7859257d2d952c6487e", "ja3_variant_count": 59, "ja3_variants": [ "0097a8a57ffac7859257d2d952c6487e", "4bc5aab49f2e18e0e06a2b5d4e5d5dbe", "d45b1861c54346be57c5756ea5c495d6", "68db363c77e2373f0f7e7624eeedfcb3", "efe1b0c9d7277d0015a9a2d169fdf61d", "ef7db21be477cf301068174a86d3ce63", "b0e9c3262627b57ff2386864bbdf3505", "57f951ad51c1a7935034c70d9162a958", "e19fe96462c4b290ee347ead883b1485", "a0dfb09c0219f9248dfb9c3a13d91a47", "6dd9989fefef6905718e0b02351ce08b", "c62f8b8f70b0c0d618161143e44c966b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 386, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 40, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 498, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_62332d89dbe4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "62332d89dbe4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-13-5-17613-35-16-27-0-51-65037-10-23-45-11-18-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 48, "first_seen": 1788778865, "last_seen": 1791315688, "transport": "t", "ja3_hash": "c43d26e7445498ded3147c7343efcb7d", "ja3_variant_count": 48, "ja3_variants": [ "c43d26e7445498ded3147c7343efcb7d", "cdde7981ae16f5f9e09b6a4f70225da1", "20ed0e179e4bd7094c2aad806f7b4f05", "0a1b0c42a5eaf3c3c957576f8aff03e5", "eba8e2393086956ae7a471f2803ec86e", "9a59d5efd529d19c53acc0ca47879c58", "599093b3ef47b6c4b76b71d82eda9374", "e44a637961dd8324bb96cd5399cc1ebb", "4084b017ff914ab305ca96733cd39a88", "33c56a8d0b1ed47b60584f95290759b3", "ab1ca17f271fc5bf3cd7775dd0fdd1b4", "42385b194f60466a35dc4ded028abd55" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1567, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 314, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 64, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_635d90b37c6a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "635d90b37c6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-45-10-27-0-65037-18-51-11-51764-65281-13-35-23-5-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 167, "first_seen": 1788454342, "last_seen": 1791361165, "transport": "t", "ja3_hash": "ce6a00081450feda23aeef0898d4a1e6", "ja3_variant_count": 167, "ja3_variants": [ "ce6a00081450feda23aeef0898d4a1e6", "f765d7e778d55266b50a77d1202d89fc", "591019d62fbaae40c26862107cf2fd25", "bba45f3081d59082647150b22b34434b", "ff8a68ae38e0afb453d79a6262ddcecb", "5b84ed491a0caef4beae15077812fad3", "75e6c36921418d301c6ce9a4783d4b9c", "26c2684da40e10d3e4b14be73a4125fc", "3f1c5cebac87a1236bd84adea8802eb0", "9816b3860edf8aa7f988640e959e5960", "03680ee48c65cc9df22495097ca78671", "c25c2e9f39db8887c7de77719ac116d8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 145, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 29, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 129, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 64, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 150, "\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 36, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1": 3 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_798f6b82d7e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "798f6b82d7e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-4832-65281-11-13-51-16-10-43-45-35-0-27-65037-5-23-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789386522, "last_seen": 1789946150, "transport": "t", "ja3_hash": "5f183df201b2f6f9288a2efe544724a5", "ja3_variant_count": 2, "ja3_variants": [ "5f183df201b2f6f9288a2efe544724a5", "bf4f851e499b73295c0c46914ad07982" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_7af0cb3b5dda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "7af0cb3b5dda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 629, "first_seen": 1787485232, "last_seen": 1791349738, "transport": "t", "ja3_hash": "9d42e90b0225e779f03141ddcd699df2", "ja3_variant_count": 4, "ja3_variants": [ "9d42e90b0225e779f03141ddcd699df2", "424f6d9c8b8928c0a0489a4f1a0f3e89", "a6500ee6b57fae757d8d0a14c31ed421", "1125367924f16778a24046f3a1723df3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 /157.0a1": 5, "Mozilla/5.0 (X11; Linux x86_64; rv:158.0) Gecko/20100101 /158.0a1": 13, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 /156.0": 2, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 218, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 41, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 799, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 27, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 32 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_7e6e16c20c5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "7e6e16c20c5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17513-0-65281-11-43-27-10-35-51-18-23-45-65037-16-13-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2216, "first_seen": 1788441550, "last_seen": 1791363338, "transport": "t", "ja3_hash": "e6e3a5c9ade212f0570f44cf7909615a", "ja3_variant_count": 2216, "ja3_variants": [ "e6e3a5c9ade212f0570f44cf7909615a", "d3f3dca1bf206a578089783cf1c558c4", "2c53efef2d1a195a7012a2b8b04c55d5", "e6337ae64506948a744c9f1d60ca0f21", "a5524b6213e9f9f05e0b14c3b007074a", "d573bfbec385395f9f05605bc18a49f9", "00404949368806c0f80921554f79ee39", "b94b1975321ac2f22ec209b97a521547", "aa184b0918a44318c793b9cb9b9b8b15", "4bccc25637b35b60f1bdbe148095522e", "808ab60401e9877f28c9affa191b6d1e", "9bf795f8cbbffe8d398acf534dc61bf1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 210, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 106, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 219, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 110, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 218, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 212, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 219, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 115, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 186, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 219, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 206, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36": 6, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 UnveilPhishingML/1.0 (+https://sitereview.unveiltech.com/)": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 11, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.169 YaBrowser/24.7.8.169.00 SA/3 Safari/537.36": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 16, "quillbot.com": 34, "Go-http-client/2.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 5, "Mozilla/5.0 (X11; CrOS x86_64 16463.10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.199 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.121 YaBrowser/26.8.2.121.00 Safari/537.36": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.1.2 Safari/603.3.8": 1 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_7e8a14c5f0ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "7e8a14c5f0ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-43-5-23-10-18-17613-0-65281-16-65037-45-51-35-11-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 57, "first_seen": 1788442716, "last_seen": 1791282015, "transport": "t", "ja3_hash": "7ad105cd39efdf013685a28701173b6d", "ja3_variant_count": 57, "ja3_variants": [ "7ad105cd39efdf013685a28701173b6d", "c66ff606c73eb6ee5a0f1757ab796620", "15900bc55683fc8f4d7a95e120595bd3", "7dc29c74534840e624ca5d74dd1694bb", "8eed7f21acd4b896391ce1f025537c06", "a2e0e88582728057c6baad4545572626", "f6ccb38eaa00b0069338ddf9cf6f14ab", "91897d3b34b320f670670a78a927a5f9", "fd85a233c93fd8a81a6de5e2576e7320", "d6f46a16fde4b9ae041ed216c01e087a", "ab2f473a95c217e355c276e019b9a0cb", "8949f5617ede4f34d73e1d71ded0ea3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1795, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 501, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 109, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_8033754817fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "8033754817fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-0-17613-10-65281-27-18-35-23-13-43-16-45-11-65037-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 63, "first_seen": 1788649461, "last_seen": 1791308597, "transport": "t", "ja3_hash": "5f753c5c7f0f046aa5a768acd99bb8fb", "ja3_variant_count": 63, "ja3_variants": [ "5f753c5c7f0f046aa5a768acd99bb8fb", "030dba6bfff465937857ec88dfd49d29", "5029c46b81da69ad8f1a70d851502512", "42c97f12a876dacddf4dbe52e8f0edfa", "e4f1b107bebab99520dc5f3795a4133c", "ee819c23354d34dde414264bda1ce5f8", "77ab23575309dc02e44ad80de2657e72", "a547ff78acb339e1ebbbb7ffae6a74bc", "43ea0220db8eed99591306fbca9be7fa", "306e376bd6fb7ff01ff275c95b7e7a42", "c9cdfbf0a0c54b70e9baed05ae1318b8", "f2ffdd302e80a6f3dbfb1868b8236aff" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2264, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 424, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 17, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_8ddfe5c7e551", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "8ddfe5c7e551", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-4832-43-23-27-16-10-51-65037-17613-0-45-11-65281-5-13-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790083179, "last_seen": 1790255180, "transport": "t", "ja3_hash": "31f478ca40a9b275f682fdb37490c8bb", "ja3_variant_count": 2, "ja3_variants": [ "31f478ca40a9b275f682fdb37490c8bb", "44ededf45aa194d696cb18723e30a67f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_91599cc177a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "91599cc177a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-35-11-16-18-0-51-65281-17613-23-65037-43-10-13-27-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 64, "first_seen": 1788511532, "last_seen": 1791307952, "transport": "t", "ja3_hash": "79209c9bb749654c753c19fcff089d4f", "ja3_variant_count": 64, "ja3_variants": [ "79209c9bb749654c753c19fcff089d4f", "e5141f1be2f4a810beadc5475f4e883b", "1c90214ce74636ea398cdf0c4d6a7598", "5abb8765f0e9a6d556dfd9bd1cc1bfb4", "13d3fd98de829c911072e82856cd0542", "8479899053538f753e6a8cc8d76df494", "deb79b6664498e130c838c35c2bdca4b", "5a2b335ca752e55da7acff9b6b0dd01d", "0eef8a42ea35b2b91e4cea7bb6208ea2", "258ccc6706d7c3abb94d5199007b3115", "0c071cc9cd3f38c29a06eb83900631b4", "4694e37ef79266934fc113a0aa35dc7c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1087, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 901, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 45, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_979d9b415b61", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "979d9b415b61", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-65281-4832-45-10-43-27-65037-51-18-11-5-16-23-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788842710, "last_seen": 1788842710, "transport": "t", "ja3_hash": "a8a672f45796d5f98722a24c69ce7e96", "ja3_variant_count": 1, "ja3_variants": [ "a8a672f45796d5f98722a24c69ce7e96" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_98d29f222568", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "98d29f222568", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 452, "first_seen": 1787527281, "last_seen": 1791323255, "transport": "t", "ja3_hash": "020ee54457b3c1d5f5a5050b22bee1f3", "ja3_variant_count": 3, "ja3_variants": [ "020ee54457b3c1d5f5a5050b22bee1f3", "a55f6cb044839f48d371a56323ed22ef", "aa72e467ff1792b0ea62c1a6de2010d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 11, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 9, "Mozilla/5.0 (Android 16; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 69, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 41, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 20 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_9d19ce9ed155", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "9d19ce9ed155", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-17613-65037-45-10-27-16-5-0-65281-13-23-43-51-11-35,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 155, "first_seen": 1788459858, "last_seen": 1791361995, "transport": "t", "ja3_hash": "93d4945eaa349ff91788b7f7a9687ac5", "ja3_variant_count": 155, "ja3_variants": [ "93d4945eaa349ff91788b7f7a9687ac5", "8de10b00fd94bc01b4590627d9b7465c", "2bcd34a613ae0b831d4fe5c6da433552", "ae1787922e135bce6c1e514f489e3d13", "97d65ecc053891e5650cf8d2695cc620", "9239acaf79a0638d3f0470240fd83c78", "6fef1c682ddb66f9a3957de344c0c759", "56793652a9ab785bc1b850f055ce9f2f", "8d8a6acb02a3ff38c2af6d821a46eb08", "1a0388c745e30fff52b77c5b4ec8c808", "55aa3e7898839d0b8517c5518ebeb67c", "c1ef106d7db39488276ea3a4f336a2d9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 49, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 92, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 20, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 82, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 179, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 61, "PromptingBot/1.0.0": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 52, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 34, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 67, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_9ee06e8801fd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "9ee06e8801fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-43-17613-35-51-18-13-16-11-23-5-65037-45-0-27-65281-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 150, "first_seen": 1788459857, "last_seen": 1791361995, "transport": "t", "ja3_hash": "4c1630b63828f9d08163b1e23834e6c5", "ja3_variant_count": 150, "ja3_variants": [ "4c1630b63828f9d08163b1e23834e6c5", "29c197d6f744bbb598a42559339223e3", "9342c651ff9ecb7930d76fc84b5ec3b1", "1aaf6ebbf057e0dbde0c6e4495edf336", "b7255bb26a6f00345472ed613cf5cf70", "e1e8ad02de1e7f80f6bb8343ec86d3c8", "c639b02894546df2e26fb1ac5da8172d", "8e729d430f324f3b0503e77d4e98c0f0", "77462d4903703b03715b2c637b2819db", "60f759afe0cb4cda14cd0cd7f9e45d44", "6ef3ce92ee98791814ad9e1e197f0abb", "6e1c4ba84f5d123724e59945d71bdddd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 94, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 146, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 107, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 47, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 45, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 142, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 48, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 79, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_a816eaafa7a8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "a816eaafa7a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-23-10-51-65037-18-16-5-45-17613-43-27-35-11-13-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 244, "first_seen": 1788441666, "last_seen": 1791238636, "transport": "t", "ja3_hash": "5ec11e8b9a7498a50ff8e0b1e7451660", "ja3_variant_count": 244, "ja3_variants": [ "5ec11e8b9a7498a50ff8e0b1e7451660", "ef5f3f3237f91b6ab5446b6d5b04decb", "47b10aa6050d26058bf35664dc4411c8", "3f7c09fe7038353723f9a8d578bed681", "170a0079ff18fe9876fdaa88bac6748d", "797b7e1a3ac32c3a87ba9f5639c0da2d", "0c825912dad0af2eb357b5e7fc250616", "463f33eaa464987a270af4c4e8645e83", "41b9fee9a8c96d04201673714c5fdeac", "e1fb3667a24ca9ea2c2e7cd2e4f5de20", "d72428da088cbd86acb56ba2a1fccf12", "04996e2ce80f8507d7f859addeb835a7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 820, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 40, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 28, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 OPR/135.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 19 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_af8a2721cac7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "af8a2721cac7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,4832-11-10-43-23-51-0-65037-45-65281-17613-5-35-13-27-18-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788810230, "last_seen": 1788810230, "transport": "t", "ja3_hash": "9c57eed87a2e6028481e6d5436220f72", "ja3_variant_count": 1, "ja3_variants": [ "9c57eed87a2e6028481e6d5436220f72" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_b3338fd442b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "b3338fd442b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-13-45-18-35-17613-5-10-43-51-23-65037-11-16-0-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 164, "first_seen": 1788526288, "last_seen": 1791362029, "transport": "t", "ja3_hash": "c7b31bee24114bc50d44942367e1c3aa", "ja3_variant_count": 164, "ja3_variants": [ "c7b31bee24114bc50d44942367e1c3aa", "7cbf24a67ebfd1b6df15b5976aeaa093", "13262358eb13bd109d50b73530c2a4c2", "0cc4ac7d19bf92fe34a4d92b7374d432", "42570893d549cbeb490f2f884126ccbd", "6226d43fc74cf9c597afbd1c314d4940", "1f9196f44f3a32ef007f6101255eaa8f", "2b2bb9996524eb0f1e168da7ef7f4a0c", "6de280d8e952180a6e440045dde59148", "86f60c2d32bfc678c4e36428712aee00", "b58b140507a287bff1c391868123f119", "38e40ee4726ebbf10b1bed39c347b183" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 45, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 73, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 22, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 65, "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/154.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 65, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 74, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 42, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 74, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 55, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36": 148, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 21, "PromptingBot/1.0.0": 6 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_b502b52a3b6f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "b502b52a3b6f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-65037-13-5-35-65281-45-10-27-23-51-18-17613-0-16-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 143, "first_seen": 1788459813, "last_seen": 1791361977, "transport": "t", "ja3_hash": "f5981ba1ae1c389cc6401b3beeff217e", "ja3_variant_count": 143, "ja3_variants": [ "f5981ba1ae1c389cc6401b3beeff217e", "25c4592a6289b09b1a00ef82a83cb8aa", "4868c12ded4e9bf508e87bc11235926e", "e0a617ceb137f059ab916b9220709aa6", "03894fd6a51b57f25e64004979265d19", "78db79ed2917140ae1626649023911f1", "9e86e0faa9b4cafcd7402dc67a8f5d84", "1e746c6165286ba79a329e7aaebb1c7d", "36e17c87bf602f1e1a9b09df871f8044", "91f4758f5a2fdee8894d23cc32ee0b5e", "d974302904557a5278ddd25ddfa73212", "d54ae52fc554b701e3329dda4e782c54" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 265, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36": 23, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 35, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 113, "PromptingBot/1.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 109, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 51, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 10, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 45, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_b540d025f6c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "b540d025f6c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613-65281-10-27-35-5-23-43-13-18-11-65037-16-45-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16978, "first_seen": 1788444355, "last_seen": 1791360562, "transport": "t", "ja3_hash": "2d25c56381929cc91bc97631a0a46f58", "ja3_variant_count": 16967, "ja3_variants": [ "2d25c56381929cc91bc97631a0a46f58", "7a5f67aeeb40aacc98e2836775b9639c", "e81bb09ba5d2347b90eaefca1b295d84", "bb7d449e329136d84b305ace40252747", "e866ba43d26089890c36d79b5fa6cbd5", "ad0a5c8b43b593a80e3c45fb82f721cb", "d1a1d4f2b877a63617414b6d8dfd8803", "426b03446953320e205e28d04c1b6010", "c0d85f25887605ef73db36a3de20e116", "caf0e6a38892bf9f33e1b8a2a9c37ed5", "29bac9c2732d826fd33222213cc9250d", "8c777cc44a64de397124c8e4e4681e9e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 9263, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 9717, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 8614, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9225, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10132, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9923, "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 355, "Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 217, "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.5 Mobile/15A372 Safari/604.1": 472, "Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 226, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 493, "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 240, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 279, "Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 57, "Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/26.5 Mobile/14E304 Safari/602.1": 32, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3530.119 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/26.5 Mobile/19E241 Safari/602.1": 33, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.2730.35 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.6379.11 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3668.111 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_c14ab140e455", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "c14ab140e455", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-51764-43-0-18-27-16-17613-23-35-13-51-45-10-65037-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 163, "first_seen": 1788516134, "last_seen": 1791362030, "transport": "t", "ja3_hash": "1264e832825f13ff769a607719ac50f6", "ja3_variant_count": 163, "ja3_variants": [ "1264e832825f13ff769a607719ac50f6", "c4289bc57c243d6cb0d570f0b3de67d9", "153106961e82400141b0fb3af0c2dfd0", "e1e20a09644aad604ea64cefdf2505a3", "042966017e3b5d7590a4066db29b4800", "e018b75e4729e37c81780459b6a0aa1c", "9b724b6f2630dfe9d152f9a687e0e0a4", "5a479ca8507fa53090c5cd71f2e6cc2c", "ad2e145fb9403a29678a6e6d5fb06fc2", "e28fde26f8d96ecfdca2d52b92c546d1", "16a1d034a119ecc9a2698ef022b3ef1b", "a7aaf48e71511b024bc578da00a57b69" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 57, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 214, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 86, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 48, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 51, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 52, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 39, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 49, "Mozilla/5.0 (compatible; Qwantbot/1.0; +https://help.qwant.com/bot/)": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0": 5 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_c3bfe41e2aa7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "c3bfe41e2aa7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-45-11-0-35-5-16-17613-13-65281-51-23-65037-18-27-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 63, "first_seen": 1788806864, "last_seen": 1791311245, "transport": "t", "ja3_hash": "07b0a97b524fa549dfe2f0c8db46ce76", "ja3_variant_count": 63, "ja3_variants": [ "07b0a97b524fa549dfe2f0c8db46ce76", "1b2e4251013c542187fdcad23b764259", "24dd861cd3fdd62d78f17eab84538771", "58df71cb15cde0a7b88b6fc39e40a430", "29dd8b96a3474bc9faf6e675ebf06328", "6d8cec827dc239bf8de0151a58979337", "25ec2bbe34bfdc442aa72495b4c46884", "8e70c565842c153128b9d518b12cd9e8", "e40f24984faa593f8ee473ac7123c029", "fdc8cb7b249f2dae3fa0a41492671a52", "f66ae5caec2cdf5ad550162d57cf6539", "76845cc3417b602598690f4e4fa42fd3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 609, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2012, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 41, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 2, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_c80cf1d07396", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "c80cf1d07396", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-18-17613-10-65281-51-5-35-0-13-16-11-27-23-45-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 122, "first_seen": 1788450032, "last_seen": 1791354502, "transport": "t", "ja3_hash": "cde7ebb4cff14d3cdaa9a4f2b8925233", "ja3_variant_count": 121, "ja3_variants": [ "cde7ebb4cff14d3cdaa9a4f2b8925233", "f4c179676780888b22294d2e5d78f211", "52639beedcde3e71a5f75f40f9ba77a3", "1a0cc9823a3d51af911a499d8eec5b1a", "fc4e0fdc0a28589d899013ee7abc3311", "4503aaaee02f5490a3aab111bc344e77", "38305d8791e704367a8d588f93dc5af1", "f7665c9804556f11501c184b34c51406", "449fb9f34d6f0f9beba06391305c5a22", "545660490926a5263c872832f77e89df", "f601c551bf6c95e223024edc02a41d0d", "6a20cc4a706ae8f6ec409c0c04c36325" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 276, "Sogou web spider/4.0": 6, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 39, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 37 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_c92d569f1d01", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "c92d569f1d01", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-16-43-65281-0-27-45-23-11-18-51-5-17613-35-65037-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 150, "first_seen": 1788459232, "last_seen": 1791361861, "transport": "t", "ja3_hash": "6598a79eb3c86c8d1e9d0ab243ae6269", "ja3_variant_count": 150, "ja3_variants": [ "6598a79eb3c86c8d1e9d0ab243ae6269", "5102ca568154585c90a0ba9e1bd65591", "9dae3e9715e1b4e1d348e398859e6dd4", "6737658031d1b12e916744a24a48a531", "b2c3453531b1a2298cbf7645dea9f0a7", "d2151d4e90b84ea91edc7d5f052ea3d4", "294d051e87bb0e5f3b30af42a3ad65fe", "ede5c57506c946c4d5f8770f91de6712", "7750055a8cfc19a89931f65fcf8d6583", "0db943981c4d02d1cbf291bb7ea5554e", "44cce2aada15032ed134268390c628d3", "203b6b9eafe387b816b07e9461512b49" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 30, "PromptingBot/1.0.0": 26, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 84, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 35, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 42, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 65, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 38, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 108, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 17, "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 28, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 49, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_d0c3baafe37d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "d0c3baafe37d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-16-27-65281-35-18-0-23-65037-11-5-17613-51-45-13-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 171, "first_seen": 1788508344, "last_seen": 1791361865, "transport": "t", "ja3_hash": "d4d9abeca2a0b4f067a5e7e8c0ddfec6", "ja3_variant_count": 171, "ja3_variants": [ "d4d9abeca2a0b4f067a5e7e8c0ddfec6", "6bbf86a7ebec763a5abcf787a4385728", "c4d88364279b49e7d3c01a71600bc090", "9febaed352cefe53ec54b6b93ecad2f3", "d39760229ed16f8a5903e1a345830df5", "5afb7c2d64794723bfbd6c29bcd20e70", "771379aab45dbae8b0bac2857d22c428", "f688c44ab8f26ef123704483475bc03a", "c97f461e8a2e44f71f59b23fee6d6d93", "cd396da2b6c2ae8ef5c3256fcdf26ea0", "db3e397f91790cfb55d77a626e57f600", "08427544f982245e9191637bcb5d2301" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 45, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 139, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 110, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 72, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 79, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 35, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 37, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/144.0.7559.95 Mobile/15E148 Safari/604.1": 23, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 110, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 35, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1, "PromptingBot/1.0.0": 3 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_dd9efda7f7b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "dd9efda7f7b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-35-5-43-65281-51-45-17613-11-18-0-23-65037-16-27-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 55, "first_seen": 1788458533, "last_seen": 1791324210, "transport": "t", "ja3_hash": "063308e115112b262688cbfcf9777937", "ja3_variant_count": 55, "ja3_variants": [ "063308e115112b262688cbfcf9777937", "084c4ed0d77dbb2446040d854f91572d", "69db328e6dfeb79e15522fac1c3c609a", "3d1f650dd2359315804ec3544f33078b", "1ae88cfc0b596a6debd53baad1dfef0d", "12f38afad5c259673f5a0cc93cea9616", "e69031e9fdd55b0e0955ae64ca747304", "5dc8ee628b1ef6579d23aed66d55ad1b", "7d7daa34cec8ca6e70416c2cae76fd9b", "50aa50e2dae484dd191182ac648f7c23", "c9fc4c138017793e1bbff582b270e8c1", "db4b396d935f9d286ece1ebc429b6b99" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1206, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 100, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 74, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_deb8da781666", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "deb8da781666", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-51764-17613-45-10-43-11-13-18-65037-0-51-65281-35-16-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 157, "first_seen": 1788459228, "last_seen": 1791361977, "transport": "t", "ja3_hash": "3764d11264bd8c4e2e4c3862b6b03e57", "ja3_variant_count": 157, "ja3_variants": [ "3764d11264bd8c4e2e4c3862b6b03e57", "91ec3b369650fcdff1e84e727ce87b07", "b4e538e1848983d876d4a5fb1de39f72", "a568d5dc94a8699027b6aec370b30518", "5dbda7ce3c5990b16c3d655cfd264061", "a49e8ef0a0b5dbc3e1170f85632a894e", "44a1da092912f3f7dce9457562fe13da", "5c95b84cf7891cfa1fa4461deb79abc9", "aced3321e24a15956310a7ae149a003b", "5cf8bc578e4ed3c46f9c8670c7335790", "75983a52b0469476031fa00303d19ad2", "a649e09ddc6afbee83b2cc65cd5ab64a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 84, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 179, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 108, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 95, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 186, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 34, "DuckAssistBot/1.2; (+http://duckduckgo.com/duckassistbot.html)": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 15, "PromptingBot/1.0.0": 5 }, "ua_disagreement": true } }, { "hash": "t13d1517h2_8daaf6152771_e1e0c1594192", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "e1e0c1594192", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-35-43-18-23-51-13-10-27-65037-65281-5-17613-45-16-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 63, "first_seen": 1788911723, "last_seen": 1791309497, "transport": "t", "ja3_hash": "9cc97b8c1abe863a00f95ab161a37de8", "ja3_variant_count": 63, "ja3_variants": [ "9cc97b8c1abe863a00f95ab161a37de8", "f267804bed3eacc51e7ce23cee4413ad", "a7ece96ac11db1afd50a31933e79bf5f", "e3612c5c8f7289c404d66ef7f1a19319", "71bb585374222dde5c40e39ddaeaa74f", "09f2590e452e29610537b7a96d2ad738", "ab6af7677e9a218e3db5d914b1243255", "1473e6acbbb5937a570513af369ac240", "74b329bbb6d8274795781db27ca6dbc5", "10350fd7e8274bc8640d22f8ef1e772e", "a0e73e4f4bc588f784784517de0c1dbe", "ff54f970a194c578c906461b10b6e491" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 516, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 321, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1110, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_ff54581d4608", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "ff54581d4608", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-17613-51-13-43-10-18-23-65037-16-27-45-11-35-4832-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788810177, "last_seen": 1788810177, "transport": "t", "ja3_hash": "d83405a8617ba384caf1799560b433a7", "ja3_variant_count": 1, "ja3_variants": [ "d83405a8617ba384caf1799560b433a7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_16591a004eb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "16591a004eb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-65037-5-11-35-23-13-10-45-65281-0-17613-27-16-43-51764-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 109, "first_seen": 1788559995, "last_seen": 1791360881, "transport": "t", "ja3_hash": "5b93fc9990a44eab2d096de787e042d3", "ja3_variant_count": 109, "ja3_variants": [ "5b93fc9990a44eab2d096de787e042d3", "b3422e5744a0d885f16a4e6eabdbf1d7", "5c650003b3a4869a0b8483d595cc19bd", "63e947b76a4eb8681f798762af159b54", "a4bf38a370543cc9ed5bf2a07579fc4e", "4063a7f9af09354842dccdfe93b2d64d", "d939e6b4c6ff037635f600ac58e709a0", "4b19f875c21b78fcd336537ff52256bd", "4a4e723ec9225dde3c77d97f4d462ba0", "1ac37a6896553c9c1bb8023022b8806a", "2ecc8e8591693ab4993c5286f521f5d3", "5393dce271c864ab510f78f15c910313" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 419, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 63, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 63, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 57, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_18b64242ae5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "18b64242ae5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-23-11-13-17613-43-27-51-35-16-10-5-65037-51764-45-65281-4832,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788842710, "last_seen": 1791250691, "transport": "t", "ja3_hash": "1c9c5f11bb62c5eb7f04791bee18cd80", "ja3_variant_count": 14, "ja3_variants": [ "1c9c5f11bb62c5eb7f04791bee18cd80", "a714a3084c13b5c93438c3ab8e8c5b26", "152ec46d561cae06f4c11632b24249cd", "53b88a5f430e3a41fbc4c360acea98ba", "5d11b1ca53b3dfc09dd4c93960f0e284", "2e4076d294376bc053801c14ac014645", "12d0b1d3393d85317870448f72af2842", "9fbcdd00596d7beabef91e5d562ab70b", "ed81f44a15d0ac6e50b9f1bff1d35da3", "3148f8bb212258a62e04fc1e4bc861b9", "09584398e3a534f9ea731849558f4122", "93e561230a02188d9c4ec1f1bc4f20af" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_20e599e072a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "20e599e072a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-17613-18-51764-45-27-51-16-11-10-65037-65281-5-0-13-35-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 97, "first_seen": 1788508425, "last_seen": 1791360161, "transport": "t", "ja3_hash": "6c0c754a5dfbbbc2604131da55a70467", "ja3_variant_count": 97, "ja3_variants": [ "6c0c754a5dfbbbc2604131da55a70467", "6d65052c0967f9b886bc608506918359", "a7aa299c4ece09780e39174b0c8e8a6d", "19ea9daedf9a19da8438f25937e5dd5c", "9a2202bd9c3a380721cb80b3126a4e5f", "d7fab8e77da50a5e797f695b73a9ca73", "ebfcab967b07417a80f2114edd483d3c", "1ece77f21f8a2a2624519cbfa831ebe4", "21bac0d99468202ec51adaea964b8a03", "cdafee4160f99a5514afeb7f2b5e8701", "4c1dfda237f3bb85af75b596211a1255", "53ebac13a68e496a914a9bd0a49294cf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 562, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 29 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_353ed13deaf5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "353ed13deaf5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-43-11-35-4832-16-18-27-13-51-0-65281-10-17613-23-45-5-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1788681327, "last_seen": 1790576930, "transport": "t", "ja3_hash": "26d756f87c3ebe990e715cc7e1445ae1", "ja3_variant_count": 9, "ja3_variants": [ "26d756f87c3ebe990e715cc7e1445ae1", "1c647d82a567123900fd6aa66ab9a435", "0f66221c199f05e4ead129707e50f96c", "b8d337e61b83797f01e809be0dcf6c5a", "937f2012f0bf12d5fbb753e7f1035e94", "258d9d8e83dce2cd14dca857cc5221f5", "7aeb901a95e912b9749d48a9fa4cd4c6", "48ca0545716df8bd9235dafcef7ff90b", "2c38e38be4d8879cd4326605fd57315e" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_3c770798d5f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "3c770798d5f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-43-65037-23-45-35-65281-51764-4832-18-10-17613-16-5-51-13-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788653259, "last_seen": 1791250691, "transport": "t", "ja3_hash": "8701f00af686814010251c166aa46ed5", "ja3_variant_count": 8, "ja3_variants": [ "8701f00af686814010251c166aa46ed5", "917de3e31c90ede057b1d875d75351c1", "8aceacc5f62776dc12438fe4a611993b", "54ccb47ca5fcf71223b0f78ea9ac0112", "2ae48ad5131a2406825e996dc17001f7", "bf1972e30d4953d26b8b0163ca7c7826", "0dc4d49f5a1fdd5d8593953c72020b95", "14037dc724630a571c4e52e185f44f00" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_3fa279c3c235", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "3fa279c3c235", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-43-18-51-11-51764-45-0-23-35-10-27-17613-65037-65281-13-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 116, "first_seen": 1788508414, "last_seen": 1791362621, "transport": "t", "ja3_hash": "fafdfd607aed80b7d72552d0bfe373bf", "ja3_variant_count": 116, "ja3_variants": [ "fafdfd607aed80b7d72552d0bfe373bf", "4b090d6787220550bf37ec0dde80b52b", "68a2c2bc5ecca45fd0acddd261e583a4", "01fff4cc9bb9f2919b605c71684e346a", "568699810b9da33e2e64efc4e8800a1a", "5d8759d48a236e0847064b37171859b1", "b65cdf6366a7ccce2621a39a973d64eb", "f740616f9fb05abb3871d12e070cc3e5", "b538e8aa7631827320bc147c948761b5", "8f1487f92636dae1f86a3814d05213e8", "afe616b6afe2bf01a6a11ead174c894f", "dcbc23195d2dc4cacc6abad5b25accb0" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 92, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 487, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 98, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 9, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_4142db4e03a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "4142db4e03a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-10-65037-4832-11-43-35-51764-16-45-18-13-5-23-0-65281-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788810238, "last_seen": 1790979359, "transport": "t", "ja3_hash": "cb1807fdcd33053bb04c2f0668fa4b22", "ja3_variant_count": 11, "ja3_variants": [ "cb1807fdcd33053bb04c2f0668fa4b22", "7d4a8fe0024dbb54e984454a4dca7953", "4481ee64687ae47e3a4369eb27360a48", "b98f33681a3ac6815a0ab054f85b2bae", "95e76af1ccce049b3712978a1c63eefd", "dea4a62c6e02758bc13d844a250c93d4", "ea3debb1cb04f7ac57088822cef4627c", "256e4ba505e87a01f53f8487e3b1672e", "ab8a6f73a4971f9c0682d0ef0aaf0344", "3f725e02f2e7cdcd9f31e999d609334d", "00d8b06af465686dc650032640edf726" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 76 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_541d4068e22f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "541d4068e22f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-11-65281-51-18-10-5-35-17613-65037-43-45-51764-0-16-27-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 99, "first_seen": 1788550318, "last_seen": 1791360762, "transport": "t", "ja3_hash": "6e97dd7b533255bc73bcab89e93058fc", "ja3_variant_count": 99, "ja3_variants": [ "6e97dd7b533255bc73bcab89e93058fc", "7aad8bb7a557981daf7f79c5c716396b", "e4ae4b571d9907db18d76977255e68be", "91a88769bc9bd3da1c3013c28a6503e6", "99c1340ec160396a72354f67d8a6cb38", "11e9965c5cbdb7abff994cb0ada1cc9f", "8cf893368a30bdc1defc4f3f36274c17", "c270c70183f000f60be6fc2f3f994a1f", "d109b3a6e8aeb8a42639e7c1c63734bb", "dd0723af4b729982e0efb2abc0715219", "c960503d1ae222a5430c652135efbb21", "0dbef2c16db3e9e96fedadf4b0c96717" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 444, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 25, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 42, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_5568d14ab310", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "5568d14ab310", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-45-51764-4832-65281-18-43-65037-13-23-27-35-11-51-10-5-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788885578, "last_seen": 1790255187, "transport": "t", "ja3_hash": "66e3ae6887c12bf965d1ae382c19abcc", "ja3_variant_count": 5, "ja3_variants": [ "66e3ae6887c12bf965d1ae382c19abcc", "dc0931d5a96fa24d80b796f71e5517c2", "425775da70c492d5c3eb5903ab180d76", "cf12298ea25972e042340a684f871de2", "59e6c5c2abd51d2d7ccd185cdaa31608" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 13, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 25 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_5acfb5ee7fe3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "5acfb5ee7fe3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-0-17613-10-35-27-45-11-23-13-16-51-65281-5-18-51764-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 102, "first_seen": 1788459861, "last_seen": 1791363341, "transport": "t", "ja3_hash": "1de59ccdf0a164ea9c9523600a11d7a9", "ja3_variant_count": 102, "ja3_variants": [ "1de59ccdf0a164ea9c9523600a11d7a9", "4532441fae4af0ca37d7bd4fc1a99448", "8357644199ab9db1b3dcf1f02fc167eb", "c1a77898f0523aa7fd0ad4052f28db26", "6559aa987a2673df33f436b429eac50a", "67d4084e38fa5da996e5150fa7e781c4", "72b2620afbea3b780204219e7c919503", "b92e3954ac7725040d77794fa0338eb8", "b0b280f23001851d2a52d04001d4e440", "9c5452992c71d2a4eddc21c0c0b0e443", "ec06a979ea8b6182c68922461cd14908", "c496677bcd1302d3d6290885bd4ec890" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 178, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 56, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 86, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_5b1e49e67150", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "5b1e49e67150", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-51764-13-35-65037-17613-10-23-18-16-11-45-27-5-0-51-4832,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1788681327, "last_seen": 1790979356, "transport": "t", "ja3_hash": "432a3c0b9e6d6361b7c672331d34bb1a", "ja3_variant_count": 12, "ja3_variants": [ "432a3c0b9e6d6361b7c672331d34bb1a", "129c82d01dd72b12b887901d86d01dc3", "1e2c57a7d9f43ddb8bb0838b95eb58d5", "5b2cd149b80faabd9e4336c95f82388d", "8598725cab8754280b55352c545cbc25", "c2aab191f45c58ed7d30f4e6d7bf9724", "64d292f1affa6e5b489ce4772b7772a0", "41a8d217053bfa5fe70031eafcc15bdc", "04f4b9f8f1297bb4c1548cff4a804a94", "43bec6b356d6e00dea28cb2e6407d3f3", "525a0eef46765a0bc4cd4ba8d07ae144", "0041999367f3084a4142f37ecc4a60d4" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_5d320455916e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "5d320455916e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-51764-65281-18-45-17613-10-43-35-0-23-11-16-13-51-27-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 103, "first_seen": 1788505876, "last_seen": 1791363221, "transport": "t", "ja3_hash": "a04bb7e64ea5b7092fb5ba80a511cc38", "ja3_variant_count": 103, "ja3_variants": [ "a04bb7e64ea5b7092fb5ba80a511cc38", "e6d01067356fe6e963df128cd5dd2233", "966bbe7499f4877b9d82a26234886242", "b48f0296071aab8513aba13d5fcfa212", "24459992ba2e89de51a2629c4aacbf80", "63b7ba3937e6009f8574843b0b3959c4", "dce6467d965d2d6efe9eb1b85ccfdcbf", "d15e51de376ec213d6b38864f507e119", "311a2664c7b93a2b62236279e4c5a3cf", "66032767b2c9f62175b23afc1da3fdf4", "28133386d9561dbc26d72b2fb97ba60d", "62c9eb5029fe927d4e8020c3e5a1322d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 590, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 50, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_6275101b5ac4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "6275101b5ac4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-51-27-4832-13-65037-16-51764-65281-17613-45-11-10-35-43-0-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1788842716, "last_seen": 1791250690, "transport": "t", "ja3_hash": "fbf38276b3b188badc21c2666fe07fa2", "ja3_variant_count": 6, "ja3_variants": [ "fbf38276b3b188badc21c2666fe07fa2", "e11eafd1dccfa7f86475237f3df6b2e4", "a0b6e0a8a627c86743e0a4aecdacb982", "df6891de589e44c9289aaa12d25b4f41", "07c8f5c55bb1f34ef172e9e9c20e0f1e", "95a9a52c0eb5b8867504af3babf1f374" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 25 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_636efb5f59e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "636efb5f59e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-23-51764-4832-65281-10-27-17613-65037-0-45-5-16-18-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788810226, "last_seen": 1790979359, "transport": "t", "ja3_hash": "5b66a9cfe4182d3a4c18511c4dfdb562", "ja3_variant_count": 10, "ja3_variants": [ "5b66a9cfe4182d3a4c18511c4dfdb562", "8c6a95e20c9a2f885c6f49208d15b3f7", "d20a9fb1a0186a891262b48599885bdd", "e2ab05873b7e88c17b5953b73098ebed", "38511ec4fa3a9afb45b4774e7de2b9e4", "11cb293871582f64eb36255e94baf861", "a53268d28161c2984225e606712ad455", "f02c6fd272c7d3f18c09e33bb586b32f", "fc2e52b58138b2d70b1e72c055c501ca", "4f6b8d9957cffacbe5a04457c6bb7664" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 62, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_6c9755ee8c21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "6c9755ee8c21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-51-18-17613-10-35-45-65037-23-5-51764-11-65281-4832-43-0-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788681323, "last_seen": 1790979357, "transport": "t", "ja3_hash": "18be4be78f190243cfa673dfeb39f286", "ja3_variant_count": 10, "ja3_variants": [ "18be4be78f190243cfa673dfeb39f286", "551216b844b79733b4e7d3b568dbd0ae", "542d6f5eef416fbb9f614b2f14e376a8", "910286d74609ad166a2e1ad61d5b22dc", "5f8a08a978f03d055524e7c7b996cf31", "8116c5000f1c62be738ff7e8c588f995", "e49bde61803c0f3e8b28c4513b1c3a89", "b5bf093679300f6baca87bae148ae94b", "292902e09606d62384aed20751b072e4", "a89091d9703db5e5b2b71318d4e09696" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 15, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_7475c8b4a612", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "7475c8b4a612", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-17613-27-65281-51764-43-45-11-10-23-35-65037-5-0-18-16-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 91, "first_seen": 1788556619, "last_seen": 1791361121, "transport": "t", "ja3_hash": "912d1953b0dacd6e877e6a999431f909", "ja3_variant_count": 91, "ja3_variants": [ "912d1953b0dacd6e877e6a999431f909", "09e65288590061e535f3741fb76bc107", "96b2ee36c2fd7fe4def03e1d031c3458", "be3229a4b57766a28a34682eb605a571", "d85a55bfa1e50129899f44925842ef0e", "1299616acaefbf7c4e9b6b628bb6021e", "bafd78293c6c07099b2a21935ec9e515", "dc52b1fff712a7580942ef39ebe9a03b", "768176fd8590b0a5540f450a167e1d5f", "43f44624393637d0705d50af76240d02", "d084e71bd8afdf2e0e7db7c3991b1f2e", "917c49bbda4599e2dbf17a2ce424ed41" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 432, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 217, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 90, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_85db8068b50c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "85db8068b50c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-23-43-10-13-5-35-65037-11-45-51-51764-18-65281-16-17613-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 114, "first_seen": 1788550298, "last_seen": 1791360401, "transport": "t", "ja3_hash": "5f13ae1a88c89542a37be513640b1adb", "ja3_variant_count": 114, "ja3_variants": [ "5f13ae1a88c89542a37be513640b1adb", "374a7f1476370161faaea57291fe2920", "9b93aac0785fdd60e7c35f0f420bd0ab", "adeac0b3227d0d10c8ae6a144aa9bd73", "1fb11a76f5de5d26406e3d8ce4faf212", "8f10286ac671c79e18eeef7a482b65f6", "c739142fde2fb9d4aaa643faeb097054", "9fa63114fbe0c94c7f8b382d81b5075a", "70389c2e45ffd4c33378639196024ba2", "f74affec152fbcb451aa3da629e98d2f", "832705cf0691c1d46b56c0ca5314274c", "00f4e0fdccd795cd76df8b47a937b8f2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 353, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 145, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 83, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 34, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 11 }, "ua_disagreement": true } }, { "hash": "t13d1518h2_8daaf6152771_8725fc830744", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "8725fc830744", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-51-13-27-5-0-10-23-43-11-17613-18-65281-35-45-65037-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 106, "first_seen": 1788459867, "last_seen": 1791361901, "transport": "t", "ja3_hash": "905f94391ac98a96eeae339d5564547b", "ja3_variant_count": 106, "ja3_variants": [ "905f94391ac98a96eeae339d5564547b", "5f580f7dcf1a7b889d873b5b8fff764e", "15c427682c4813e1cd2336589efb0df0", "9dc0a21cf666b5ab3dc84efe7ff159e5", "bec972a5ec414850bb305c8d3e4b0f76", "0473c68087445b08869fc9865f4c16d8", "e650d1c8dee61b1ec058043f9613ddd6", "4ec9b8506f9fe94079c3451d43dfc3dd", "f1d4e2ceb1409362fe4f530eb186cc65", "bf5952a6aba9986897eda086003d527c", "b28a2183c8c65a9c2fac0b17ec5345f9", "0b898d3f8679a434ea187875dd072ed9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 189, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 57, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 157, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 29, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_8b83ee4b167c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "8b83ee4b167c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-16-23-10-35-13-51-0-27-43-65037-51764-5-18-45-4832-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1788681325, "last_seen": 1790582191, "transport": "t", "ja3_hash": "c912025933af55f0e944bb3a3e183888", "ja3_variant_count": 7, "ja3_variants": [ "c912025933af55f0e944bb3a3e183888", "00464094d2465d3ec4f5824541100283", "5c0345bc569926a9a41895302ffe4c4e", "f75b014dd264fe7ff7ef1d0f242007e6", "58dfe4823a07c6fcf7b6cdbd7500a374", "f454be1620a02218cd6e2acc23767085", "123b5c19f312c9b50d40881d7a2c2b2a" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 36 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_8cebf4ce2327", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "8cebf4ce2327", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-23-65037-27-11-16-43-18-10-13-51764-5-65281-4832-35-17613-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788681325, "last_seen": 1791250691, "transport": "t", "ja3_hash": "2c7c7bac1719c401be6953d14cf4a3c3", "ja3_variant_count": 14, "ja3_variants": [ "2c7c7bac1719c401be6953d14cf4a3c3", "aeff326ddd6cd19785d0d480852686dc", "44ffce2d8aac631d3ed21e42f2b52cd6", "3968877e89e88b437f6cae6460d171ff", "dc06bdf3994e95f194f225ba71295620", "c26cd6c6ec54af1da51de2141088f775", "b011c2309176db3f3b357ca662ed43a7", "f353c74ffce864fbcb56bb99e50fd33f", "cac77217ba0bcd9b88af022e54df52c3", "882a14bbdb1f5af899a1ff47889aec43", "ded4e79f3c9dd727e08d4fb4fe87bd7b", "da3586901e6582c011c42dd1069b6e8b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 18, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_92da371f693a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "92da371f693a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-13-18-51764-51-0-5-16-17613-65037-35-45-43-11-10-23-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 119, "first_seen": 1788550337, "last_seen": 1791362021, "transport": "t", "ja3_hash": "9ae5510e25889f36f8898e55301edad5", "ja3_variant_count": 119, "ja3_variants": [ "9ae5510e25889f36f8898e55301edad5", "4ac390b0163a85cf3e3a46f2d95e529f", "de83003130b8656ebdc43ed1dcf28154", "52f6b40e76048bcfc26177a0b0c774de", "e204287bf3191fea40d7f113e6147da0", "9c7baed005d2e6444a4e7f6c8749499e", "5493a51df2e83ba9012c647ed58a9a40", "e7cb0463cd7af434ccb9953b081d5790", "13453f15d2f29102eb5f0f51f0d69e43", "e3a2e9b8127d59dc2377cf69c14c396e", "84f97b80d25382e96f5bdfe00df341fb", "fb3f83bee086d5be6e10fbaf2edb0021" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 516, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 39, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 63, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_94861d7492ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "94861d7492ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-23-35-65037-10-43-13-11-51764-18-65281-5-16-51-0-17613-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 97, "first_seen": 1788554566, "last_seen": 1791363221, "transport": "t", "ja3_hash": "5faf5e50e8c98387fe8acf803a677a4f", "ja3_variant_count": 97, "ja3_variants": [ "5faf5e50e8c98387fe8acf803a677a4f", "4ee01d0c452cb1a36e398619357bd268", "a2799e34da8825b56bd7610e0e91282e", "aa9a50915c3077eff3f7035e4aeea115", "814ab0ac571b781937da1b9caef0b82b", "805cb128685d95fbbdf31f0748a46962", "bbcf6e143adf7421fa64d9c79727ed3c", "bfdfbce9d174309af06667aeb997de35", "780773c06b64aa03b3dd5bdfaacf1c0e", "7d64f4a5a56c220d5ba18fabf21fd75c", "4c626944eeead6ae4fed1922c217ac18", "72b578022127085eb49b406187c45fb2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 564, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 51, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 32, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_a83e75488472", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "a83e75488472", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-10-0-13-65037-27-35-11-5-17613-43-18-51764-45-16-65281-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 96, "first_seen": 1788573834, "last_seen": 1791362741, "transport": "t", "ja3_hash": "8490ce5f739e293b89ccdb54c2cbbf29", "ja3_variant_count": 96, "ja3_variants": [ "8490ce5f739e293b89ccdb54c2cbbf29", "4262484e48a8c672040ab0dfa114249c", "28ed3d433cffba27f7baa8014eb35395", "d0cd006cb5cd7dace57ff682b3a2f234", "4f61141414c7f87c8e10946cd810bf85", "28b7665598d397910f48c4967149963e", "5c5218e476d11db1d515e34c50a8e247", "678c980afc1cc01f5af18ea31aef4e82", "3dbe5e4b557dc952bf6ac40c69d622e5", "9d92e83522ab7c304cee3fbc5c53415e", "5586d67417406045ae881d043753176e", "0c37345a0721b0cb8ac92adfa2158246" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 384, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 78, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 61, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_b1777264716f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "b1777264716f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-10-11-0-27-65037-13-23-16-43-45-4832-5-35-51-17613-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788575657, "last_seen": 1788725820, "transport": "t", "ja3_hash": "a82d84c61cabe2ffed1e9a2936979fbf", "ja3_variant_count": 3, "ja3_variants": [ "a82d84c61cabe2ffed1e9a2936979fbf", "addeae62dab0c4b6dca5cd67b6d74ded", "203a95d7ac67477072d9ff3a8c60abb6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_b978bdcc2607", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "b978bdcc2607", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-23-11-5-35-43-4832-51-16-45-17613-65281-0-18-51764-65037-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788842779, "last_seen": 1790972039, "transport": "t", "ja3_hash": "fa42236149d70281bb93ed3ce9565eff", "ja3_variant_count": 10, "ja3_variants": [ "fa42236149d70281bb93ed3ce9565eff", "17e97a1c9aa9f118dc7bc56963a0f697", "e43b3a5e78aec9c2f218d1ab1a55f24d", "266b8f2e021430f57293ab4dd5bbce79", "48d5605cc31a4307ed17bd794b04e821", "704b74a92e4050078dcc9bb94ee14b72", "f1ca566936178f5fed0e63adf732a065", "e0ac7227bac2892b324dbc6d8757d4d4", "9bb88be60886ea4983e9e4f1e3bc91d6", "1b3344c51e9c7e1f839b71b7ef7cb05b" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 217, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_b97b09fa7adb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "b97b09fa7adb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-65281-16-45-35-23-10-51-43-0-5-13-27-17613-11-51764-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 102, "first_seen": 1788550301, "last_seen": 1791359681, "transport": "t", "ja3_hash": "5f037b5de71fe2574461ff9af7339349", "ja3_variant_count": 102, "ja3_variants": [ "5f037b5de71fe2574461ff9af7339349", "b0b16d6052166b6ce84fb54259cda890", "3dabab7b148fc5d4735b58b08d7b8a34", "626dbba3dd253aa1ef2b59c2364d9400", "5f3bd69475c2626c08f0d095d425aa6b", "79bcfc9147525f639beb917db181a010", "da3b20adad1dc45f0d18bd5fc74f1d00", "c83f94ea53b3dff50de82d822c2cdb07", "65eba681ec3881c7a65572280266cfd9", "f48dae097b56746a6c39fa3e88436677", "94748bc3df4540bab4afc151c9908723", "81a7fedd11d9e45637bb7d5c2ded84d3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 408, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 107, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 65, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 57, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 67, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_c23320c3fa2a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "c23320c3fa2a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-13-65281-51764-43-23-5-51-65037-16-0-35-10-17613-45-11-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 97, "first_seen": 1788552987, "last_seen": 1791362021, "transport": "t", "ja3_hash": "c9b64ae06423307f0017b69edb374497", "ja3_variant_count": 97, "ja3_variants": [ "c9b64ae06423307f0017b69edb374497", "4632486ed04dae70407264b72eba7569", "e4e0ece70f4d9a3e1da141de07196cd9", "e96f52ef989e45e067555f6e5802ae23", "d4f07d2c424e56beedb78e21c4c758be", "ff6c947bd736579bbc71416204947ced", "4f7e61d9d88f4679a72464e085f88869", "d82ff4f3bf531ee7380829ad60f38b31", "3502c12cc4dd48806151e47cd4ac6e39", "9bdf4d172d02ae99c99fe57cc5931a52", "7f16df79c6f744fcc6060d64181d4e51", "c2b38071b71dcd44ff6d97bfe29cec17" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 352, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 57, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 98, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0": 1 }, "ua_disagreement": true } }, { "hash": "t13d1518h2_8daaf6152771_d5f01608aba7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "d5f01608aba7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51764-4832-5-23-65281-43-18-13-45-10-35-65037-0-51-17613-27-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1788810233, "last_seen": 1790972039, "transport": "t", "ja3_hash": "d0c26a125fec08c377555ecd854d9dfe", "ja3_variant_count": 9, "ja3_variants": [ "d0c26a125fec08c377555ecd854d9dfe", "a195f6c1ffd2ddfde83e9c2066db7bb0", "ab5d041aa7fefaa61ebae6302cd87e24", "da3bdcf4652f9cfdc3f33510a7da32ca", "8a9c7bc379385d6e1a28ba0d11a65cd2", "22c2fc48d865e5078909295746b7efbc", "6f484b95c00a5a77c078f57a6d995c06", "934104360ddb708da4c28e3a49b9b9fa", "4c9f33a4ebe3ad8d9ceefe302a299324" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_e051bf92a81a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "e051bf92a81a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-18-13-45-51-43-4832-51764-10-65281-11-16-65037-5-27-35-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788910940, "last_seen": 1791250691, "transport": "t", "ja3_hash": "a68af924926dfa9046159acddb29bd08", "ja3_variant_count": 5, "ja3_variants": [ "a68af924926dfa9046159acddb29bd08", "89ec578ee272d5469a9b4520f8ab53a2", "7be96c0fe60f54cb0a885a13cadb6849", "fa49faafa6608ace39bcf4af63a84376", "a93777a152a46155fcaee434f62aaa98" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_e58fcb275dc7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "e58fcb275dc7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-35-17613-27-23-43-16-10-13-5-11-18-65037-0-51-65281-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 103, "first_seen": 1788459869, "last_seen": 1791362501, "transport": "t", "ja3_hash": "4cccc3b436566a1f3f147bfbd095734a", "ja3_variant_count": 103, "ja3_variants": [ "4cccc3b436566a1f3f147bfbd095734a", "eb9713c75ad25fe0a070dee38728000e", "07e226ae69ad91388bdec5bed3e2c3c8", "46e9763f33db3c9c3868dcf98fa56cf1", "30073b969926e70220ab264d0699e450", "64c2c175dd85ee219d228579f7a23750", "c7ee989a790fec59a7cdff0e96ef9178", "049815a1b519f1451d9994818b36c95b", "e4979096c1928322d656593835d07bc1", "aaad1a2bee7099e3ecd7bb9eb577fcde", "5f8e8ad972400b10024242d893e51006", "3a000453781c0394c7aa41cd92d2028c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 420, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 52, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 66, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_f242d6c68ddd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "f242d6c68ddd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-27-10-0-51764-13-45-23-16-43-51-11-65281-35-5-65037-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 96, "first_seen": 1788459872, "last_seen": 1791358961, "transport": "t", "ja3_hash": "7c11e70b1affd2119d9ad4274993c3dc", "ja3_variant_count": 96, "ja3_variants": [ "7c11e70b1affd2119d9ad4274993c3dc", "ea38109768edced20e9290fc290b7d2e", "746668a483f6f717c1dc199e5e34c5fa", "8be062f23150fb7ee8530ab3a7c68437", "6d27eaecc6ddd4960a90d93836536b21", "a3251c0cd1a48eda9e49ae6b23b76b44", "ffe1707898b45b41c0523fec45ba292e", "d4c931c37f78c43c629de9a123a92308", "45e889ac028fd0181fa601367b32926e", "f729f815a70557f78703b8d8087b1d14", "de8d82b818e9289ebe95d325d00b3831", "a4c8655753c1f88ad95220dc4cef939b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 221, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 84, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 35 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_f45502ff2921", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "f45502ff2921", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-4832-35-51764-5-10-23-45-27-43-17613-11-65037-16-0-18-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1788910942, "last_seen": 1791250691, "transport": "t", "ja3_hash": "5318e7c333a575f4d92cae279b6e2680", "ja3_variant_count": 7, "ja3_variants": [ "5318e7c333a575f4d92cae279b6e2680", "2014de2734b5d0801d5c5601a6eab170", "2657bd3307b448ceab7ddc1a981e8ee7", "77a403ea6b94f8a01259470574f6b873", "63f0fb4b59e5349e7364b7c315fb270a", "04b62c6c2e9a21d4572f6933596817c7", "bb77393d0dc2d4298725f478dbfedfe2" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_f985745adfa6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "f985745adfa6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-65281-27-65037-16-45-0-5-11-51-18-35-10-4832-17613-13-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788810233, "last_seen": 1790582191, "transport": "t", "ja3_hash": "5bf2574e127d8503b41cd08f7dd5610d", "ja3_variant_count": 12, "ja3_variants": [ "5bf2574e127d8503b41cd08f7dd5610d", "2d9e836248d2167321052af1e531e4c8", "8be59fa8673768ef30ae87e180120878", "19ac1040b9939c9669ad57bd9edbde5e", "f7d57cec6817539993b05151575e12c9", "c288143ed4ada1f41a1483c467a3d525", "24886e85bdb84246ceeb9b33ef08c907", "fc8734590406a0cf5b1173a8dfaccb8d", "97e49679522d0bdbade93f007720c251", "4fe0aec69f38994b11def1ad9cac89f5", "f3f784c12531e6bcbe0adc9d1ffec189", "f5c74c076e47c5b9f84afd1555ff1c46" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1519h2_8daaf6152771_184efcf4d8f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1519h2", "b": "8daaf6152771", "c": "184efcf4d8f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 19, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-51764-27-5-13-35-43-4832-51-10-18-65281-16-17613-0-11-45-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790095067, "last_seen": 1790095067, "transport": "t", "ja3_hash": "99a2d4662ad2c4ceeb3f86b62855c3f9", "ja3_variant_count": 1, "ja3_variants": [ "99a2d4662ad2c4ceeb3f86b62855c3f9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1519h2_8daaf6152771_8c8d81a5e528", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1519h2", "b": "8daaf6152771", "c": "8c8d81a5e528", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 19, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-5-10-4832-27-0-45-35-23-65037-16-65281-13-51764-18-51-43-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788681335, "last_seen": 1788681335, "transport": "t", "ja3_hash": "b8a1efb795b81963adb5e406dc99a6bb", "ja3_variant_count": 1, "ja3_variants": [ "b8a1efb795b81963adb5e406dc99a6bb" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1519h2_8daaf6152771_bd248ed37839", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1519h2", "b": "8daaf6152771", "c": "bd248ed37839", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 19, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51764-51-17613-27-10-43-16-0-18-4832-11-13-23-45-65281-65037-35-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788681333, "last_seen": 1790351021, "transport": "t", "ja3_hash": "f4a44e1309f7eefb16de204d914252b8", "ja3_variant_count": 2, "ja3_variants": [ "f4a44e1309f7eefb16de204d914252b8", "fda68643317bb06b696a80ee0feb97a3" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; HubSpot Crawler; +https://www.hubspot.com) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1610h2_926abbf9e651_b0ef02ef599f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1610h2", "b": "926abbf9e651", "c": "b0ef02ef599f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49200-49195-49199-157-156-49162-49172-49161-49171-53-47-255,0-11-10-16-23-13-43-45-51-21,23-24-25-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789575154, "last_seen": 1790175862, "transport": "t", "ja3_hash": "2a794baa93aba5904b026743a3b1d665", "ja3_variant_count": 1, "ja3_variants": [ "2a794baa93aba5904b026743a3b1d665" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Safari/605.1.15": 68, "com.apple.WebKit.Networking/20624.2.5.18.3 Network/4277.140.33.703.1 macOS/15.7.9": 10 }, "ua_disagreement": false } }, { "hash": "t13d161100_1711a4c0508c_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d161100", "b": "1711a4c0508c", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789012880, "last_seen": 1789012884, "transport": "t", "ja3_hash": "e4fcd81135fae195754d680b3dac7566", "ja3_variant_count": 1, "ja3_variants": [ "e4fcd81135fae195754d680b3dac7566" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1611h2_1711a4c0508c_d180211ea38a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1611h2", "b": "1711a4c0508c", "c": "d180211ea38a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-255,0-11-10-35-5-16-23-13-43-45-51,29-23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 30, "first_seen": 1788299253, "last_seen": 1790875026, "transport": "t", "ja3_hash": "32daeeceb3400621714e983e136c78f0", "ja3_variant_count": 2, "ja3_variants": [ "32daeeceb3400621714e983e136c78f0", "0e7a32605931ec79d5fc2e9eb7e0f0f0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 143, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 317 }, "ua_disagreement": false } }, { "hash": "t13d1611h2_1711a4c0508c_edf9f1f95545", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1611h2", "b": "1711a4c0508c", "c": "edf9f1f95545", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-255,0-11-10-35-5-16-23-13-43-45-51,29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 100, "first_seen": 1788336471, "last_seen": 1791208461, "transport": "t", "ja3_hash": "4f2d63c6a35e03e0917bcb5c7d1d6540", "ja3_variant_count": 2, "ja3_variants": [ "4f2d63c6a35e03e0917bcb5c7d1d6540", "21d90f639c23231f6f01965105380d67" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 51, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 131 }, "ua_disagreement": false } }, { "hash": "t13d1612h2_1711a4c0508c_2f0eefca25b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1612h2", "b": "1711a4c0508c", "c": "2f0eefca25b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-255,0-11-10-35-5-16-23-13-43-45-51-21,29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789362529, "last_seen": 1789362538, "transport": "t", "ja3_hash": "b575840c0d22f540c5cfe867d963a259", "ja3_variant_count": 1, "ja3_variants": [ "b575840c0d22f540c5cfe867d963a259" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 50 }, "ua_disagreement": false } }, { "hash": "t13d1612ht_1711a4c0508c_8a448b0eddb4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1612ht", "b": "1711a4c0508c", "c": "8a448b0eddb4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1789450881, "last_seen": 1790928720, "transport": "t", "ja3_hash": "95bc9b675f4acd37b89e821534de8b11", "ja3_variant_count": 1, "ja3_variants": [ "95bc9b675f4acd37b89e821534de8b11" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 17 }, "ua_disagreement": false } }, { "hash": "t13d1613h2_1711a4c0508c_a552550d4dd8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1613h2", "b": "1711a4c0508c", "c": "a552550d4dd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49195-49199-49172-49171-157-156-53-47-255,0-11-10-35-5-16-22-23-13-43-45-51-21,29-25-24-23,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1791293981, "last_seen": 1791344392, "transport": "t", "ja3_hash": "fc72dbbf90a7f7a43eba92229c095515", "ja3_variant_count": 1, "ja3_variants": [ "fc72dbbf90a7f7a43eba92229c095515" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 2151 }, "ua_disagreement": false } }, { "hash": "t13d1614h2_46e7e9700bed_8c454e6c488f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1614h2", "b": "46e7e9700bed", "c": "8c454e6c488f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-10,0-23-65281-10-11-16-5-34-18-51-43-13-28-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790576493, "last_seen": 1790576508, "transport": "t", "ja3_hash": "e758a98aa1ca6d82c1df3f54b360b70e", "ja3_variant_count": 1, "ja3_variants": [ "e758a98aa1ca6d82c1df3f54b360b70e" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 26 }, "ua_disagreement": false } }, { "hash": "t13d1614h2_86a278354501_8c454e6c488f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1614h2", "b": "86a278354501", "c": "8c454e6c488f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788480410, "last_seen": 1788480456, "transport": "t", "ja3_hash": "996033a4a134cd993d7f0ecfab09e3cc", "ja3_variant_count": 1, "ja3_variants": [ "996033a4a134cd993d7f0ecfab09e3cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:153.0) Gecko/20100101 Firefox/153.0": 28 }, "ua_disagreement": false } }, { "hash": "t13d1615h2_46e7e9700bed_5ad411fbfabb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1615h2", "b": "46e7e9700bed", "c": "5ad411fbfabb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-10,0-23-65281-10-11-16-5-34-18-51-43-13-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1790576489, "last_seen": 1790577043, "transport": "t", "ja3_hash": "a526de7349b48dbf877aadf6daa38bb5", "ja3_variant_count": 1, "ja3_variants": [ "a526de7349b48dbf877aadf6daa38bb5" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 15 }, "ua_disagreement": false } }, { "hash": "t13d1615h2_46e7e9700bed_cadd4ee51f0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1615h2", "b": "46e7e9700bed", "c": "cadd4ee51f0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 21, "first_seen": 1787559263, "last_seen": 1791301813, "transport": "t", "ja3_hash": "66918128f1b9b03303d77c6f2eefd128", "ja3_variant_count": 1, "ja3_variants": [ "66918128f1b9b03303d77c6f2eefd128" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0": 23, "Go-http-client/2.0": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3835.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1615h2_86a278354501_bfd03865c479", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1615h2", "b": "86a278354501", "c": "bfd03865c479", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 18, "first_seen": 1787542117, "last_seen": 1788480447, "transport": "t", "ja3_hash": "b074ad2e08e2809192a32ad8042d1940", "ja3_variant_count": 1, "ja3_variants": [ "b074ad2e08e2809192a32ad8042d1940" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 66 }, "ua_disagreement": false } }, { "hash": "t13d1616h2_46e7e9700bed_8e37aa83b3bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1616h2", "b": "46e7e9700bed", "c": "8e37aa83b3bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-65037,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1790576429, "last_seen": 1791209139, "transport": "t", "ja3_hash": "b72d4c0b58892f2e7063607300f34fcc", "ja3_variant_count": 2, "ja3_variants": [ "b72d4c0b58892f2e7063607300f34fcc", "405117e6157930a95cfb2335b96e1516" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 32, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 52 }, "ua_disagreement": false } }, { "hash": "t13d1616h2_86a278354501_8e37aa83b3bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1616h2", "b": "86a278354501", "c": "8e37aa83b3bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 51, "first_seen": 1787499290, "last_seen": 1791285259, "transport": "t", "ja3_hash": "5f084da4f92be5ecf20d3badb600820c", "ja3_variant_count": 1, "ja3_variants": [ "5f084da4f92be5ecf20d3badb600820c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 81, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 104, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 46 }, "ua_disagreement": false } }, { "hash": "t13d1617h2_46e7e9700bed_7af0cb3b5dda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1617h2", "b": "46e7e9700bed", "c": "7af0cb3b5dda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1790096222, "last_seen": 1791209138, "transport": "t", "ja3_hash": "4cec42b0cc8c1619415dad5dac5249f2", "ja3_variant_count": 2, "ja3_variants": [ "4cec42b0cc8c1619415dad5dac5249f2", "687dad89a4c75daf0382cded5aa17082" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 300 }, "ua_disagreement": false } }, { "hash": "t13d1617h2_46e7e9700bed_98d29f222568", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1617h2", "b": "46e7e9700bed", "c": "98d29f222568", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-10,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-27-65037-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790113295, "last_seen": 1790113295, "transport": "t", "ja3_hash": "baea2fac079cd737ed725e92246aaab8", "ja3_variant_count": 1, "ja3_variants": [ "baea2fac079cd737ed725e92246aaab8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 28 }, "ua_disagreement": false } }, { "hash": "t13d1617h2_86a278354501_7af0cb3b5dda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1617h2", "b": "86a278354501", "c": "7af0cb3b5dda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 172, "first_seen": 1787459599, "last_seen": 1791330923, "transport": "t", "ja3_hash": "6447ab086255d194909d4013b1a89e87", "ja3_variant_count": 1, "ja3_variants": [ "6447ab086255d194909d4013b1a89e87" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 947, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 /153.3.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 101 }, "ua_disagreement": false } }, { "hash": "t13d1617h2_86a278354501_98d29f222568", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1617h2", "b": "86a278354501", "c": "98d29f222568", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1788261834, "last_seen": 1791088158, "transport": "t", "ja3_hash": "f19d54c853fffdd9eeab77ae607448e9", "ja3_variant_count": 1, "ja3_variants": [ "f19d54c853fffdd9eeab77ae607448e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 152, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 139 }, "ua_disagreement": false } }, { "hash": "t13d1710h2_5b57614c22b0_b162e96b8768", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1710h2", "b": "5b57614c22b0", "c": "b162e96b8768", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-16-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 91, "first_seen": 1787555951, "last_seen": 1791086153, "transport": "t", "ja3_hash": "da6b4ed151e487ee5d4414c1b4833627", "ja3_variant_count": 1, "ja3_variants": [ "da6b4ed151e487ee5d4414c1b4833627" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 148, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 22, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Shap-User/0.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d171100_ab0a1bf427ad_6ecbdee5c734", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d171100", "b": "ab0a1bf427ad", "c": "6ecbdee5c734", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 137, "first_seen": 1787584021, "last_seen": 1791334437, "transport": "t", "ja3_hash": "e8df55bdfa49d878dc07891c00a025ce", "ja3_variant_count": 2, "ja3_variants": [ "e8df55bdfa49d878dc07891c00a025ce", "f21f8e6cf70d5980ecfe9fa2e0ef401c" ], "user_agents": { "Mozilla/5.0": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64)": 3, "StillCPAResearchBot/1.0 (homepage-only public-business research; +https://still-cpa.com/contact-us)": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0": 4, "Python-urllib/3.14": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.0": 7 }, "ua_disagreement": false } }, { "hash": "t13d1711h2_5b57614c22b0_fafec55f477d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1711h2", "b": "5b57614c22b0", "c": "fafec55f477d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-16-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 573, "first_seen": 1787484281, "last_seen": 1791328120, "transport": "t", "ja3_hash": "660a941f55bd4e528c12a52a9e9a4b03", "ja3_variant_count": 1, "ja3_variants": [ "660a941f55bd4e528c12a52a9e9a4b03" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 1639, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 36, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Shap-User/0.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d171200_4a19f3cbba51_68aee4fa2134", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d171200", "b": "4a19f3cbba51", "c": "68aee4fa2134", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49172-49171-159-158-157-156-47-255,0-11-10-35-5-13172-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 81, "first_seen": 1790234413, "last_seen": 1790579728, "transport": "t", "ja3_hash": "7633cf26df53f167ee2a3acf6054b9c0", "ja3_variant_count": 1, "ja3_variants": [ "7633cf26df53f167ee2a3acf6054b9c0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 1562 }, "ua_disagreement": false } }, { "hash": "t13d171200_ab0a1bf427ad_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d171200", "b": "ab0a1bf427ad", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 50, "first_seen": 1787618496, "last_seen": 1791357034, "transport": "t", "ja3_hash": "e459f9ec156647e137eec3618527db1f", "ja3_variant_count": 2, "ja3_variants": [ "e459f9ec156647e137eec3618527db1f", "67c055eca3b5fe3056c54d639b2a1362" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 8, "Python-urllib/3.14": 2 }, "ua_disagreement": false } }, { "hash": "t13d1712h2_5b57614c22b0_13426837f0ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1712h2", "b": "5b57614c22b0", "c": "13426837f0ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-52393-49199-52392-49161-49171-156-47-49196-49200-49162-49172-157-53,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1195, "first_seen": 1787443974, "last_seen": 1791361136, "transport": "t", "ja3_hash": "f5bd742fa88333052a1deec09f821012", "ja3_variant_count": 2, "ja3_variants": [ "f5bd742fa88333052a1deec09f821012", "aa94d602ee60d8eba83a42f740bbdd37" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 31, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot": 764, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot": 386 }, "ua_disagreement": false } }, { "hash": "t13d1712h2_5b57614c22b0_bed454b11bd1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1712h2", "b": "5b57614c22b0", "c": "bed454b11bd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-52393-49199-52392-49161-49171-156-47-49196-49200-49162-49172-157-53,0-23-65281-10-11-35-16-13-51-45-43-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 351, "first_seen": 1787464730, "last_seen": 1791336613, "transport": "t", "ja3_hash": "27441b2a2ac1d51a7f98ae44819494a5", "ja3_variant_count": 2, "ja3_variants": [ "27441b2a2ac1d51a7f98ae44819494a5", "df38140d306e29a5be0341b584e2450b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot": 58, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot": 287, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 25 }, "ua_disagreement": false } }, { "hash": "t13d1712ht_ab0a1bf427ad_be43a87a1363", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1712ht", "b": "ab0a1bf427ad", "c": "be43a87a1363", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 359, "first_seen": 1787464180, "last_seen": 1791334436, "transport": "t", "ja3_hash": "7291ea5e449f2c7b17582541703e549d", "ja3_variant_count": 2, "ja3_variants": [ "7291ea5e449f2c7b17582541703e549d", "84442eae56523a0a09a58c8ad56661b2" ], "user_agents": { "python-requests/2.32.5": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36": 8, "hnfactors/0.2 (academic research on Hacker News)": 1, "WhiteCircleTrustBot/1.0 (+https://whitecircle.ai/bots/trust-center-scraper)": 12, "Mozilla/5.0": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 59 }, "ua_disagreement": true } }, { "hash": "t13d1712ht_ab0a1bf427ad_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1712ht", "b": "ab0a1bf427ad", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 655, "first_seen": 1787505679, "last_seen": 1791358099, "transport": "t", "ja3_hash": "478843a4cce1e9955bfcf160342b6e11", "ja3_variant_count": 2, "ja3_variants": [ "478843a4cce1e9955bfcf160342b6e11", "37f7d09ced1a845dc48872abc1a29d7b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 19, "msh-pdfmin/1": 398, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 (+centryx-domain-mill; contact beinn.yule@centryx.ai)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +searchbot@anthropic.com)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13d1713h2_5b57614c22b0_1d486f7b386c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713h2", "b": "5b57614c22b0", "c": "1d486f7b386c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,10-5-65037-11-43-18-27-0-28-16-65281-13-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789777479, "last_seen": 1789777479, "transport": "t", "ja3_hash": "53fe84d79f2c993624393ba967355179", "ja3_variant_count": 1, "ja3_variants": [ "53fe84d79f2c993624393ba967355179" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.2180.105 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1713h2_5b57614c22b0_514943fa2261", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713h2", "b": "5b57614c22b0", "c": "514943fa2261", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 78, "first_seen": 1787563438, "last_seen": 1791331573, "transport": "t", "ja3_hash": "ed3d2cb3d86125377f5a4d48e431af48", "ja3_variant_count": 6, "ja3_variants": [ "ed3d2cb3d86125377f5a4d48e431af48", "fb59d4657aa9f1cde09b7b9e79b54467", "da8cae6a7c37d52494383a102529844a", "f1a2823d1c629f0161bd1f1ff6232286", "68ca5fd4b2d35b454c1ccfa6156b272f", "72f9e974237ac466af0906504c230753" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3530.119 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3748.26 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3489.160 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3680.139 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3360.67 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.2879.177 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3358.44 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.2009.38 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1713h2_5b57614c22b0_571c9eeffdb5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713h2", "b": "5b57614c22b0", "c": "571c9eeffdb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-52393-49199-52392-49161-49171-156-47-49196-49200-49162-49172-157-53,0-23-65281-10-11-35-16-13-51-45-43-21-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 693, "first_seen": 1787457735, "last_seen": 1791355843, "transport": "t", "ja3_hash": "aa2d0ad206e0981d695e9266f3fa2d65", "ja3_variant_count": 2, "ja3_variants": [ "aa2d0ad206e0981d695e9266f3fa2d65", "da404a616232aa8d719c50558af9aead" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 41, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot": 84, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot": 596 }, "ua_disagreement": false } }, { "hash": "t13d1713h2_5b57614c22b0_c38ec3c5e609", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713h2", "b": "5b57614c22b0", "c": "c38ec3c5e609", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-21,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788638699, "last_seen": 1788960064, "transport": "t", "ja3_hash": "ad55557b7cbd735c2627f7ebb3b3d493", "ja3_variant_count": 1, "ja3_variants": [ "ad55557b7cbd735c2627f7ebb3b3d493" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:109.0) Gecko/20100101 Firefox/115.0": 13, "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0": 13 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_5b57614c22b0_aea78d538e14", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "5b57614c22b0", "c": "aea78d538e14", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-52392-49161-49162-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1789494048, "last_seen": 1791232558, "transport": "t", "ja3_hash": "9b02ebd3a43b62d825e1ac605b621dc8", "ja3_variant_count": 1, "ja3_variants": [ "9b02ebd3a43b62d825e1ac605b621dc8" ], "user_agents": { "WhatsApp/2.23.20.0": 9, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:24.0) Gecko/20100101 Firefox/24.0 Chrome/80.0.3987.132 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_ab0a1bf427ad_227f730ea371", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "227f730ea371", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-16-22-23-49-13-43-45-51-21,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 44, "first_seen": 1787505984, "last_seen": 1790491008, "transport": "t", "ja3_hash": "40f10d0eb1d9d3e660aa85c7eb3555a8", "ja3_variant_count": 1, "ja3_variants": [ "40f10d0eb1d9d3e660aa85c7eb3555a8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.35/36 Safari/537.36": 44 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_ab0a1bf427ad_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2010, "first_seen": 1787443084, "last_seen": 1791351852, "transport": "t", "ja3_hash": "06873b563b993c62a40abbbdb28d2f21", "ja3_variant_count": 1, "ja3_variants": [ "06873b563b993c62a40abbbdb28d2f21" ], "user_agents": { "Mozilla/5.0 (X11; Linux i686; rv:109.0) Gecko/20100101 Firefox/120.0": 7, "Python/3.13 aiohttp/3.14.1": 42, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; YouBot/1.0; +https://docs.you.com/youbot; env:prod) Chrome/142.0.0.0 Safari/537.36": 200 }, "ua_disagreement": true } }, { "hash": "t13d1713ht_ab0a1bf427ad_ab44252766dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "ab44252766dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-16-22-23-13-43-45-51-21,4588-4587-514-4589-29-23-30-24-25-31-32-33-26-27-28,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 33, "first_seen": 1790431319, "last_seen": 1791309352, "transport": "t", "ja3_hash": "efb1b6e1ce3bbafeb0aa15ed137ce4f8", "ja3_variant_count": 1, "ja3_variants": [ "efb1b6e1ce3bbafeb0aa15ed137ce4f8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t13d1714h2_5b57614c22b0_1e92bedb447c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1714h2", "b": "5b57614c22b0", "c": "1e92bedb447c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-45-28-41,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790983671, "last_seen": 1790983671, "transport": "t", "ja3_hash": "c279b0189edb9269da7bc43dea5e0c36", "ja3_variant_count": 1, "ja3_variants": [ "c279b0189edb9269da7bc43dea5e0c36" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1714h2_5b57614c22b0_50ede07022fd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1714h2", "b": "5b57614c22b0", "c": "50ede07022fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 38, "first_seen": 1787569163, "last_seen": 1790795437, "transport": "t", "ja3_hash": "a767f8ae9115cc5752e5cff59612e74f", "ja3_variant_count": 2, "ja3_variants": [ "a767f8ae9115cc5752e5cff59612e74f", "aa2f8a6304a024c468699c41bb2a46da" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3001.78 Safari/537.36": 2, "Mozilla/5.0 (Android 10; Mobile; rv:140.0) Gecko/140.0 Firefox/140.0": 125, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3541.187 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.2738.192 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1714h2_5b57614c22b0_8c454e6c488f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1714h2", "b": "5b57614c22b0", "c": "8c454e6c488f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 30, "first_seen": 1789762407, "last_seen": 1791143787, "transport": "t", "ja3_hash": "75603adb8780ff56ed5ffdf57fe8b4cc", "ja3_variant_count": 1, "ja3_variants": [ "75603adb8780ff56ed5ffdf57fe8b4cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 49, "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 111 }, "ua_disagreement": false } }, { "hash": "t13d1714ht_5b57614c22b0_8667f5695ef6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1714ht", "b": "5b57614c22b0", "c": "8667f5695ef6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 183, "first_seen": 1787473008, "last_seen": 1791329101, "transport": "t", "ja3_hash": "d871d02cecbde59abbf8f4806134addf", "ja3_variant_count": 1, "ja3_variants": [ "d871d02cecbde59abbf8f4806134addf" ], "user_agents": { "Bun/1.4.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 177, "Bun/1.3.14": 2 }, "ua_disagreement": false } }, { "hash": "t13d1715h2_5b57614c22b0_2b6791c0b3dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1715h2", "b": "5b57614c22b0", "c": "2b6791c0b3dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-21,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 28, "first_seen": 1787459788, "last_seen": 1791185490, "transport": "t", "ja3_hash": "579ccef312d18482fc42e2b822ca2430", "ja3_variant_count": 1, "ja3_variants": [ "579ccef312d18482fc42e2b822ca2430" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:115.0) Gecko/20100101 /115.42.0": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:115.0) Gecko/20100101 /115.41.0": 2, "Mozilla/5.0 (Windows NT 10.0; rv:111.0) Gecko/20100101 Firefox/111.0": 71 }, "ua_disagreement": false } }, { "hash": "t13d1715h2_5b57614c22b0_32db7dcf895c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1715h2", "b": "5b57614c22b0", "c": "32db7dcf895c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787666455, "last_seen": 1791203814, "transport": "t", "ja3_hash": "b5001237acdf006056b409cc433726b0", "ja3_variant_count": 3, "ja3_variants": [ "b5001237acdf006056b409cc433726b0", "5f9d64f34625c87625e09e7e9d84b488", "17135f7f41ddc871524817242e15851e" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0": 37, "MerchantSecurityScanner/1.0 (+https://stri.pe/go/merchant-security-scanner)": 61, "Mozilla/5.0 (Android 16; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0": 6 }, "ua_disagreement": false } }, { "hash": "t13d1715h2_5b57614c22b0_5ad411fbfabb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1715h2", "b": "5b57614c22b0", "c": "5ad411fbfabb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 221, "first_seen": 1787508092, "last_seen": 1791236471, "transport": "t", "ja3_hash": "7704a11cf87dfcf33080b90ce11d5527", "ja3_variant_count": 2, "ja3_variants": [ "7704a11cf87dfcf33080b90ce11d5527", "fae2d0ee1d76703828d9af1c91a959de" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 819, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3232.14 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 1392, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3458.20 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d1715h2_e08a0f08260f_5563d4852cd1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (5563d4852cd1) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1715h2", "b": "e08a0f08260f", "c": "5563d4852cd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "257,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-57363-57427-156-157-47-53,23-65281-10-11-35-16-5-13-18-51-45-43-27-21-0,29-23-24,0", "ja3_decoded": { "version": { "value": 257, "name": "257 (0x0101)" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57363, "name": "57363 (0xe013)", "known": false }, { "value": 57427, "name": "57427 (0xe053)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 28, "first_seen": 1787461181, "last_seen": 1791317086, "transport": "t", "ja3_hash": "ef53b4052670264d7c747d36964b86e4", "ja3_variant_count": 1, "ja3_variants": [ "ef53b4052670264d7c747d36964b86e4" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1716h2_5b57614c22b0_494fa9cd0083", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (494fa9cd0083) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1716h2", "b": "5b57614c22b0", "c": "494fa9cd0083", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789366657, "last_seen": 1789366657, "transport": "t", "ja3_hash": "1bd037f4362e6fb24b2718009dd1049a", "ja3_variant_count": 1, "ja3_variants": [ "1bd037f4362e6fb24b2718009dd1049a" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1716h2_5b57614c22b0_7e448db9ea6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1716h2", "b": "5b57614c22b0", "c": "7e448db9ea6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788390093, "last_seen": 1790763306, "transport": "t", "ja3_hash": "2d692a4485ca2f5f2b10ecb2d2909ad3", "ja3_variant_count": 1, "ja3_variants": [ "2d692a4485ca2f5f2b10ecb2d2909ad3" ], "user_agents": { "Mozilla/5.0 (Android 16; Mobile; rv:149.0) Gecko/149.0 Firefox/149.0": 27, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0": 6 }, "ua_disagreement": false } }, { "hash": "t13d1716h2_5b57614c22b0_8e37aa83b3bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1716h2", "b": "5b57614c22b0", "c": "8e37aa83b3bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 67, "first_seen": 1788884303, "last_seen": 1791043170, "transport": "t", "ja3_hash": "aa335cae1834c8200477ce25932b9ad0", "ja3_variant_count": 1, "ja3_variants": [ "aa335cae1834c8200477ce25932b9ad0" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 6547, "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0": 28 }, "ua_disagreement": false } }, { "hash": "t13d1717h2_5b57614c22b0_66f9b3d2442a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1717h2", "b": "5b57614c22b0", "c": "66f9b3d2442a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,34-28-65281-27-11-0-23-35-10-16-5-18-51-43-13-45-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791363282, "last_seen": 1791363282, "transport": "t", "ja3_hash": "3ebd09962512bd88900807ae6878de6e", "ja3_variant_count": 1, "ja3_variants": [ "3ebd09962512bd88900807ae6878de6e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1717h2_5b57614c22b0_7af0cb3b5dda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1717h2", "b": "5b57614c22b0", "c": "7af0cb3b5dda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 868, "first_seen": 1787456789, "last_seen": 1791345212, "transport": "t", "ja3_hash": "6f7889b9fb1a62a9577e685c1fcfa919", "ja3_variant_count": 1, "ja3_variants": [ "6f7889b9fb1a62a9577e685c1fcfa919" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0": 666, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0": 40 }, "ua_disagreement": false } }, { "hash": "t13d1717h2_5b57614c22b0_98d29f222568", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (98d29f222568) with 3 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1717h2", "b": "5b57614c22b0", "c": "98d29f222568", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-27-65037-41,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1789641892, "last_seen": 1791043169, "transport": "t", "ja3_hash": "0e76c7e9d06fa0e211b1827687dd8f43", "ja3_variant_count": 1, "ja3_variants": [ "0e76c7e9d06fa0e211b1827687dd8f43" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d181000_85036bcba153_1075c442c310", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181000", "b": "85036bcba153", "c": "1075c442c310", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 38, "first_seen": 1787649931, "last_seen": 1791261224, "transport": "t", "ja3_hash": "80a0681edf7be3a4d5dc90fc39055d22", "ja3_variant_count": 1, "ja3_variants": [ "80a0681edf7be3a4d5dc90fc39055d22" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36": 38 }, "ua_disagreement": false } }, { "hash": "t13d181000_e8a523a41297_badae892920c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181000", "b": "e8a523a41297", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4867-4865-4866-49199-49195-49200-49196-52393-52392-49161-49171-49162-49172-156-157-47-53-10,0-23-65281-10-11-35-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790873399, "last_seen": 1790879909, "transport": "t", "ja3_hash": "ca450f8afb5c4c9c678d1c667c7482f2", "ja3_variant_count": 1, "ja3_variants": [ "ca450f8afb5c4c9c678d1c667c7482f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203": 2 }, "ua_disagreement": false } }, { "hash": "t13d181100_85036bcba153_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181100", "b": "85036bcba153", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1015, "first_seen": 1787489395, "last_seen": 1791327740, "transport": "t", "ja3_hash": "5833fcd5a2599274dacc5a94102ac943", "ja3_variant_count": 2, "ja3_variants": [ "5833fcd5a2599274dacc5a94102ac943", "93c7d42c0df602fb91589311534831f5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 66, "Python-urllib/3.12": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36": 318 }, "ua_disagreement": false } }, { "hash": "t13d181200_5103eae14fdb_6c7ee535e33c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6c7ee535e33c) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d181200", "b": "5103eae14fdb", "c": "6c7ee535e33c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-22-23-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790408960, "last_seen": 1790408961, "transport": "t", "ja3_hash": "1a08299fe7233c02a2e5873af8b8eaac", "ja3_variant_count": 1, "ja3_variants": [ "1a08299fe7233c02a2e5873af8b8eaac" ], "user_agents": { "sieve-retrieval/4": 2 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1812ht_85036bcba153_6c7c91134a62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1812ht", "b": "85036bcba153", "c": "6c7c91134a62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 974, "first_seen": 1787445853, "last_seen": 1791356432, "transport": "t", "ja3_hash": "004bf73563645cc1faefe99886ed32eb", "ja3_variant_count": 2, "ja3_variants": [ "004bf73563645cc1faefe99886ed32eb", "304734bb1c086c3453b387400cf83f11" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 2, "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/5d7.36 (KHTML, like Gecko) Chrome/138.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 (PhantomJsCloud.com/6.2025.4.20)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0": 3, "Mozilla/5.0 (compatible; SectorBot/1.0; +https://serdartorun.dev/bot) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d1812ht_85036bcba153_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1812ht", "b": "85036bcba153", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 706, "first_seen": 1787468190, "last_seen": 1791348093, "transport": "t", "ja3_hash": "47f56493e551459ad91fdee8f61435f3", "ja3_variant_count": 2, "ja3_variants": [ "47f56493e551459ad91fdee8f61435f3", "a48c0d5f95b1ef98f560f324fd275da1" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 44, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1": 7, "python-requests/2.32.5": 14, "python-requests/2.34.2": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0": 58 }, "ua_disagreement": true } }, { "hash": "t13d1813ht_85036bcba153_6b9dd2e5c643", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6b9dd2e5c643) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d1813ht", "b": "85036bcba153", "c": "6b9dd2e5c643", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-35-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 371, "first_seen": 1787818245, "last_seen": 1791316920, "transport": "t", "ja3_hash": "331a436afb23d4e31134c11b301bdcb5", "ja3_variant_count": 1, "ja3_variants": [ "331a436afb23d4e31134c11b301bdcb5" ], "user_agents": { "KingfisherIngest/1.0 (+https://github.com/tldrmedia/kingfisher)": 5, "wp2shell": 3, "CodeMMPretrainCrawler/1.0": 139 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d1814ht_5103eae14fdb_575b7503f51b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1814ht", "b": "5103eae14fdb", "c": "575b7503f51b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-16-22-23-49-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1788535152, "last_seen": 1791212966, "transport": "t", "ja3_hash": "ed5d44508b4c00e058be147ed87e7830", "ja3_variant_count": 1, "ja3_variants": [ "ed5d44508b4c00e058be147ed87e7830" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36": 4, "python-requests/2.34.2": 3 }, "ua_disagreement": true } }, { "hash": "t13d1816h2_e8a523a41297_7b0b2a9ab28f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1816h2", "b": "e8a523a41297", "c": "7b0b2a9ab28f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-16-5-34-18-51-43-13-45-28-65037-41,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787749786, "last_seen": 1788610444, "transport": "t", "ja3_hash": "77e18ee7f135525b68db30e448032200", "ja3_variant_count": 1, "ja3_variants": [ "77e18ee7f135525b68db30e448032200" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 7 }, "ua_disagreement": false } }, { "hash": "t13d1910ht_9dc949149365_466c27a6074e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1910ht", "b": "9dc949149365", "c": "466c27a6074e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 10, "alpn": "ht" } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,0-5-10-11-13-65281-16-18-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1788488550, "last_seen": 1790641221, "transport": "t", "ja3_hash": "fb2f41ad1ff624286946b588576a70de", "ja3_variant_count": 1, "ja3_variants": [ "fb2f41ad1ff624286946b588576a70de" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d191100_9dc949149365_0fe28f4911d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d191100", "b": "9dc949149365", "c": "0fe28f4911d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 124, "first_seen": 1787724786, "last_seen": 1791306850, "transport": "t", "ja3_hash": "27d8c260ed098a8ad17fa38232a7e7ae", "ja3_variant_count": 1, "ja3_variants": [ "27d8c260ed098a8ad17fa38232a7e7ae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64)": 2, "Mozilla/5.0 (compatible; SecurityResearch/1.0; )": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d191100_9dc949149365_8cc08dffc9e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d191100", "b": "9dc949149365", "c": "8cc08dffc9e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 11, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,0-5-10-11-35-13-65281-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 86, "first_seen": 1787472280, "last_seen": 1791193738, "transport": "t", "ja3_hash": "d6199990cfdd3e02bffa3af7a530275c", "ja3_variant_count": 1, "ja3_variants": [ "d6199990cfdd3e02bffa3af7a530275c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36": 86 }, "ua_disagreement": false } }, { "hash": "t13d1911h2_9dc949149365_2f5041364463", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1911h2", "b": "9dc949149365", "c": "2f5041364463", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-11-65281-23-18-5-10-13-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 145, "first_seen": 1787488743, "last_seen": 1791173997, "transport": "t", "ja3_hash": "d1d19c71e48184c6bf6827a3fea5da87", "ja3_variant_count": 2, "ja3_variants": [ "d1d19c71e48184c6bf6827a3fea5da87", "7a15285d4efc355608b304698cd7f9ab" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36": 15, "Go-http-client/2.0": 43, "metadata.party/1.0 (+https://github.com/yourusername/metadata.party)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.3": 5, "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36": 121 }, "ua_disagreement": true } }, { "hash": "t13d1912h2_9dc949149365_b246ff971066", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1912h2", "b": "9dc949149365", "c": "b246ff971066", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 55, "first_seen": 1787458549, "last_seen": 1790266575, "transport": "t", "ja3_hash": "d113e8b9d55b97b77077806180483c96", "ja3_variant_count": 1, "ja3_variants": [ "d113e8b9d55b97b77077806180483c96" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36": 50 }, "ua_disagreement": false } }, { "hash": "t13d191300_9dc949149365_db66201a557f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d191300", "b": "9dc949149365", "c": "db66201a557f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 13, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1790705995, "last_seen": 1790706192, "transport": "t", "ja3_hash": "3166f9c5e6b0e72f283dc10e6f23f345", "ja3_variant_count": 1, "ja3_variants": [ "3166f9c5e6b0e72f283dc10e6f23f345" ], "user_agents": { "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36": 4, "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13d200700_411b8c243a9d_070f1dc89d25", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d200700", "b": "411b8c243a9d", "c": "070f1dc89d25", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49199-49200-156-157-49195-49324-49326-49196-49325-49327-158-159-4865-4866-4868-4869-52392-52393-4867-255,0-10-11-13-23-43-51,23-29-24-256-257-258,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1790624762, "last_seen": 1790624789, "transport": "t", "ja3_hash": "ed09f45b56c8fcffaa814522f6af4c43", "ja3_variant_count": 1, "ja3_variants": [ "ed09f45b56c8fcffaa814522f6af4c43" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 101 }, "ua_disagreement": false } }, { "hash": "t13d201100_2b729b4bf6f3_2b2467513d7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d201100", "b": "2b729b4bf6f3", "c": "2b2467513d7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 663, "first_seen": 1787442950, "last_seen": 1791361300, "transport": "t", "ja3_hash": "68b3ecfaf0034bb9fcbecd518b5ab8d4", "ja3_variant_count": 2, "ja3_variants": [ "68b3ecfaf0034bb9fcbecd518b5ab8d4", "9085f08651f3d508044b9e41a776f45f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1173, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 18, "ddg_win": 78 }, "ua_disagreement": false } }, { "hash": "t13d201100_2b729b4bf6f3_f8f1377fd325", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d201100", "b": "2b729b4bf6f3", "c": "f8f1377fd325", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-43-13-35-10-51-49-23-65281-45,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 25, "first_seen": 1787782360, "last_seen": 1791319070, "transport": "t", "ja3_hash": "3c293bdf2a25c07559b560ba86debc77", "ja3_variant_count": 1, "ja3_variants": [ "3c293bdf2a25c07559b560ba86debc77" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36": 6, "Mozilla/5.0 (Windows NT 6.2; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/76.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d201200_2b729b4bf6f3_7e1dbb44d532", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d201200", "b": "2b729b4bf6f3", "c": "7e1dbb44d532", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-43-13-35-10-11-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 129, "first_seen": 1787473467, "last_seen": 1791362216, "transport": "t", "ja3_hash": "2800f914a7a4ba98aa9df62d316a460c", "ja3_variant_count": 1, "ja3_variants": [ "2800f914a7a4ba98aa9df62d316a460c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d201200_2b729b4bf6f3_d42405ff081a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d201200", "b": "2b729b4bf6f3", "c": "d42405ff081a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-51-49-23-65281-45-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 87, "first_seen": 1787443422, "last_seen": 1791308515, "transport": "t", "ja3_hash": "6ad69cecca55b3321a3261b1ae4aaab1", "ja3_variant_count": 1, "ja3_variants": [ "6ad69cecca55b3321a3261b1ae4aaab1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 22, "ddg_win": 53 }, "ua_disagreement": false } }, { "hash": "t13d2013h2_2b729b4bf6f3_b9165cb4b096", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2013h2", "b": "2b729b4bf6f3", "c": "b9165cb4b096", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-43-13-35-10-11-16-51-49-23-65281-45,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 358, "first_seen": 1787443156, "last_seen": 1791353089, "transport": "t", "ja3_hash": "d4ed3e50e6fccfcd0b8f2635bcec55ff", "ja3_variant_count": 1, "ja3_variants": [ "d4ed3e50e6fccfcd0b8f2635bcec55ff" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36": 413 }, "ua_disagreement": false } }, { "hash": "t13d2013h2_a09f3c656075_fb18a4f6686c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2013h2", "b": "a09f3c656075", "c": "fb18a4f6686c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 578, "first_seen": 1787488759, "last_seen": 1791331000, "transport": "t", "ja3_hash": "ecdf4f49dd59effc439639da29186671", "ja3_variant_count": 1, "ja3_variants": [ "ecdf4f49dd59effc439639da29186671" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Mobile/15E148 Safari/604.1": 103, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.15": 321, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 361 }, "ua_disagreement": false } }, { "hash": "t13d2014h2_a09f3c656075_1cccc7bac6be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2014h2", "b": "a09f3c656075", "c": "1cccc7bac6be", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,23-51-13-10-5-16-45-0-18-27-65281-43-11-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789749590, "last_seen": 1789788732, "transport": "t", "ja3_hash": "83b9eb790a8e69700b75e504426652f2", "ja3_variant_count": 5, "ja3_variants": [ "83b9eb790a8e69700b75e504426652f2", "72ed740b30d13d60b2a7812049151974", "d51347e0b4417e6b42a9f6a17bb5a01c", "bf3d8492a30d1099cb0d0b9308e1a5f4", "a073cd21467d575479e154f6cc3f8afa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3074.111 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.2455.8 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3212.166 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3776.37 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.2871.191 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d2014h2_a09f3c656075_31edcf4f4949", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2014h2", "b": "a09f3c656075", "c": "31edcf4f4949", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 434, "first_seen": 1787464746, "last_seen": 1791356744, "transport": "t", "ja3_hash": "773906b0efdefa24a7f2b8eb6985bf37", "ja3_variant_count": 1, "ja3_variants": [ "773906b0efdefa24a7f2b8eb6985bf37" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3024.75 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1": 35, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Safari/605.1.15": 124 }, "ua_disagreement": false } }, { "hash": "t13d2014h2_a09f3c656075_575785468cb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2014h2", "b": "a09f3c656075", "c": "575785468cb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,65281-11-10-35-5-22-18-23-13-43-45-51-0-16,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1789499558, "last_seen": 1790352911, "transport": "t", "ja3_hash": "5d42ca7c7fa584cce7692c676bc78c6f", "ja3_variant_count": 1, "ja3_variants": [ "5d42ca7c7fa584cce7692c676bc78c6f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Safari": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/27.0 Safari/605.1.15": 366 }, "ua_disagreement": false } }, { "hash": "t13d2014h2_a09f3c656075_d79dab2964a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2014h2", "b": "a09f3c656075", "c": "d79dab2964a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-35-16-5-13-18-51-45-43-27,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788597365, "last_seen": 1788757500, "transport": "t", "ja3_hash": "6618231821d2d40f8d1859f5a43a0307", "ja3_variant_count": 1, "ja3_variants": [ "6618231821d2d40f8d1859f5a43a0307" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15": 3 }, "ua_disagreement": false } }, { "hash": "t13d210900_6b2954d954da_e7627c074108", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d210900", "b": "6b2954d954da", "c": "e7627c074108", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49172-57-49171-51-157-156-53-47-255,0-11-10-22-23-13-43-45-51,4588-29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 37, "first_seen": 1788847211, "last_seen": 1788855105, "transport": "t", "ja3_hash": "7a07b517a5302a7ffd8b1151b81869e7", "ja3_variant_count": 1, "ja3_variants": [ "7a07b517a5302a7ffd8b1151b81869e7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 405 }, "ua_disagreement": false } }, { "hash": "t13d2111h2_74f0bb2f7da4_76331d012143", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2111h2", "b": "74f0bb2f7da4", "c": "76331d012143", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10-255,0-11-10-35-5-16-23-13-43-45-51,4588-29-23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790169996, "last_seen": 1790169996, "transport": "t", "ja3_hash": "4cd3c28071a1373e48c817746f13df14", "ja3_variant_count": 1, "ja3_variants": [ "4cd3c28071a1373e48c817746f13df14" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6.2 Safari/605.1.15": 22 }, "ua_disagreement": false } }, { "hash": "t13d2114h2_74f0bb2f7da4_96359d2267ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2114h2", "b": "74f0bb2f7da4", "c": "96359d2267ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10-255,11-10-35-5-22-18-23-13-43-45-51-0-16-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791193819, "last_seen": 1791193819, "transport": "t", "ja3_hash": "0da8b82d3c7faf34b257513548c541f1", "ja3_variant_count": 1, "ja3_variants": [ "0da8b82d3c7faf34b257513548c541f1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/27.0 Safari/605.1.15": 24 }, "ua_disagreement": false } }, { "hash": "t13d221000_231e334592e8_792f005fcd63", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d221000", "b": "231e334592e8", "c": "792f005fcd63", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-51-49-23-65281-45,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 77, "first_seen": 1790507416, "last_seen": 1790602917, "transport": "t", "ja3_hash": "9fd0948a7cafdb1cf1b2e689a5fa8db0", "ja3_variant_count": 1, "ja3_variants": [ "9fd0948a7cafdb1cf1b2e689a5fa8db0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 106, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15": 13 }, "ua_disagreement": false } }, { "hash": "t13d221100_231e334592e8_ea4cbeb91c15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d221100", "b": "231e334592e8", "c": "ea4cbeb91c15", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-51-49-23-65281-45-41,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789397350, "last_seen": 1790098022, "transport": "t", "ja3_hash": "253714f62c0a1e6869fe8ba6a45a0588", "ja3_variant_count": 1, "ja3_variants": [ "253714f62c0a1e6869fe8ba6a45a0588" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d2211h2_231e334592e8_7c0787dd9fe1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2211h2", "b": "231e334592e8", "c": "7c0787dd9fe1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-16-51-49-23-65281-45,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1789223334, "last_seen": 1790292062, "transport": "t", "ja3_hash": "8f6dd29dcbedf04835eb38c37abca624", "ja3_variant_count": 1, "ja3_variants": [ "8f6dd29dcbedf04835eb38c37abca624" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 96, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13d2212h2_231e334592e8_a342e66d9b48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2212h2", "b": "231e334592e8", "c": "a342e66d9b48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-16-51-49-23-65281-45,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8889, "first_seen": 1787443411, "last_seen": 1791362906, "transport": "t", "ja3_hash": "a1180b5557791f9d36d36739d0d9b08a", "ja3_variant_count": 1, "ja3_variants": [ "a1180b5557791f9d36d36739d0d9b08a" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/136.0.0.0 Safari/537.36 AppleWebKit/537.36 (KHTML, like Gecko; ": 1452, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36": 9473, "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534+ (KHTML, like Gecko) BingPreview/1.0b": 20 }, "ua_disagreement": false } }, { "hash": "t13d221300_a3988f242d56_5c37d630f182", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (5c37d630f182) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d221300", "b": "a3988f242d56", "c": "5c37d630f182", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49200-49196-49199-49195-159-158-57-136-51-49172-49171-69-49161-49162-132-53-65-47,65281-0-11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 31, "first_seen": 1788324771, "last_seen": 1791028582, "transport": "t", "ja3_hash": "cbec769fa50b19be5dd9c627a8a27d1b", "ja3_variant_count": 1, "ja3_variants": [ "cbec769fa50b19be5dd9c627a8a27d1b" ], "user_agents": { "Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com)": 11, "Mozilla/4.0 (compatible; Netcraft Web Server Survey)": 20 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d2213h2_231e334592e8_05b94552854b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2213h2", "b": "231e334592e8", "c": "05b94552854b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-16-51-49-23-65281-45-41,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 281, "first_seen": 1787454114, "last_seen": 1791347075, "transport": "t", "ja3_hash": "e073a34f05d77085eb938b316a570589", "ja3_variant_count": 1, "ja3_variants": [ "e073a34f05d77085eb938b316a570589" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36": 415, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/136.0.0.0 Safari/537.36 AppleWebKit/537.36 (KHTML, like Gecko; ": 361 }, "ua_disagreement": false } }, { "hash": "t13d241100_df98b6d6dfe4_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d241100", "b": "df98b6d6dfe4", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 24, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49195-49199-49188-49192-49187-49191-49162-49172-49161-49171-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788885416, "last_seen": 1790720588, "transport": "t", "ja3_hash": "3353901e5dcb7720211753cebdaa087f", "ja3_variant_count": 1, "ja3_variants": [ "3353901e5dcb7720211753cebdaa087f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d241200_e4d65112872d_80a66a7241b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (80a66a7241b6) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d241200", "b": "e4d65112872d", "c": "80a66a7241b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 24, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49195-49199-158-52393-52392-49162-49172-57-49161-49171-51-156-53-47-49200-49196-61-106-56-50-255,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787488234, "last_seen": 1791296016, "transport": "t", "ja3_hash": "f1b9b751b665449f1ce77721b0487b69", "ja3_variant_count": 1, "ja3_variants": [ "f1b9b751b665449f1ce77721b0487b69" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d251000_b78ed14e2fd0_27f0a1fdd87d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d251000", "b": "b78ed14e2fd0", "c": "27f0a1fdd87d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,0-11-65281-23-18-5-10-13-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789997505, "last_seen": 1789997506, "transport": "t", "ja3_hash": "6d148f747f881eff499f36677cb94c24", "ja3_variant_count": 1, "ja3_variants": [ "6d148f747f881eff499f36677cb94c24" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0, Win64, x64, rv:139.0) Gecko/20100101 Firefox/139.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:104.0) Gecko/20100101 Firefox/104.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d251100_b78ed14e2fd0_4b7cee5f0569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d251100", "b": "b78ed14e2fd0", "c": "4b7cee5f0569", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 565, "first_seen": 1787450480, "last_seen": 1791287892, "transport": "t", "ja3_hash": "99c071c5a5e14cc2527c9e8e0dde4a50", "ja3_variant_count": 4, "ja3_variants": [ "99c071c5a5e14cc2527c9e8e0dde4a50", "238bcebdfa16aa0be417a7f7a80063a9", "7916980d74f734e3cce90212ba1f5e2a", "bfd0c1ee9f8821c672b82328bf04183e" ], "user_agents": { "Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.7.5 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_5_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.7922.112 Mobile/15E148 Safari/604.1": 1, "RootEvidence/1.0": 58, "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.6.25": 2, "domain-harvester/dev (+https://github.com/esc-city/domain-harvester)": 24, "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d251200_b78ed14e2fd0_33dd2ce6e697", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d251200", "b": "b78ed14e2fd0", "c": "33dd2ce6e697", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 12, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,0-5-10-11-35-13-65281-23-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790280922, "last_seen": 1790280923, "transport": "t", "ja3_hash": "2c71e9319a97b1f12f62b9962613aeaf", "ja3_variant_count": 1, "ja3_variants": [ "2c71e9319a97b1f12f62b9962613aeaf" ], "user_agents": { "fasthttp": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d2512h2_b78ed14e2fd0_36b6e4cc52f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2512h2", "b": "b78ed14e2fd0", "c": "36b6e4cc52f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 104, "first_seen": 1787464622, "last_seen": 1791289941, "transport": "t", "ja3_hash": "d6627faa72aa91c9e2ae51d456173c69", "ja3_variant_count": 1, "ja3_variants": [ "d6627faa72aa91c9e2ae51d456173c69" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0": 88, "Mozilla/5.0 (compatible; wpbot/1.4; +https://forms.gle/ajBaxygz9jSR8p8G9)": 25 }, "ua_disagreement": false } }, { "hash": "t13d260900_6d1bcf7a4624_1c00b73368e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d260900", "b": "6d1bcf7a4624", "c": "1c00b73368e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49195-49196-49187-49188-49161-49162-49200-49199-49171-49172-49191-49192-157-156-53-47-159-158-107-103-57-51-255,0-11-10-5-23-13-43-45-51,23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 366, "first_seen": 1787550991, "last_seen": 1791290423, "transport": "t", "ja3_hash": "de62b1c1a1860dded17275e0b45978bf", "ja3_variant_count": 1, "ja3_variants": [ "de62b1c1a1860dded17275e0b45978bf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 154, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 42, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13d2610h2_6d1bcf7a4624_44417bcab4c7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2610h2", "b": "6d1bcf7a4624", "c": "44417bcab4c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49196-49187-49188-49161-49162-49200-49199-49171-49172-49191-49192-157-156-53-47-159-158-107-103-57-51-255,0-11-10-5-16-23-13-43-45-51,23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 21, "first_seen": 1788245269, "last_seen": 1790831434, "transport": "t", "ja3_hash": "fc061a05f1ac1f02645670f181e02e37", "ja3_variant_count": 1, "ja3_variants": [ "fc061a05f1ac1f02645670f181e02e37" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 62, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 70 }, "ua_disagreement": false } }, { "hash": "t13d2613h2_2802a3db6c62_87f4314a3231", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2613h2", "b": "2802a3db6c62", "c": "87f4314a3231", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49188-49187-49162-49161-49192-49191-49172-49171-157-156-61-60-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 27, "first_seen": 1787456790, "last_seen": 1791151307, "transport": "t", "ja3_hash": "656b9a2f4de6ed4909e157482860ab3d", "ja3_variant_count": 2, "ja3_variants": [ "656b9a2f4de6ed4909e157482860ab3d", "6fa3244afc6bb6f9fad207b6b52af26b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6.1 Safari/605.1.15": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15": 2 }, "ua_disagreement": false } }, { "hash": "t13d271200_c42a7efa14d1_665d54402951", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d271200", "b": "c42a7efa14d1", "c": "665d54402951", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 21, "first_seen": 1789799634, "last_seen": 1790199770, "transport": "t", "ja3_hash": "34afa12d10b640211cbf67c4af08a5a8", "ja3_variant_count": 1, "ja3_variants": [ "34afa12d10b640211cbf67c4af08a5a8" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d271200_c42a7efa14d1_6c7ee535e33c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d271200", "b": "c42a7efa14d1", "c": "6c7ee535e33c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-22-23-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 10, "first_seen": 1791142025, "last_seen": 1791217690, "transport": "t", "ja3_hash": "274ef3990c5e0950d49148e75669f7e1", "ja3_variant_count": 1, "ja3_variants": [ "274ef3990c5e0950d49148e75669f7e1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d2712h2_b4f9224df7c1_84ae619bfcdc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2712h2", "b": "b4f9224df7c1", "c": "84ae619bfcdc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-60-61-49188-49192-51-57-103-107-158-159-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1787832856, "last_seen": 1789948495, "transport": "t", "ja3_hash": "35c61a611436bd206b042c36810d36ad", "ja3_variant_count": 1, "ja3_variants": [ "35c61a611436bd206b042c36810d36ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d2712h2_bd9791dd9fd6_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2712h2", "b": "bd9791dd9fd6", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1788490738, "last_seen": 1789930698, "transport": "t", "ja3_hash": "d9f2482281395ce985f6d857e69e64c4", "ja3_variant_count": 2, "ja3_variants": [ "d9f2482281395ce985f6d857e69e64c4", "c2185c98088330cdff0145dcfce4f50b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13d271300_c42a7efa14d1_439777fa9f13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d271300", "b": "c42a7efa14d1", "c": "439777fa9f13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 26, "first_seen": 1789798643, "last_seen": 1790201090, "transport": "t", "ja3_hash": "a1f1aa95d7822b9eb6dda74301f2d31d", "ja3_variant_count": 1, "ja3_variants": [ "a1f1aa95d7822b9eb6dda74301f2d31d" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 26 }, "ua_disagreement": false } }, { "hash": "t13d2713h1_c42a7efa14d1_27df2afde934", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2713h1", "b": "c42a7efa14d1", "c": "27df2afde934", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790502747, "last_seen": 1790502747, "transport": "t", "ja3_hash": "9a6b0d39aa942795f5373dfac00c80d4", "ja3_variant_count": 1, "ja3_variants": [ "9a6b0d39aa942795f5373dfac00c80d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d2713h2_bd9791dd9fd6_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2713h2", "b": "bd9791dd9fd6", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 327, "first_seen": 1788477230, "last_seen": 1790964297, "transport": "t", "ja3_hash": "884e316eab85b7ebf649b54ededca3a6", "ja3_variant_count": 2, "ja3_variants": [ "884e316eab85b7ebf649b54ededca3a6", "c914b1b03e730d6324212d0e6e2103f5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 74, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 77 }, "ua_disagreement": false } }, { "hash": "t13d2713h2_c42a7efa14d1_567d8c15e8cd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2713h2", "b": "c42a7efa14d1", "c": "567d8c15e8cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789311806, "last_seen": 1789915873, "transport": "t", "ja3_hash": "7a12f1c2001593911ef85ba1beca892c", "ja3_variant_count": 1, "ja3_variants": [ "7a12f1c2001593911ef85ba1beca892c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d271400_c42a7efa14d1_468dee8d67d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d271400", "b": "c42a7efa14d1", "c": "468dee8d67d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 27, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51-27-41,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 135, "first_seen": 1789798668, "last_seen": 1790201190, "transport": "t", "ja3_hash": "aa2a482eb0209d2d01798b499241cd56", "ja3_variant_count": 1, "ja3_variants": [ "aa2a482eb0209d2d01798b499241cd56" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 135 }, "ua_disagreement": false } }, { "hash": "t13d2812h2_257f3020b3a2_84ae619bfcdc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2812h2", "b": "257f3020b3a2", "c": "84ae619bfcdc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 28, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-60-61-49161-49171-49162-49172-49187-49188-49192-156-157-47-53-51-57-103-107-158-159,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 50, "first_seen": 1787626678, "last_seen": 1791342638, "transport": "t", "ja3_hash": "c3c1610cb4fbc856ed4f0652eddd3288", "ja3_variant_count": 1, "ja3_variants": [ "c3c1610cb4fbc856ed4f0652eddd3288" ], "user_agents": { "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13d291300_723694b0fccc_3bb9007d4306", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d291300", "b": "723694b0fccc", "c": "3bb9007d4306", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49200-52392-49172-49199-49171-49196-49325-52393-49162-49195-49324-49161-157-49309-53-156-49308-47-159-49311-52394-57-158-49310-51,10-45-23-0-28-51-65281-22-5-13-35-43-11,29-23-30-25-24-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790904285, "last_seen": 1791249905, "transport": "t", "ja3_hash": "32520dc8489ab698c0b2397a8fc5a24e", "ja3_variant_count": 2, "ja3_variants": [ "32520dc8489ab698c0b2397a8fc5a24e", "79cf024bd1ba5978cfdbd9688c41a8df" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d291300_723694b0fccc_c944148a3ac7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d291300", "b": "723694b0fccc", "c": "c944148a3ac7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49162-49325-49195-49161-49324-49200-52392-49172-49199-49171-157-53-49309-156-47-49308-159-52394-57-49311-158-51-49310,5-10-11-13-22-23-35-51-43-65281-0-45-28,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789265854, "last_seen": 1789361955, "transport": "t", "ja3_hash": "dc77af0fe75a1f6074c71845f8d49230", "ja3_variant_count": 1, "ja3_variants": [ "dc77af0fe75a1f6074c71845f8d49230" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d301000_1d37bd780c83_2038e8b55db5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301000", "b": "1d37bd780c83", "c": "2038e8b55db5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 64, "first_seen": 1787625384, "last_seen": 1791156980, "transport": "t", "ja3_hash": "000f09ddfa6bb524e9b0c07931ddb084", "ja3_variant_count": 1, "ja3_variants": [ "000f09ddfa6bb524e9b0c07931ddb084" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 107, "YelpBot (https://www.yelp.com/)": 11 }, "ua_disagreement": false } }, { "hash": "t13d301000_1d37bd780c83_389a908827a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301000", "b": "1d37bd780c83", "c": "389a908827a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-22-23-13-43-45-51-0,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 119, "first_seen": 1787454418, "last_seen": 1791293762, "transport": "t", "ja3_hash": "33ae362844509ccb28660da3cbfca03d", "ja3_variant_count": 1, "ja3_variants": [ "33ae362844509ccb28660da3cbfca03d" ], "user_agents": { "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 45, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 4, "Scrapy/2.17.0 (+https://scrapy.org)": 18 }, "ua_disagreement": false } }, { "hash": "t13d301100_1d37bd780c83_43412d48a437", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301100", "b": "1d37bd780c83", "c": "43412d48a437", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 15, "first_seen": 1787832165, "last_seen": 1791294132, "transport": "t", "ja3_hash": "039a83a63c9eb5abb4c270206a9faa9d", "ja3_variant_count": 1, "ja3_variants": [ "039a83a63c9eb5abb4c270206a9faa9d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3": 48 }, "ua_disagreement": false } }, { "hash": "t13d301100_1d37bd780c83_6ecbdee5c734", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6ecbdee5c734) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d301100", "b": "1d37bd780c83", "c": "6ecbdee5c734", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1167, "first_seen": 1787468466, "last_seen": 1791360013, "transport": "t", "ja3_hash": "27718d56688425cd36a401c66147c4ee", "ja3_variant_count": 2, "ja3_variants": [ "27718d56688425cd36a401c66147c4ee", "0b85eb0d4981e69064e40753e4f0ac5f" ], "user_agents": { "SeltzSitemapFetcher/1.0": 471, "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; I": 1 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d301200_1d37bd780c83_2c84123d7314", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301200", "b": "1d37bd780c83", "c": "2c84123d7314", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1790989720, "last_seen": 1791185366, "transport": "t", "ja3_hash": "9cfef2d216eb9ed3a68fcee3d25860c6", "ja3_variant_count": 1, "ja3_variants": [ "9cfef2d216eb9ed3a68fcee3d25860c6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0": 30 }, "ua_disagreement": false } }, { "hash": "t13d301200_1d37bd780c83_5cffa70d1141", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301200", "b": "1d37bd780c83", "c": "5cffa70d1141", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 39, "first_seen": 1787710537, "last_seen": 1791299548, "transport": "t", "ja3_hash": "eb4b4551f2c04f27c13b2cac537d42ff", "ja3_variant_count": 1, "ja3_variants": [ "eb4b4551f2c04f27c13b2cac537d42ff" ], "user_agents": { "Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.4a) Gecko/20030401": 5, "Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.4b) Gecko/20030516 Mozilla Firebird/0.6": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15": 5 }, "ua_disagreement": false } }, { "hash": "t13d301200_9bc4b2584674_136ffa00a224", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (136ffa00a224) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d301200", "b": "9bc4b2584674", "c": "136ffa00a224", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-52393-52392-49195-49199-49196-49200-158-159-49187-49191-49161-49192-49171-49188-49162-49172-103-51-107-57-156-157-60-61-47-53-255,0-11-10-35-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 23, "first_seen": 1790818972, "last_seen": 1791348909, "transport": "t", "ja3_hash": "e4b65bf7048960d2596e44b224762544", "ja3_variant_count": 1, "ja3_variants": [ "e4b65bf7048960d2596e44b224762544" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d3012h2_1d37bd780c83_be43a87a1363", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3012h2", "b": "1d37bd780c83", "c": "be43a87a1363", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7637, "first_seen": 1787442702, "last_seen": 1791362967, "transport": "t", "ja3_hash": "446fb8bd613d17e5d44bd3b288ac94ca", "ja3_variant_count": 2, "ja3_variants": [ "446fb8bd613d17e5d44bd3b288ac94ca", "db8a6f4f9f8195ea17db377175d2cb08" ], "user_agents": { "curl/8.22.0-rc2": 2, "Mozilla/5.0 verrou-PQC-Scanner/1.15.0": 5, "Mozilla/5.0 ": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 201, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 SecurityHeaders": 6676, "pqcrypta-ip-update/1.0 (us-midwest heartbeat)": 672 }, "ua_disagreement": true } }, { "hash": "t13d3012h2_1d37bd780c83_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3012h2", "b": "1d37bd780c83", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4099, "first_seen": 1787448609, "last_seen": 1791261126, "transport": "t", "ja3_hash": "bb4bfd0ec15f5be2c4225880b93a8b18", "ja3_variant_count": 1, "ja3_variants": [ "bb4bfd0ec15f5be2c4225880b93a8b18" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; SleepBot/1.0; +http://sleepbot.com/) Chrome/131.0.0.0 Safari/537.36": 1722, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 5, "oh-llama/1.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d301300_1d37bd780c83_2b0ed48f4b04", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301300", "b": "1d37bd780c83", "c": "2b0ed48f4b04", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788470753, "last_seen": 1788470753, "transport": "t", "ja3_hash": "0ac7324a79776481ebbd4ad3c0a7860b", "ja3_variant_count": 1, "ja3_variants": [ "0ac7324a79776481ebbd4ad3c0a7860b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d301300_1d37bd780c83_39ecddd7b55d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301300", "b": "1d37bd780c83", "c": "39ecddd7b55d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-49-13-43-45-51-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 101, "first_seen": 1787710538, "last_seen": 1791081122, "transport": "t", "ja3_hash": "09070c12b765f9c0775d04ed2eadeb24", "ja3_variant_count": 1, "ja3_variants": [ "09070c12b765f9c0775d04ed2eadeb24" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.2210.133": 42, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/121.0": 11 }, "ua_disagreement": false } }, { "hash": "t13d301300_1d37bd780c83_4271f981cf51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301300", "b": "1d37bd780c83", "c": "4271f981cf51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 380, "first_seen": 1787463362, "last_seen": 1791321500, "transport": "t", "ja3_hash": "9524fdc98d5b2c3efd160e8906158fa8", "ja3_variant_count": 1, "ja3_variants": [ "9524fdc98d5b2c3efd160e8906158fa8" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0": 83, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 190, "SoonBot/1.0 (+https://soon.ciaransplayground.com)": 4 }, "ua_disagreement": false } }, { "hash": "t13d3013h2_1d37bd780c83_6da051328960", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6da051328960) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d3013h2", "b": "1d37bd780c83", "c": "6da051328960", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-5-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791319586, "last_seen": 1791319586, "transport": "t", "ja3_hash": "434321f1773904326b1b63129953b5cd", "ja3_variant_count": 1, "ja3_variants": [ "434321f1773904326b1b63129953b5cd" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d3014h2_1d37bd780c83_b8a067fa89f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3014h2", "b": "1d37bd780c83", "c": "b8a067fa89f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51-27-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788489863, "last_seen": 1791038874, "transport": "t", "ja3_hash": "2fccaedf5c014eb2ab6bbb4a73fdfc87", "ja3_variant_count": 1, "ja3_variants": [ "2fccaedf5c014eb2ab6bbb4a73fdfc87" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d311000_e8f1e7e78f70_3e0748a2ed56", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "e8f1e7e78f70", "c": "3e0748a2ed56", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787911058, "last_seen": 1791174349, "transport": "t", "ja3_hash": "49e76101e93ff7ad65a47925a25c2cff", "ja3_variant_count": 1, "ja3_variants": [ "49e76101e93ff7ad65a47925a25c2cff" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d311000_e8f1e7e78f70_60527930a971", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "e8f1e7e78f70", "c": "60527930a971", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 468, "first_seen": 1787551524, "last_seen": 1791313765, "transport": "t", "ja3_hash": "a3afc2c46ba4a7d7fbe1cfb7a3031c2f", "ja3_variant_count": 1, "ja3_variants": [ "a3afc2c46ba4a7d7fbe1cfb7a3031c2f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 YaBrowser/25.4.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d311100_1d947a95fc68_95845176f41a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "1d947a95fc68", "c": "95845176f41a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-13-50-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1787552547, "last_seen": 1791350379, "transport": "t", "ja3_hash": "3b1a95acc8030a741dbf6d54b2b67b71", "ja3_variant_count": 1, "ja3_variants": [ "3b1a95acc8030a741dbf6d54b2b67b71" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/600.3.18 (KHTML, like Gecko) Version/8.0.3 Safari/600.3.18": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_173082c9b150", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "173082c9b150", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 204, "first_seen": 1787492933, "last_seen": 1791278130, "transport": "t", "ja3_hash": "c199b43d41b470f8f68c5561f8f1ce3e", "ja3_variant_count": 1, "ja3_variants": [ "c199b43d41b470f8f68c5561f8f1ce3e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 186, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_b2544a34d7f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "b2544a34d7f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-5-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791081871, "last_seen": 1791081871, "transport": "t", "ja3_hash": "9247f1a6c0df0303185af2dfb2ab21ca", "ja3_variant_count": 1, "ja3_variants": [ "9247f1a6c0df0303185af2dfb2ab21ca" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4702, "first_seen": 1787445935, "last_seen": 1791362508, "transport": "t", "ja3_hash": "d39e1be3241d516b1f714bd47c2bc968", "ja3_variant_count": 1, "ja3_variants": [ "d39e1be3241d516b1f714bd47c2bc968" ], "user_agents": { "Mozilla/5.0 (compatible; CT-WP-Probe/1.2)": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/126 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_d5a215a6b957", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "d5a215a6b957", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-13172-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788924250, "last_seen": 1788924250, "transport": "t", "ja3_hash": "71b34f414018bd096ecc05c22b4630c6", "ja3_variant_count": 1, "ja3_variants": [ "71b34f414018bd096ecc05c22b4630c6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_ea55c5214f7d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "ea55c5214f7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-157-156-61-60-53-47-255,0-5-10-11-13-50-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789181034, "last_seen": 1790286743, "transport": "t", "ja3_hash": "f3bacacdad014062f21b944423053cda", "ja3_variant_count": 1, "ja3_variants": [ "f3bacacdad014062f21b944423053cda" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:59.0) Gecko/20100101 Firefox/59.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d3111h2_e8f1e7e78f70_43244b3c42a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3111h2", "b": "e8f1e7e78f70", "c": "43244b3c42a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 177246, "first_seen": 1787444775, "last_seen": 1791363408, "transport": "t", "ja3_hash": "1ce565f411fbc7412e3c5ba0bcfd62ab", "ja3_variant_count": 1, "ja3_variants": [ "1ce565f411fbc7412e3c5ba0bcfd62ab" ], "user_agents": { "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)": 996, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.faceb": 52127, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.co": 99662 }, "ua_disagreement": true } }, { "hash": "t13d311200_1d947a95fc68_30b414fd2f42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311200", "b": "1d947a95fc68", "c": "30b414fd2f42", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 30235, "first_seen": 1787443046, "last_seen": 1791363280, "transport": "t", "ja3_hash": "adbab9d5752f7c834ec405ec92e46415", "ja3_variant_count": 2, "ja3_variants": [ "adbab9d5752f7c834ec405ec92e46415", "6a61e40083a0978aac19a7bd5aad9a19" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_3_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.17 Safari/537.36": 83, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36": 215, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.69 Safari/537.36": 74 }, "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_136ffa00a224", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "136ffa00a224", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 34, "first_seen": 1788503613, "last_seen": 1790224360, "transport": "t", "ja3_hash": "86d37534033d9c5b60a83ff8b2fbeea3", "ja3_variant_count": 1, "ja3_variants": [ "86d37534033d9c5b60a83ff8b2fbeea3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36": 3, "Ruby": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36": 27 }, "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_4a346d76d9b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "4a346d76d9b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-5-22-23-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791081879, "last_seen": 1791081879, "transport": "t", "ja3_hash": "0c59de52d152f2593e57ef3a1db4fc2a", "ja3_variant_count": 1, "ja3_variants": [ "0c59de52d152f2593e57ef3a1db4fc2a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_5db088831031", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "5db088831031", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-49-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789536934, "last_seen": 1789536934, "transport": "t", "ja3_hash": "6f9acb2c779756ec4cf50428532f9896", "ja3_variant_count": 1, "ja3_variants": [ "6f9acb2c779756ec4cf50428532f9896" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_80a66a7241b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "80a66a7241b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1790921695, "last_seen": 1791247878, "transport": "t", "ja3_hash": "428770f704845022589b515d18095279", "ja3_variant_count": 1, "ja3_variants": [ "428770f704845022589b515d18095279" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0": 12 }, "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_b613c2328c02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "b613c2328c02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791149288, "last_seen": 1791149288, "transport": "t", "ja3_hash": "98cf32c3542f7910d87558088043bb3a", "ja3_variant_count": 1, "ja3_variants": [ "98cf32c3542f7910d87558088043bb3a" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d3112h2_e8f1e7e78f70_af1dcfb11df7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112h2", "b": "e8f1e7e78f70", "c": "af1dcfb11df7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-5-16-23-13-43-45-51-21,29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1791215926, "last_seen": 1791216034, "transport": "t", "ja3_hash": "0d3ee3641ea9bbf347d4f0e29e838933", "ja3_variant_count": 1, "ja3_variants": [ "0d3ee3641ea9bbf347d4f0e29e838933" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t13d3112ht_e8f1e7e78f70_6c7c91134a62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112ht", "b": "e8f1e7e78f70", "c": "6c7c91134a62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 198, "first_seen": 1787523154, "last_seen": 1791319585, "transport": "t", "ja3_hash": "3adacb99ecb51ed59c4f6c4ed9a7dcaa", "ja3_variant_count": 1, "ja3_variants": [ "3adacb99ecb51ed59c4f6c4ed9a7dcaa" ], "user_agents": { "Datiobot/0.1 (+https://datio-phi.vercel.app)": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36": 12, "Python/3.12 aiohttp/3.14.3": 6 }, "ua_disagreement": true } }, { "hash": "t13d311300_1d947a95fc68_0f7785612353", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311300", "b": "1d947a95fc68", "c": "0f7785612353", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-17-23-35-13-43-45-50-51-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 61, "first_seen": 1787531202, "last_seen": 1789456329, "transport": "t", "ja3_hash": "57128db24fb3c2fc035d6a39ccb08cac", "ja3_variant_count": 1, "ja3_variants": [ "57128db24fb3c2fc035d6a39ccb08cac" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (compatible; SEOkicks; +https://www.seokicks.de/robot.html)": 4, "Mozilla/5.0 (compatible; heritrix/3.14.2-SNAPSHOT-2026-04-13T06:21:22Z +https://www.image-meta.com)": 35 }, "ua_disagreement": false } }, { "hash": "t13d3113h2_e8f1e7e78f70_2cdd36f09136", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3113h2", "b": "e8f1e7e78f70", "c": "2cdd36f09136", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-13172-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1009, "first_seen": 1787487112, "last_seen": 1791347812, "transport": "t", "ja3_hash": "f436b9416f37d134cadd04886327d3e8", "ja3_variant_count": 1, "ja3_variants": [ "f436b9416f37d134cadd04886327d3e8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 8.0.0; ATU-L11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; arm; Android 9; SM-J400F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 YaApp_Android/10.63 YaSearchBrowser/10.63 BroPP/1.0 SA/1 Mobile Safari/537": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0": 123 }, "ua_disagreement": false } }, { "hash": "t13d3113h2_e8f1e7e78f70_6fab81fbbddb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3113h2", "b": "e8f1e7e78f70", "c": "6fab81fbbddb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-13172-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 88, "first_seen": 1787642796, "last_seen": 1791301511, "transport": "t", "ja3_hash": "4ea056e63b7910cbf543f0c095064dfe", "ja3_variant_count": 1, "ja3_variants": [ "4ea056e63b7910cbf543f0c095064dfe" ], "user_agents": { "Slackbot 1.0 (+https://api.slack.com/robots)": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 14, "Slackbot-LinkExpanding 1.0 (+https://api.slack.com/robots)": 14 }, "ua_disagreement": false } }, { "hash": "t13d3113h2_e8f1e7e78f70_b9cf1a435647", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3113h2", "b": "e8f1e7e78f70", "c": "b9cf1a435647", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-157-156-61-60-53-47-255,0-5-10-11-16-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789798581, "last_seen": 1790209288, "transport": "t", "ja3_hash": "6cdcd76c031562f861291a0d61a9d9b0", "ja3_variant_count": 1, "ja3_variants": [ "6cdcd76c031562f861291a0d61a9d9b0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; SM-G981B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.162 Mobile Safari/537.36": 4, "Mozilla/5.0 (compatible; Dataprovider.com)": 71 }, "ua_disagreement": false } }, { "hash": "t13d3113ht_e8f1e7e78f70_6b9dd2e5c643", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3113ht", "b": "e8f1e7e78f70", "c": "6b9dd2e5c643", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 76, "first_seen": 1787718413, "last_seen": 1791029440, "transport": "t", "ja3_hash": "46531b76d4d69e9c86d481cf71fa4933", "ja3_variant_count": 1, "ja3_variants": [ "46531b76d4d69e9c86d481cf71fa4933" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:31.0) Gecko/20100101 Firefox/31.0": 4, "Mozilla/5.0 (compatible; PisarBot/1.0)": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 28 }, "ua_disagreement": false } }, { "hash": "t13d321000_5138d9e69d38_52a7703c1fdd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d321000", "b": "5138d9e69d38", "c": "52a7703c1fdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 32, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-52393-52392-158-159-52394-49187-49191-49161-49171-49188-49192-49162-49172-103-107-156-157-60-61-47-53-49170-22-10-255,0-11-10-35-5-22-13-43-45-51,29-30-23-21-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790184562, "last_seen": 1790188493, "transport": "t", "ja3_hash": "68372154ed2ccec951d9ba6dd5a6e108", "ja3_variant_count": 1, "ja3_variants": [ "68372154ed2ccec951d9ba6dd5a6e108" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 43 }, "ua_disagreement": false } }, { "hash": "t13d321000_b7b92d878678_0308b505d65b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d321000", "b": "b7b92d878678", "c": "0308b505d65b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 32, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49172-57-49171-51-157-156-61-60-53-47-154-153-150-255,0-11-10-35-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 22, "first_seen": 1789566367, "last_seen": 1789568239, "transport": "t", "ja3_hash": "d0cb9fd7e9ac1d5a44285d06b3833dc2", "ja3_variant_count": 1, "ja3_variants": [ "d0cb9fd7e9ac1d5a44285d06b3833dc2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 233 }, "ua_disagreement": false } }, { "hash": "t13d330900_80cecea31fe6_295fbc80e014", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d330900", "b": "80cecea31fe6", "c": "295fbc80e014", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 33, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-157-156-61-60-53-47-255,0-10-11-13-50-23-43-45-51,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789043199, "last_seen": 1791046217, "transport": "t", "ja3_hash": "5bc54a041cd6063568c95e70de1d4bc6", "ja3_variant_count": 1, "ja3_variants": [ "5bc54a041cd6063568c95e70de1d4bc6" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13d340900_832bd7ce3ea2_b229174c0316", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d340900", "b": "832bd7ce3ea2", "c": "b229174c0316", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 34, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-52393-52392-49195-49199-49196-49200-158-159-49187-49191-49161-49192-49171-49188-49162-49172-103-51-107-57-49160-49170-22-156-157-60-61-47-53-10-255,0-11-10-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788463569, "last_seen": 1788463569, "transport": "t", "ja3_hash": "04f1408fbaed687e2510afff7ea52fdf", "ja3_variant_count": 1, "ja3_variants": [ "04f1408fbaed687e2510afff7ea52fdf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t13d351200_bfa337485184_6c7ee535e33c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6c7ee535e33c) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d351200", "b": "bfa337485184", "c": "6c7ee535e33c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-22-23-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 39, "first_seen": 1788104958, "last_seen": 1791302722, "transport": "t", "ja3_hash": "79528b91a7d3b362447f5c890f9fb708", "ja3_variant_count": 1, "ja3_variants": [ "79528b91a7d3b362447f5c890f9fb708" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d3512ht_bfa337485184_791d1759074c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3512ht", "b": "bfa337485184", "c": "791d1759074c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-16-22-23-49-13-43-45-51,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788833863, "last_seen": 1790807923, "transport": "t", "ja3_hash": "f919ef172bfa751d8355985fbf154b3c", "ja3_variant_count": 1, "ja3_variants": [ "f919ef172bfa751d8355985fbf154b3c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (compatible; DiscoveryBot/1.0)": 2 }, "ua_disagreement": false } }, { "hash": "t13d351300_bfa337485184_5c37d630f182", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d351300", "b": "bfa337485184", "c": "5c37d630f182", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787893158, "last_seen": 1788470880, "transport": "t", "ja3_hash": "89df856fbed53b06863adb3e3d27c505", "ja3_variant_count": 1, "ja3_variants": [ "89df856fbed53b06863adb3e3d27c505" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d3513ht_bfa337485184_567d8c15e8cd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3513ht", "b": "bfa337485184", "c": "567d8c15e8cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-4587-4589-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1788332706, "last_seen": 1791167090, "transport": "t", "ja3_hash": "42cb4ba4c818da3ce6424cb212377c24", "ja3_variant_count": 1, "ja3_variants": [ "42cb4ba4c818da3ce6424cb212377c24" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 7, "URLBuilder/2.0 (research crawler; set a contact address here)": 2, "Mozilla/5.0 (compatible; DiscoveryBot/1.0)": 6 }, "ua_disagreement": false } }, { "hash": "t13d351400_bfa337485184_3db6827a426b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d351400", "b": "bfa337485184", "c": "3db6827a426b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51-27-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 248, "first_seen": 1789798341, "last_seen": 1790201417, "transport": "t", "ja3_hash": "caf8598cced3c5a2cee76e5f2f4e5e1f", "ja3_variant_count": 1, "ja3_variants": [ "caf8598cced3c5a2cee76e5f2f4e5e1f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 248 }, "ua_disagreement": false } }, { "hash": "t13d361000_bcee18a5b459_389a908827a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (389a908827a0) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d361000", "b": "bcee18a5b459", "c": "389a908827a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49188-49192-49162-49172-49311-107-57-49324-49187-49191-49161-49171-49310-103-51-157-156-49309-49308-61-60-53-47,65281-11-10-22-23-13-43-45-51-0,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788155902, "last_seen": 1791298553, "transport": "t", "ja3_hash": "b86120d79287048bf5f46a2992b514cb", "ja3_variant_count": 1, "ja3_variants": [ "b86120d79287048bf5f46a2992b514cb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2)": 8 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d361100_018971650b2c_c4bb350abab6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d361100", "b": "018971650b2c", "c": "c4bb350abab6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789231356, "last_seen": 1789231362, "transport": "t", "ja3_hash": "58b4a68113f964e19d977ee28575751a", "ja3_variant_count": 1, "ja3_variants": [ "58b4a68113f964e19d977ee28575751a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d3612h1_bcee18a5b459_be43a87a1363", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3612h1", "b": "bcee18a5b459", "c": "be43a87a1363", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790796300, "last_seen": 1790796300, "transport": "t", "ja3_hash": "c986125a996825fa036306ac7699db59", "ja3_variant_count": 1, "ja3_variants": [ "c986125a996825fa036306ac7699db59" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d3612ht_018971650b2c_2b7f4d1bb443", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3612ht", "b": "018971650b2c", "c": "2b7f4d1bb443", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 104, "first_seen": 1787455745, "last_seen": 1791134551, "transport": "t", "ja3_hash": "329b565abdf75223103131e11ead4844", "ja3_variant_count": 1, "ja3_variants": [ "329b565abdf75223103131e11ead4844" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d3612ht_018971650b2c_f7fc4ab940eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3612ht", "b": "018971650b2c", "c": "f7fc4ab940eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 132, "first_seen": 1787445553, "last_seen": 1791231844, "transport": "t", "ja3_hash": "8ecd69af8e3262389176342e8165854e", "ja3_variant_count": 1, "ja3_variants": [ "8ecd69af8e3262389176342e8165854e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 128, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d3613ht_018971650b2c_1b4599a2a42a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3613ht", "b": "018971650b2c", "c": "1b4599a2a42a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-16-22-23-49-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787882288, "last_seen": 1791292428, "transport": "t", "ja3_hash": "1ee96c96da0a44dc79c063f3d88105f5", "ja3_variant_count": 1, "ja3_variants": [ "1ee96c96da0a44dc79c063f3d88105f5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d3613ht_bcee18a5b459_23c7dd8c4d5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3613ht", "b": "bcee18a5b459", "c": "23c7dd8c4d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 19, "first_seen": 1787695625, "last_seen": 1791276236, "transport": "t", "ja3_hash": "114a5a24bfd39d2e70adabd3a205029f", "ja3_variant_count": 1, "ja3_variants": [ "114a5a24bfd39d2e70adabd3a205029f" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0 Safari/537.36": 6, "python-requests/2.32.3": 2 }, "ua_disagreement": true } }, { "hash": "t13d3614ht_bcee18a5b459_ed8524ea7a97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3614ht", "b": "bcee18a5b459", "c": "ed8524ea7a97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-0-11-10-35-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 28, "first_seen": 1787864840, "last_seen": 1791048645, "transport": "t", "ja3_hash": "42f276190a111f16589fafca4399a9d6", "ja3_variant_count": 1, "ja3_variants": [ "42f276190a111f16589fafca4399a9d6" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d371200_db35923f8641_f0d148687978", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d371200", "b": "db35923f8641", "c": "f0d148687978", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 37, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 32, "first_seen": 1788654168, "last_seen": 1791156608, "transport": "t", "ja3_hash": "0a0d72200639a7a39887b9d81a247310", "ja3_variant_count": 1, "ja3_variants": [ "0a0d72200639a7a39887b9d81a247310" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5 (TestUserAgent)": 7, "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d371300_db35923f8641_fb34c6f268a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d371300", "b": "db35923f8641", "c": "fb34c6f268a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 37, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 34, "first_seen": 1788923179, "last_seen": 1790987392, "transport": "t", "ja3_hash": "a391c8ec005d3a6a8aafc394edf6c1c2", "ja3_variant_count": 1, "ja3_variants": [ "a391c8ec005d3a6a8aafc394edf6c1c2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.21 (KHTML, like Gecko) Chrome/19.0.1042.0 Safari/535.21": 1 }, "ua_disagreement": false } }, { "hash": "t13d4311ht_c7886603b240_d448f5ea0137", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4311ht", "b": "c7886603b240", "c": "d448f5ea0137", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 43, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 199, "first_seen": 1788393656, "last_seen": 1791342165, "transport": "t", "ja3_hash": "1401686b7c2c7223309a4b924ae84ade", "ja3_variant_count": 1, "ja3_variants": [ "1401686b7c2c7223309a4b924ae84ade" ], "user_agents": { "Dalvik/2.1.0 (Linux; U; Android 9.0; ZTE BA520 Build/MRA58K)": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36": 195, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/601.1.27 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/601.1.27": 2 }, "ua_disagreement": false } }, { "hash": "t13d431200_c7886603b240_f6d223e2d5c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d431200", "b": "c7886603b240", "c": "f6d223e2d5c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 43, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 22, "first_seen": 1788803515, "last_seen": 1791149894, "transport": "t", "ja3_hash": "5fb798ffef091e3699f344d0d0895792", "ja3_variant_count": 1, "ja3_variants": [ "5fb798ffef091e3699f344d0d0895792" ], "user_agents": { "Mozilla/5.0": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 18, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d4312h1_c7886603b240_6c7c91134a62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4312h1", "b": "c7886603b240", "c": "6c7c91134a62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 43, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791037031, "last_seen": 1791037031, "transport": "t", "ja3_hash": "076058bf79a70eb604200cfaac7d9bf8", "ja3_variant_count": 1, "ja3_variants": [ "076058bf79a70eb604200cfaac7d9bf8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d4312ht_c7886603b240_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4312ht", "b": "c7886603b240", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 43, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1717, "first_seen": 1787447968, "last_seen": 1791362495, "transport": "t", "ja3_hash": "07ff1e545ef8ab3fcf8a4dc9272221c2", "ja3_variant_count": 2, "ja3_variants": [ "07ff1e545ef8ab3fcf8a4dc9272221c2", "8d9f7747675e24454cd9b7ed35c58707" ], "user_agents": { "Mozilla/5.096783921 Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 147, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 207, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2161 }, "ua_disagreement": false } }, { "hash": "t13d4313h1_c7886603b240_6b9dd2e5c643", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6b9dd2e5c643) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d4313h1", "b": "c7886603b240", "c": "6b9dd2e5c643", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 43, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791323938, "last_seen": 1791323938, "transport": "t", "ja3_hash": "e45087c66343de692972e62d757ac385", "ja3_variant_count": 1, "ja3_variants": [ "e45087c66343de692972e62d757ac385" ], "user_agents": { "longcontext-sourcing/1.0 (+technical source discovery; contact: local agent run)": 1 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d441200_fd39b124ee10_f6d223e2d5c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d441200", "b": "fd39b124ee10", "c": "f6d223e2d5c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 44, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1787540034, "last_seen": 1791196583, "transport": "t", "ja3_hash": "7fa6c8a6bf61ccc693e36c73d8b45f41", "ja3_variant_count": 1, "ja3_variants": [ "7fa6c8a6bf61ccc693e36c73d8b45f41" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0": 1, "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d450900_d524c25c267f_295fbc80e014", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d450900", "b": "d524c25c267f", "c": "295fbc80e014", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 45, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-10-11-13-50-23-43-45-51,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7942, "first_seen": 1787442878, "last_seen": 1791361236, "transport": "t", "ja3_hash": "479b976148ec2a1a195ae2e15805fefa", "ja3_variant_count": 1, "ja3_variants": [ "479b976148ec2a1a195ae2e15805fefa" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5 (Gort)": 646, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/605.1.15": 34, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36": 7239 }, "ua_disagreement": false } }, { "hash": "t13d451000_d524c25c267f_3f413ad7895a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d451000", "b": "d524c25c267f", "c": "3f413ad7895a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 45, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-10-11-13-50-23-43-45-51-41,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 18, "first_seen": 1790531834, "last_seen": 1791239796, "transport": "t", "ja3_hash": "862742212d658156b9d7215381c3a4b7", "ja3_variant_count": 1, "ja3_variants": [ "862742212d658156b9d7215381c3a4b7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13d451100_d524c25c267f_afd444485979", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d451100", "b": "d524c25c267f", "c": "afd444485979", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 45, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-49196-49195-49200-157-49198-49202-159-163-49199-156-49197-49201-158-162-49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-255,0-5-10-11-13-50-17-23-43-45-51,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787547885, "last_seen": 1791262827, "transport": "t", "ja3_hash": "6f0d86606b7ca191fbd2c072e4f99f9f", "ja3_variant_count": 1, "ja3_variants": [ "6f0d86606b7ca191fbd2c072e4f99f9f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "YisouSpider": 23 }, "ua_disagreement": false } }, { "hash": "t13d461100_0cb0c5806038_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d461100", "b": "0cb0c5806038", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 46, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49327-49325-49245-49249-49195-49199-49326-49324-49244-49248-49188-49192-49267-49271-49187-49191-49266-49270-49162-49172-49161-49171-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790777422, "last_seen": 1790777422, "transport": "t", "ja3_hash": "32fb75b86f98c45b36c7317d9bf985c0", "ja3_variant_count": 1, "ja3_variants": [ "32fb75b86f98c45b36c7317d9bf985c0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d491000_834380eab35e_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d491000", "b": "834380eab35e", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-163-159-162-158-52394-49327-49325-49188-49192-49162-49172-49315-49311-107-106-57-56-49326-49324-49187-49191-49161-49171-49314-49310-103-64-51-50-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 62, "first_seen": 1787717765, "last_seen": 1791293855, "transport": "t", "ja3_hash": "c3bd146e335e754c321db7baee4b2cf1", "ja3_variant_count": 1, "ja3_variants": [ "c3bd146e335e754c321db7baee4b2cf1" ], "user_agents": { "Mozilla/5.0101097241 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36": 3, "Mozilla/5.051975669 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36": 2, "Mozilla/5.066704189 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13d491100_bd868743f55c_afd444485979", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (afd444485979) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d491100", "b": "bd868743f55c", "c": "afd444485979", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-5-10-11-13-50-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789812536, "last_seen": 1789812536, "transport": "t", "ja3_hash": "2c7b42976f538f0759bad05220ba8e2d", "ja3_variant_count": 1, "ja3_variants": [ "2c7b42976f538f0759bad05220ba8e2d" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d4913h2_bd868743f55c_67923868ce16", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4913h2", "b": "bd868743f55c", "c": "67923868ce16", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-5-10-11-16-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789608586, "last_seen": 1789656259, "transport": "t", "ja3_hash": "62f6a6727fda5a1104d5b147cd82e520", "ja3_variant_count": 1, "ja3_variants": [ "62f6a6727fda5a1104d5b147cd82e520" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d520900_7faecdd2bbb4_295fbc80e014", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d520900", "b": "7faecdd2bbb4", "c": "295fbc80e014", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-49160-49170-22-19-49155-49165-10-255,0-10-11-13-50-23-43-45-51,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789725414, "last_seen": 1789725414, "transport": "t", "ja3_hash": "087ee3566e951eff4a754d09329fa1c6", "ja3_variant_count": 1, "ja3_variants": [ "087ee3566e951eff4a754d09329fa1c6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/121.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d521100_b262b3658495_6ecbdee5c734", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d521100", "b": "b262b3658495", "c": "6ecbdee5c734", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 911, "first_seen": 1787500185, "last_seen": 1791363052, "transport": "t", "ja3_hash": "944d1e1858cd278718f8a46b65d3212f", "ja3_variant_count": 3, "ja3_variants": [ "944d1e1858cd278718f8a46b65d3212f", "b01117ea1f10cac905ca73e33a078c75", "0bfaf0ce57f1e5476668c0bcff35e70e" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36": 9, "FudgeResearchBot/1.0 (+https://design.withfudge.com; simdi@withfudge.com)": 5, "YisouSpider": 109, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "ArenaUnfurlBot/1.0 (Link preview bot for AI model comparison platform; +https://arena.ai) Mozilla/5.0 (compatible)": 6 }, "ua_disagreement": false } }, { "hash": "t13d521200_b262b3658495_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d521200", "b": "b262b3658495", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788916044, "last_seen": 1789972141, "transport": "t", "ja3_hash": "8a6ffa496f0369be9fba044efee40f80", "ja3_variant_count": 1, "ja3_variants": [ "8a6ffa496f0369be9fba044efee40f80" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13d5212h2_b262b3658495_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d5212h2", "b": "b262b3658495", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1281, "first_seen": 1787510925, "last_seen": 1791362061, "transport": "t", "ja3_hash": "d67b094811e5145139d7cea5f014309f", "ja3_variant_count": 1, "ja3_variants": [ "d67b094811e5145139d7cea5f014309f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 24, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; BuiltWith/1.4; rb.gy/xprgqj) Chrome/124.0.0.0 Safari/537.36": 94, "FraunhoferSIT-DomainIntel/1.0 (domain measurement study; Fraunhofer Institute for Secure Information Technology SIT; contact: tobias.gattermayer@sit.fraunhofer.de)": 16 }, "ua_disagreement": false } }, { "hash": "t13d5212ht_b262b3658495_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d5212ht", "b": "b262b3658495", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787669954, "last_seen": 1791133844, "transport": "t", "ja3_hash": "983846581fdb62fafdb21d2282592c57", "ja3_variant_count": 2, "ja3_variants": [ "983846581fdb62fafdb21d2282592c57", "1808993db60a053eb8ce0eb1c51750d6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Salesguy/1.0 (+https://salesguy.com/why)": 2, "Mozilla/5.0 (compatible; ProductCandidate/0.1; +local-research)": 4, "favi.sh/1.0 (+https://favi.sh/legal/abuse; logo fetcher; contact abuse@favi.sh)": 2, "Mozilla/5.0 (compatible; NewsltrBot/1.0; +https://www.newsltr.ca)": 1, "Unite-ResolveUrl/1.0": 1, "node": 1 }, "ua_disagreement": false } }, { "hash": "t13d5213ht_b262b3658495_64d09470ca3c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d5213ht", "b": "b262b3658495", "c": "64d09470ca3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1896, "first_seen": 1787759448, "last_seen": 1791362062, "transport": "t", "ja3_hash": "30490d79325943f1ebf6750aae4e304c", "ja3_variant_count": 1, "ja3_variants": [ "30490d79325943f1ebf6750aae4e304c" ], "user_agents": { "node": 18090, "Mozilla/5.0 (compatible; QlyzeBot/1.0; +https://app.qlyze.io/bot)": 26, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13d531000_ed6c8d7875f9_60527930a971", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d531000", "b": "ed6c8d7875f9", "c": "60527930a971", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 53, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1787579685, "last_seen": 1790333356, "transport": "t", "ja3_hash": "84c5a0e20a05f30088adf77a111f86ba", "ja3_variant_count": 1, "ja3_variants": [ "84c5a0e20a05f30088adf77a111f86ba" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13d591000_a33745022dd6_1075c442c310", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d591000", "b": "a33745022dd6", "c": "1075c442c310", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 59, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 170, "first_seen": 1787458669, "last_seen": 1791323553, "transport": "t", "ja3_hash": "0cce74b0d9b7f8528fb2181588d23793", "ja3_variant_count": 1, "ja3_variants": [ "0cce74b0d9b7f8528fb2181588d23793" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; ClaudeBot/1.0; +claudebot@anthropic.com)": 31, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13d591100_a33745022dd6_73d3357defd0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d591100", "b": "a33745022dd6", "c": "73d3357defd0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 59, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790202925, "last_seen": 1791138174, "transport": "t", "ja3_hash": "a685258a6b9efe7d51633cf248ba2c83", "ja3_variant_count": 1, "ja3_variants": [ "a685258a6b9efe7d51633cf248ba2c83" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.8052.1642 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d5911ht_a33745022dd6_4086b72c8bfb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d5911ht", "b": "a33745022dd6", "c": "4086b72c8bfb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 59, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 474, "first_seen": 1787562959, "last_seen": 1791274206, "transport": "t", "ja3_hash": "1a28e69016765d92e3b381168d68922c", "ja3_variant_count": 1, "ja3_variants": [ "1a28e69016765d92e3b381168d68922c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15": 2, "node": 3476, "mcpsee-observatory/0.1.0 (+https://mcpsee.com)": 80 }, "ua_disagreement": false } }, { "hash": "t13d681100_13e0e9e1c501_6ecbdee5c734", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (6ecbdee5c734) with 2 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d681100", "b": "13e0e9e1c501", "c": "6ecbdee5c734", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 68, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-162-163-159-49191-49187-49171-49161-49192-49188-49172-49162-103-51-64-107-56-57-156-157-49324-49310-50-49308-60-47-49325-49311-106-49309-61-53-52393-52392-52394-49245-49249-49239-49235-49244-49248-49238-49234-49267-49271-196-195-49266-49270-190-189-136-135-69-68-49233-49232-192-186-132-65,65281-0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 262, "first_seen": 1787456526, "last_seen": 1791358877, "transport": "t", "ja3_hash": "8c62649fec22c17049a59e7d05c53484", "ja3_variant_count": 2, "ja3_variants": [ "8c62649fec22c17049a59e7d05c53484", "d1fbc036c01e61dd08a74292b08430d6" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d691000_8b2139ff7677_c77473ed3a43", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d691000", "b": "8b2139ff7677", "c": "c77473ed3a43", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51,4588-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789119243, "last_seen": 1789131801, "transport": "t", "ja3_hash": "fc01617548c3d00273cf57901ba5602a", "ja3_variant_count": 1, "ja3_variants": [ "fc01617548c3d00273cf57901ba5602a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13d691100_8b2139ff7677_35692a61e658", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d691100", "b": "8b2139ff7677", "c": "35692a61e658", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 60, "first_seen": 1787810396, "last_seen": 1790154054, "transport": "t", "ja3_hash": "85ba585fa57b7a441a1b0dd6f2b85d90", "ja3_variant_count": 1, "ja3_variants": [ "85ba585fa57b7a441a1b0dd6f2b85d90" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 43, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13d691100_8b2139ff7677_ac2311016557", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d691100", "b": "8b2139ff7677", "c": "ac2311016557", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51-41,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 43, "first_seen": 1787810497, "last_seen": 1790154054, "transport": "t", "ja3_hash": "87e71c0467fafa13b2d8d0fea645a7d3", "ja3_variant_count": 2, "ja3_variants": [ "87e71c0467fafa13b2d8d0fea645a7d3", "7ada50d13957b8015fe585c0e38b5bc3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 1322, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 127, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d6911h2_8b2139ff7677_95bd209da7e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d6911h2", "b": "8b2139ff7677", "c": "95bd209da7e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 11, "first_seen": 1789119248, "last_seen": 1789134599, "transport": "t", "ja3_hash": "a0da5209e1c60415f59eda3f2cd5e7fe", "ja3_variant_count": 1, "ja3_variants": [ "a0da5209e1c60415f59eda3f2cd5e7fe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 466 }, "ua_disagreement": false } }, { "hash": "t13d691200_8b2139ff7677_0778cb588346", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d691200", "b": "8b2139ff7677", "c": "0778cb588346", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 78, "first_seen": 1789120618, "last_seen": 1790686568, "transport": "t", "ja3_hash": "1700d1961c5836e896b9611a8a85713c", "ja3_variant_count": 1, "ja3_variants": [ "1700d1961c5836e896b9611a8a85713c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 47, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 84 }, "ua_disagreement": false } }, { "hash": "t13d691200_ea0618708e31_b613c2328c02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (b613c2328c02) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d691200", "b": "ea0618708e31", "c": "b613c2328c02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": null } }, "ja3_string": "771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 27, "first_seen": 1787457272, "last_seen": 1791353898, "transport": "t", "ja3_hash": "4ab40ed46d2f0f15292e2ccc59b55f0d", "ja3_variant_count": 1, "ja3_variants": [ "4ab40ed46d2f0f15292e2ccc59b55f0d" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d6912h2_8b2139ff7677_c5ac172ddf95", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d6912h2", "b": "8b2139ff7677", "c": "c5ac172ddf95", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 173, "first_seen": 1787810394, "last_seen": 1791306756, "transport": "t", "ja3_hash": "24f150d25e5f0f4327e4f3e210bb89c8", "ja3_variant_count": 1, "ja3_variants": [ "24f150d25e5f0f4327e4f3e210bb89c8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 30, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d6912ht_8b2139ff7677_8f650188da36", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d6912ht", "b": "8b2139ff7677", "c": "8f650188da36", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-16-22-23-13-43-45-51-41,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789458274, "last_seen": 1791303617, "transport": "t", "ja3_hash": "970a8f9cb1ad50badefb3538d0b3e3e1", "ja3_variant_count": 1, "ja3_variants": [ "970a8f9cb1ad50badefb3538d0b3e3e1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d6913h2_8b2139ff7677_123bc1990f87", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d6913h2", "b": "8b2139ff7677", "c": "123bc1990f87", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-35-5-16-22-23-13-43-45-51-21,29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 92, "first_seen": 1789120623, "last_seen": 1790158869, "transport": "t", "ja3_hash": "4f9b0e26fc64e24476d5a62fed9b04d1", "ja3_variant_count": 1, "ja3_variants": [ "4f9b0e26fc64e24476d5a62fed9b04d1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 452, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t13d751100_479067518aa3_173082c9b150", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d751100", "b": "479067518aa3", "c": "173082c9b150", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 75, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-163-159-162-158-52394-49327-49325-49188-49192-49162-49172-49315-49311-107-106-57-56-49326-49324-49187-49191-49161-49171-49314-49310-103-64-51-50-49245-49249-49244-49248-49267-49271-49266-49270-49239-49235-49238-49234-196-195-190-189-136-135-69-68-157-156-49313-49309-49312-49308-61-60-53-47-49233-49232-192-186-132-65-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789277334, "last_seen": 1789277626, "transport": "t", "ja3_hash": "da12c94da8021bbaf502907ad086e7bc", "ja3_variant_count": 1, "ja3_variants": [ "da12c94da8021bbaf502907ad086e7bc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d751100_479067518aa3_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d751100", "b": "479067518aa3", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 75, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-162-163-159-49191-49187-49171-49161-49192-49188-49172-49162-103-51-64-107-56-57-156-157-49326-49324-49314-49310-50-49312-49308-60-47-49327-49325-49315-49311-106-49313-49309-61-53-52393-52392-52394-49245-49249-49239-49235-49244-49248-49238-49234-49267-49271-196-195-49266-49270-190-189-136-135-69-68-49233-49232-192-186-132-65-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 33, "first_seen": 1787495622, "last_seen": 1791276730, "transport": "t", "ja3_hash": "a468eae2a82cd86fea9fd0c541ed8ff0", "ja3_variant_count": 4, "ja3_variants": [ "a468eae2a82cd86fea9fd0c541ed8ff0", "d220a0948b0aa07286b432e28a19f5b5", "5232f1c67a1d474ee004f996d7a1ef9f", "1c1cd8b08328d6eb175075eb50739048" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Trailer/93.3.8652.5": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.3": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.1958": 1 }, "ua_disagreement": false } }, { "hash": "t13d781100_ab95583b6d39_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (cf86beea0419) with 7 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d781100", "b": "ab95583b6d39", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 78, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-150-65-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1790670677, "last_seen": 1790670696, "transport": "t", "ja3_hash": "24b17abb1c18a4c5eb806eb218774f32", "ja3_variant_count": 1, "ja3_variants": [ "24b17abb1c18a4c5eb806eb218774f32" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d781200_ab95583b6d39_80a66a7241b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d781200", "b": "ab95583b6d39", "c": "80a66a7241b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 78, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-150-65-255,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789812960, "last_seen": 1789812960, "transport": "t", "ja3_hash": "e2365f4bb718d121f8db95865f8b0192", "ja3_variant_count": 1, "ja3_variants": [ "e2365f4bb718d121f8db95865f8b0192" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 15.2; rv:119.0) Gecko/20100101 Firefox/119.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d871000_c66346c74e42_c09c0586aa1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d871000", "b": "c66346c74e42", "c": "c09c0586aa1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 87, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-255,0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 19, "first_seen": 1787584187, "last_seen": 1790898561, "transport": "t", "ja3_hash": "de72b07c9190406d2e3e50ed41573c79", "ja3_variant_count": 1, "ja3_variants": [ "de72b07c9190406d2e3e50ed41573c79" ], "user_agents": { "curl/8.14.1": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d9013h2_c6771aded2ed_be6b31666b21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d9013h2", "b": "c6771aded2ed", "c": "be6b31666b21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 90, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788662530, "last_seen": 1789831657, "transport": "t", "ja3_hash": "1d573f07cf9592c93700cd3f524279e0", "ja3_variant_count": 1, "ja3_variants": [ "1d573f07cf9592c93700cd3f524279e0" ], "user_agents": { "Mozilla/5.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d911000_0d5420ba6086_c09c0586aa1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d911000", "b": "0d5420ba6086", "c": "c09c0586aa1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 91, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65-255,0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1791254101, "last_seen": 1791254105, "transport": "t", "ja3_hash": "45207ca35a1e95cffd5dd9df9f95c873", "ja3_variant_count": 1, "ja3_variants": [ "45207ca35a1e95cffd5dd9df9f95c873" ], "user_agents": { "Mozilla/5.0 Chrome/124.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d911100_0d5420ba6086_3d6bface6ca2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d911100", "b": "0d5420ba6086", "c": "3d6bface6ca2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 91, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65-255,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1791048858, "last_seen": 1791319988, "transport": "t", "ja3_hash": "e332d3ae2b11b385c085017f097ca30d", "ja3_variant_count": 2, "ja3_variants": [ "e332d3ae2b11b385c085017f097ca30d", "8230ec99306445c532ac814af25e4e91" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13d9112ht_0d5420ba6086_3fc9930d72b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d9112ht", "b": "0d5420ba6086", "c": "3fc9930d72b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 91, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65-255,0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789488664, "last_seen": 1790866113, "transport": "t", "ja3_hash": "fa3a9d56d33ec3d9cfe479b7017482e8", "ja3_variant_count": 1, "ja3_variants": [ "fa3a9d56d33ec3d9cfe479b7017482e8" ], "user_agents": { "Mozilla/5.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36": 2, "Python/3.14 aiohttp/3.14.1": 1 }, "ua_disagreement": true } }, { "hash": "t13d921000_1a0666d6c920_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d921000", "b": "1a0666d6c920", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 92, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-167-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-166-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-7-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789122139, "last_seen": 1789122139, "transport": "t", "ja3_hash": "155d76c346dc6d93f3164cde50581e11", "ja3_variant_count": 1, "ja3_variants": [ "155d76c346dc6d93f3164cde50581e11" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d9912ht_ee3966d44962_1c142f2ba1d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d9912ht", "b": "ee3966d44962", "c": "1c142f2ba1d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 99, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1724, "first_seen": 1787442950, "last_seen": 1791353127, "transport": "t", "ja3_hash": "6fcafe7a659fde3135f818ad9eb434ad", "ja3_variant_count": 1, "ja3_variants": [ "6fcafe7a659fde3135f818ad9eb434ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)": 9217 }, "ua_disagreement": false } }, { "hash": "t13i030800_55b375c5d22e_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i030800", "b": "55b375c5d22e", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 50, "first_seen": 1787469787, "last_seen": 1791339454, "transport": "t", "ja3_hash": "7f9afda94eb685adc8d863d934bf54bd", "ja3_variant_count": 2, "ja3_variants": [ "7f9afda94eb685adc8d863d934bf54bd", "f3a0f342a0d8b55571c42532cf0445dc" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i100900_61a7ad8aa9b6_56c777df044d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i100900", "b": "61a7ad8aa9b6", "c": "56c777df044d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-13-43-10-11-5-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788886857, "last_seen": 1788886857, "transport": "t", "ja3_hash": "96758dba33c0555f410a979860d1c5fd", "ja3_variant_count": 1, "ja3_variants": [ "96758dba33c0555f410a979860d1c5fd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i130900_f57a46bbacb6_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i130900", "b": "f57a46bbacb6", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 205, "first_seen": 1787557832, "last_seen": 1791343424, "transport": "t", "ja3_hash": "6639916abfac56b9257ca216677085bc", "ja3_variant_count": 3, "ja3_variants": [ "6639916abfac56b9257ca216677085bc", "674c9b60629e4885877f5ec76f21723e", "7a0f9f4cd2d2795734f1c6a19c8020c4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 1, "Go-http-client/1.1": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0": 83, "RecordedFuture Global Inventory Crawler": 26, "Mozilla/5.0": 7, "what-vpn-go/0.1": 2, "Mozilla/5.0 (compatible; what-vpn-go/0.1)": 3 }, "ua_disagreement": true } }, { "hash": "t13i131000_f57a46bbacb6_2dd10c1a5aba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131000", "b": "f57a46bbacb6", "c": "2dd10c1a5aba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787851177, "last_seen": 1789208913, "transport": "t", "ja3_hash": "2bb8066f8aef758fe0ebdf26ce012609", "ja3_variant_count": 1, "ja3_variants": [ "2bb8066f8aef758fe0ebdf26ce012609" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.318.108 Safari/537.36; compatible; Claude-User/1.0; +Claude-User@anthropic.com": 1, "Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.3533.1 Mobile Safari/537.36; compatible; Claude-User/1.0; +https://www.anthropic.com/cl": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_1) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user) Chrome/85.0.6466.15 Safar": 1 }, "ua_disagreement": false } }, { "hash": "t13i131000_f57a46bbacb6_ab7e3b40a677", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131000", "b": "f57a46bbacb6", "c": "ab7e3b40a677", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2327, "first_seen": 1787450443, "last_seen": 1791361774, "transport": "t", "ja3_hash": "2196848d251b217de8b2c037e356c11d", "ja3_variant_count": 4, "ja3_variants": [ "2196848d251b217de8b2c037e356c11d", "725543c78edf669194c11dc7a039b56e", "fcf8fb9a64c165eafca9822192c1b969", "006598cf32b8feecd39e4337bdba9c44" ], "user_agents": { "Mozilla/5.0 (compatible; Scanner/1.0)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 52, "curl/7.61.1": 30, "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 234, "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity": 48 }, "ua_disagreement": true } }, { "hash": "t13i131000_f57a46bbacb6_e5728521abd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131000", "b": "f57a46bbacb6", "c": "e5728521abd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 30, "first_seen": 1787609843, "last_seen": 1790339481, "transport": "t", "ja3_hash": "ad8e2ddea9ec0a77edc063c36fc6cecc", "ja3_variant_count": 1, "ja3_variants": [ "ad8e2ddea9ec0a77edc063c36fc6cecc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Android 14; Mobile; rv:123.0) Gecko/123.0 Firefox/123": 1, "Mozilla/5.0 (Linux; Android 12; SAMSUNG SM-A415F) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/23.0 Chrome/115.0.0.0 Mobile Safari/537.3": 1 }, "ua_disagreement": false } }, { "hash": "t13i1310h1_f57a46bbacb6_da06f2e414f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (da06f2e414f4) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13i1310h1", "b": "f57a46bbacb6", "c": "da06f2e414f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790693656, "last_seen": 1790693656, "transport": "t", "ja3_hash": "faa162b5a653756fba26803ea81b362f", "ja3_variant_count": 1, "ja3_variants": [ "faa162b5a653756fba26803ea81b362f" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13i1311ht_f57a46bbacb6_d86ca3cca451", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1311ht", "b": "f57a46bbacb6", "c": "d86ca3cca451", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 60, "first_seen": 1787889953, "last_seen": 1791279660, "transport": "t", "ja3_hash": "60828da5b42313d165aae2938e651b72", "ja3_variant_count": 1, "ja3_variants": [ "60828da5b42313d165aae2938e651b72" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 74, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/128 Safari/537.36": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i131200_f57a46bbacb6_7e55ffd90fc1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131200", "b": "f57a46bbacb6", "c": "7e55ffd90fc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 12, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-43-51-45-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 232, "first_seen": 1787851177, "last_seen": 1789208911, "transport": "t", "ja3_hash": "879fcbac0ba29304629c82b09581bd46", "ja3_variant_count": 1, "ja3_variants": [ "879fcbac0ba29304629c82b09581bd46" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GrokBot/1.0; +https://x.ai/grokbot)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Applebot/0.1; +http://www.apple.com/go/applebot) Chrome/126.0.7356.112 Safari/537": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko; compatible; Discordbot/2.0; +https://discordapp.com) Chrome/134.0.2218.58 Safari/537.36 Edg/134.0.2": 1 }, "ua_disagreement": false } }, { "hash": "t13i141000_cbb2034c60b8_e5728521abd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i141000", "b": "cbb2034c60b8", "c": "e5728521abd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 14, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 171, "first_seen": 1787622537, "last_seen": 1791353586, "transport": "t", "ja3_hash": "2079bcc000c9a54e0784733c0142d140", "ja3_variant_count": 1, "ja3_variants": [ "2079bcc000c9a54e0784733c0142d140" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i150200_8daaf6152771_e73cb7da2dfc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150200", "b": "8daaf6152771", "c": "e73cb7da2dfc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 13, "first_seen": 1787842970, "last_seen": 1791253691, "transport": "t", "ja3_hash": "e51aedfd800e8a9d7b36f565cf3f1508", "ja3_variant_count": 2, "ja3_variants": [ "e51aedfd800e8a9d7b36f565cf3f1508", "9408a596e0b027c12769d98b42cdff84" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 6 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_04b14dc380a8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "04b14dc380a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789539388, "last_seen": 1790575040, "transport": "t", "ja3_hash": "b4840cb7a136ee5bcfffaab3b70c216f", "ja3_variant_count": 2, "ja3_variants": [ "b4840cb7a136ee5bcfffaab3b70c216f", "2d15e663cc6f7da6100b4b5607c8261e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_215f3d469cd5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "215f3d469cd5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789319845, "last_seen": 1790541635, "transport": "t", "ja3_hash": "78a605d37b3a6c4468fc4393269337d1", "ja3_variant_count": 2, "ja3_variants": [ "78a605d37b3a6c4468fc4393269337d1", "21c6fb18581c08b1d968e9e8708d39ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_352721e01328", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "352721e01328", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789847466, "last_seen": 1790540195, "transport": "t", "ja3_hash": "14867a1012c28839263cba20c2574b02", "ja3_variant_count": 2, "ja3_variants": [ "14867a1012c28839263cba20c2574b02", "ff7d07f193cd2d1cbec3b78ea6f47703" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_41b57b44cf22", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "41b57b44cf22", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787936453, "last_seen": 1791043785, "transport": "t", "ja3_hash": "8e9ec91cb83586a5924f4b7e93fa7139", "ja3_variant_count": 2, "ja3_variants": [ "8e9ec91cb83586a5924f4b7e93fa7139", "af234cf11295e41975cfb02dac9045da" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_51e17fb48fcb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "51e17fb48fcb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790108263, "last_seen": 1791191194, "transport": "t", "ja3_hash": "45f96d7b61a8c6bf7a405b9133db663b", "ja3_variant_count": 2, "ja3_variants": [ "45f96d7b61a8c6bf7a405b9133db663b", "d49a1f0376450c7ca00d80e252170c41" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_6c58999868bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "6c58999868bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788724234, "last_seen": 1788724234, "transport": "t", "ja3_hash": "824aa2a6c3455ba73f64f71e1b36d25a", "ja3_variant_count": 1, "ja3_variants": [ "824aa2a6c3455ba73f64f71e1b36d25a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_85c5c6a023d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "85c5c6a023d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789624330, "last_seen": 1789684591, "transport": "t", "ja3_hash": "fe22e981f3bc0aed90705aafcf743769", "ja3_variant_count": 1, "ja3_variants": [ "fe22e981f3bc0aed90705aafcf743769" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_977885baa268", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "977885baa268", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789469868, "last_seen": 1790728503, "transport": "t", "ja3_hash": "c33eddda69a19902df77f4d88d096927", "ja3_variant_count": 3, "ja3_variants": [ "c33eddda69a19902df77f4d88d096927", "de27ecd1d2d8daf61027843818c9f349", "97d105b5aed6d6c9f10241b66845170e" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_9f72e9d66abc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "9f72e9d66abc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 14, "first_seen": 1788496177, "last_seen": 1791036728, "transport": "t", "ja3_hash": "34b701bdee40d5a6bb51d4cc94c75e99", "ja3_variant_count": 3, "ja3_variants": [ "34b701bdee40d5a6bb51d4cc94c75e99", "ad5ad280f44fbfa544b128378341d1d0", "9f008f218ea50926750263cef4d8fb88" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_bc716ed4d103", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "bc716ed4d103", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1791242196, "last_seen": 1791278937, "transport": "t", "ja3_hash": "d6da538bd59290064874d62509cf852e", "ja3_variant_count": 2, "ja3_variants": [ "d6da538bd59290064874d62509cf852e", "496904e4ba9b655feef72c1b1f9fe638" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_c4fe6519c741", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "c4fe6519c741", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790145199, "last_seen": 1790145199, "transport": "t", "ja3_hash": "19cad7d4b8e6d57916ddf321c8f303de", "ja3_variant_count": 1, "ja3_variants": [ "19cad7d4b8e6d57916ddf321c8f303de" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_d5d9fd1c3291", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "d5d9fd1c3291", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790215718, "last_seen": 1790930523, "transport": "t", "ja3_hash": "92c78b3f731e97e1ab252ff2d4350974", "ja3_variant_count": 2, "ja3_variants": [ "92c78b3f731e97e1ab252ff2d4350974", "858834ad43ffedbe0c03cc6762bd9ec8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_e48e9f2c5c73", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "e48e9f2c5c73", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790239271, "last_seen": 1790239271, "transport": "t", "ja3_hash": "31176c4a51153200f60de9200e2dbbd6", "ja3_variant_count": 1, "ja3_variants": [ "31176c4a51153200f60de9200e2dbbd6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1503h2_8daaf6152771_266c5487f233", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1503h2", "b": "8daaf6152771", "c": "266c5487f233", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1788512718, "last_seen": 1789929654, "transport": "t", "ja3_hash": "dbcbec3eb296b4e97d1628a1f065c9a4", "ja3_variant_count": 2, "ja3_variants": [ "dbcbec3eb296b4e97d1628a1f065c9a4", "c72e9b03f9ffb919d6532a12906bbe00" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_0ce814d9700e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "0ce814d9700e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-43-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790251453, "last_seen": 1790322719, "transport": "t", "ja3_hash": "09be05aab4ffdcb1690b770c1cedcf0e", "ja3_variant_count": 2, "ja3_variants": [ "09be05aab4ffdcb1690b770c1cedcf0e", "61c12581222744db1ec5ccd17f90409b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_0e6d02268820", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "0e6d02268820", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789710064, "last_seen": 1791233350, "transport": "t", "ja3_hash": "0c65d9c8140d363a11582c2a0ac8aff4", "ja3_variant_count": 3, "ja3_variants": [ "0c65d9c8140d363a11582c2a0ac8aff4", "e047d5265846c912f6226b86bba7c88a", "377ce6775e29b90bcfbb30207c07bb14" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_0e9a0b19dce5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "0e9a0b19dce5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-45-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791282233, "last_seen": 1791282233, "transport": "t", "ja3_hash": "a285c1cec7aaef9ddf4f5f372e925da2", "ja3_variant_count": 1, "ja3_variants": [ "a285c1cec7aaef9ddf4f5f372e925da2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_101ba9e36379", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "101ba9e36379", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789692123, "last_seen": 1789692123, "transport": "t", "ja3_hash": "4b400ff341fb29439c3b9080eca14d13", "ja3_variant_count": 1, "ja3_variants": [ "4b400ff341fb29439c3b9080eca14d13" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_1a3950a29b4a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "1a3950a29b4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790656367, "last_seen": 1790656367, "transport": "t", "ja3_hash": "a3b6ebf558d4999a2760814f2cf8ad53", "ja3_variant_count": 1, "ja3_variants": [ "a3b6ebf558d4999a2760814f2cf8ad53" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_22adf9fcbd9a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "22adf9fcbd9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-43-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788805877, "last_seen": 1788870579, "transport": "t", "ja3_hash": "fd6f00a4d27fb51775756021a8718d25", "ja3_variant_count": 2, "ja3_variants": [ "fd6f00a4d27fb51775756021a8718d25", "2184ec4ef6c6a153dab4c961ce949bd7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_3fa44f85e59f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "3fa44f85e59f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790236142, "last_seen": 1791032347, "transport": "t", "ja3_hash": "3ea464f9725a47afde9804d0d8e9bb05", "ja3_variant_count": 2, "ja3_variants": [ "3ea464f9725a47afde9804d0d8e9bb05", "fe89b7635050933e59feeeaea67d1263" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_490d7e1b8b00", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "490d7e1b8b00", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-43-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790232166, "last_seen": 1790232166, "transport": "t", "ja3_hash": "3653ad7cee8a6c03df817b43e7ab4c89", "ja3_variant_count": 1, "ja3_variants": [ "3653ad7cee8a6c03df817b43e7ab4c89" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_517afc684326", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "517afc684326", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790903529, "last_seen": 1790903529, "transport": "t", "ja3_hash": "d67c63c288838ca5b020099afc58bf68", "ja3_variant_count": 1, "ja3_variants": [ "d67c63c288838ca5b020099afc58bf68" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_5b9486e65a57", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "5b9486e65a57", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788790406, "last_seen": 1788790406, "transport": "t", "ja3_hash": "e73cf5f40cdc67593d7b0aab6256ec10", "ja3_variant_count": 1, "ja3_variants": [ "e73cf5f40cdc67593d7b0aab6256ec10" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_6395773a0331", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "6395773a0331", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-18-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791012089, "last_seen": 1791012089, "transport": "t", "ja3_hash": "4fd7cccee2f9889297886b81a6d5774b", "ja3_variant_count": 1, "ja3_variants": [ "4fd7cccee2f9889297886b81a6d5774b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_64f7b3f700be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "64f7b3f700be", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791186099, "last_seen": 1791186099, "transport": "t", "ja3_hash": "def073c78d14eed611149c20d04314e7", "ja3_variant_count": 1, "ja3_variants": [ "def073c78d14eed611149c20d04314e7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_7d06e6a78045", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "7d06e6a78045", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789695935, "last_seen": 1790684659, "transport": "t", "ja3_hash": "f5cee628290c65ebc80e383dbb0398b7", "ja3_variant_count": 2, "ja3_variants": [ "f5cee628290c65ebc80e383dbb0398b7", "bf97912c7c5deb36a0c93f20a8f767c0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_874a44c71b15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "874a44c71b15", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790466373, "last_seen": 1790466373, "transport": "t", "ja3_hash": "b24e0b263969d1d9a79057b329932aa3", "ja3_variant_count": 1, "ja3_variants": [ "b24e0b263969d1d9a79057b329932aa3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_891f24112c60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "891f24112c60", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-51-43-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790625442, "last_seen": 1790625442, "transport": "t", "ja3_hash": "4de7f891d8c34a01c1312b71b95c52e7", "ja3_variant_count": 1, "ja3_variants": [ "4de7f891d8c34a01c1312b71b95c52e7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_947d3da51217", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "947d3da51217", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788984119, "last_seen": 1788984119, "transport": "t", "ja3_hash": "b2f0cbd41b9e6774fa1a1bc282d97495", "ja3_variant_count": 1, "ja3_variants": [ "b2f0cbd41b9e6774fa1a1bc282d97495" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_a79eb5675868", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "a79eb5675868", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789692444, "last_seen": 1790833986, "transport": "t", "ja3_hash": "a6b584bb81ca49594240d61dde7fa253", "ja3_variant_count": 3, "ja3_variants": [ "a6b584bb81ca49594240d61dde7fa253", "b41753f756090839a3076874de58f8a4", "00e807c5554438cb15d73c96403562fd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_b0b305792b57", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "b0b305792b57", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790236734, "last_seen": 1790236734, "transport": "t", "ja3_hash": "6fbbf3efbb0d57a0e0192e86111b055f", "ja3_variant_count": 1, "ja3_variants": [ "6fbbf3efbb0d57a0e0192e86111b055f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_be0efe662b47", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "be0efe662b47", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790220595, "last_seen": 1791286654, "transport": "t", "ja3_hash": "fd7460191472c54df9178a8c13f0f053", "ja3_variant_count": 2, "ja3_variants": [ "fd7460191472c54df9178a8c13f0f053", "836ba7a6e1cf4dcbc257023bbd0bfcbc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_c37a9bff9c07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "c37a9bff9c07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-27-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790222407, "last_seen": 1790222407, "transport": "t", "ja3_hash": "1e80b4d27dd1d1138de68add6bf48f71", "ja3_variant_count": 1, "ja3_variants": [ "1e80b4d27dd1d1138de68add6bf48f71" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_c810dfe9e8c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "c810dfe9e8c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789928890, "last_seen": 1789928890, "transport": "t", "ja3_hash": "923a852f1f7cf408dc6fb5b3978590ec", "ja3_variant_count": 1, "ja3_variants": [ "923a852f1f7cf408dc6fb5b3978590ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_d1680cca4981", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "d1680cca4981", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790427692, "last_seen": 1790427692, "transport": "t", "ja3_hash": "967dad955a53071c708bf76950001a8a", "ja3_variant_count": 1, "ja3_variants": [ "967dad955a53071c708bf76950001a8a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_d2ff498b7713", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "d2ff498b7713", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789438965, "last_seen": 1789438965, "transport": "t", "ja3_hash": "ef0657b4a036e50e0a5fa8f99a99eb4b", "ja3_variant_count": 1, "ja3_variants": [ "ef0657b4a036e50e0a5fa8f99a99eb4b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_d9633f91f8bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "d9633f91f8bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790526384, "last_seen": 1790526384, "transport": "t", "ja3_hash": "c2f60077cff6a91af654f907c960d0f8", "ja3_variant_count": 1, "ja3_variants": [ "c2f60077cff6a91af654f907c960d0f8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_e3f8a7bdc651", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "e3f8a7bdc651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790650094, "last_seen": 1790650094, "transport": "t", "ja3_hash": "32e7d423456117f5a725912af7f9a6be", "ja3_variant_count": 1, "ja3_variants": [ "32e7d423456117f5a725912af7f9a6be" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_fa7314977c09", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "fa7314977c09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-51-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789229355, "last_seen": 1789229355, "transport": "t", "ja3_hash": "80fd7c95fcfe8e402faa8b7cb8962514", "ja3_variant_count": 1, "ja3_variants": [ "80fd7c95fcfe8e402faa8b7cb8962514" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 9 }, "ua_disagreement": false } }, { "hash": "t13i1504h2_8daaf6152771_392db9dbc40a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1504h2", "b": "8daaf6152771", "c": "392db9dbc40a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790876420, "last_seen": 1790876420, "transport": "t", "ja3_hash": "f60dbfc02aa6c0e45b97c1517c9dfce1", "ja3_variant_count": 1, "ja3_variants": [ "f60dbfc02aa6c0e45b97c1517c9dfce1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1504h2_8daaf6152771_490d7e1b8b00", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1504h2", "b": "8daaf6152771", "c": "490d7e1b8b00", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790850447, "last_seen": 1790850447, "transport": "t", "ja3_hash": "edbcb299af9725c0d3305dc6f8e6f9e5", "ja3_variant_count": 1, "ja3_variants": [ "edbcb299af9725c0d3305dc6f8e6f9e5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1504h2_8daaf6152771_8cedfb1563fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1504h2", "b": "8daaf6152771", "c": "8cedfb1563fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-43-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791139694, "last_seen": 1791139694, "transport": "t", "ja3_hash": "0f55c49d6ab09980c50e338aeaeed8e3", "ja3_variant_count": 1, "ja3_variants": [ "0f55c49d6ab09980c50e338aeaeed8e3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13i1504h2_8daaf6152771_e8bf30e6818d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1504h2", "b": "8daaf6152771", "c": "e8bf30e6818d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1791169812, "last_seen": 1791265574, "transport": "t", "ja3_hash": "25cbad1529a5662ca8e3accf368b1866", "ja3_variant_count": 2, "ja3_variants": [ "25cbad1529a5662ca8e3accf368b1866", "d714da0fea9fd6373fc2a6434814cd9e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1504h2_8daaf6152771_fb163ed6e928", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1504h2", "b": "8daaf6152771", "c": "fb163ed6e928", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788459231, "last_seen": 1788459231, "transport": "t", "ja3_hash": "5e59fccda389ca437cfdb0ba8a897f20", "ja3_variant_count": 1, "ja3_variants": [ "5e59fccda389ca437cfdb0ba8a897f20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_0650121f63a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "0650121f63a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-51-43-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789040424, "last_seen": 1789040424, "transport": "t", "ja3_hash": "7d45b39fd2eeb78a3ec024ce58a9531d", "ja3_variant_count": 1, "ja3_variants": [ "7d45b39fd2eeb78a3ec024ce58a9531d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_0962d9263295", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "0962d9263295", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-23-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790085049, "last_seen": 1790085049, "transport": "t", "ja3_hash": "fd984499e8bf4617073830536753282a", "ja3_variant_count": 1, "ja3_variants": [ "fd984499e8bf4617073830536753282a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_10bd084bbec6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "10bd084bbec6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-51-13-65281,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790225609, "last_seen": 1790225609, "transport": "t", "ja3_hash": "50916ea1636281132381459fb0fe39c0", "ja3_variant_count": 1, "ja3_variants": [ "50916ea1636281132381459fb0fe39c0" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_175bc6cc4925", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "175bc6cc4925", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-51-65281-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790991889, "last_seen": 1790991889, "transport": "t", "ja3_hash": "7a1a6eb0add9b2f191c1fc32dacaba80", "ja3_variant_count": 1, "ja3_variants": [ "7a1a6eb0add9b2f191c1fc32dacaba80" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_1ac4601af77f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "1ac4601af77f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-65281-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789473581, "last_seen": 1789473581, "transport": "t", "ja3_hash": "2574cd90fdf31a173a2a2038a1cfc317", "ja3_variant_count": 1, "ja3_variants": [ "2574cd90fdf31a173a2a2038a1cfc317" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_3646c6b9f867", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "3646c6b9f867", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790242045, "last_seen": 1790242045, "transport": "t", "ja3_hash": "6fdc377a996635b42bb326880de98312", "ja3_variant_count": 1, "ja3_variants": [ "6fdc377a996635b42bb326880de98312" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_3ca1bccb150d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "3ca1bccb150d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-43-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790488640, "last_seen": 1790488640, "transport": "t", "ja3_hash": "5549c60e26bb1f16976d1f9608ee0945", "ja3_variant_count": 1, "ja3_variants": [ "5549c60e26bb1f16976d1f9608ee0945" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_445c0653bd54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "445c0653bd54", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-27-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790227394, "last_seen": 1790227394, "transport": "t", "ja3_hash": "797e16684f6bb218161346eef825e24c", "ja3_variant_count": 1, "ja3_variants": [ "797e16684f6bb218161346eef825e24c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_4bdf4a3e9681", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "4bdf4a3e9681", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-43-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790689903, "last_seen": 1790689903, "transport": "t", "ja3_hash": "3189127593ecdcfd3c590d3551c4c215", "ja3_variant_count": 1, "ja3_variants": [ "3189127593ecdcfd3c590d3551c4c215" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_4c93e6dcfdd7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "4c93e6dcfdd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-43-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788844062, "last_seen": 1790532160, "transport": "t", "ja3_hash": "11d9040c772469b41205557ada38edca", "ja3_variant_count": 2, "ja3_variants": [ "11d9040c772469b41205557ada38edca", "c950cb63e0c3451684e7ca87720d0603" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_501fa965050d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "501fa965050d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-18-35-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790207558, "last_seen": 1790207558, "transport": "t", "ja3_hash": "fce1ee2edf91e40ca595452aa02f4daf", "ja3_variant_count": 1, "ja3_variants": [ "fce1ee2edf91e40ca595452aa02f4daf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_55ebdd5369a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "55ebdd5369a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-43-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790311554, "last_seen": 1790311554, "transport": "t", "ja3_hash": "8debab8e985177d34dffcbe1099d5f64", "ja3_variant_count": 1, "ja3_variants": [ "8debab8e985177d34dffcbe1099d5f64" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_59e6862a9223", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "59e6862a9223", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790998774, "last_seen": 1790998774, "transport": "t", "ja3_hash": "263af27ce055c40213dfb5604d621884", "ja3_variant_count": 1, "ja3_variants": [ "263af27ce055c40213dfb5604d621884" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_622f7799a6ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "622f7799a6ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-43-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790997872, "last_seen": 1790997872, "transport": "t", "ja3_hash": "442e0a191fb767daed7d783228c92fc5", "ja3_variant_count": 1, "ja3_variants": [ "442e0a191fb767daed7d783228c92fc5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_69b1c76817b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "69b1c76817b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-45-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790644959, "last_seen": 1790644959, "transport": "t", "ja3_hash": "a3c1f1aed5512df9ba4400f77c95b085", "ja3_variant_count": 1, "ja3_variants": [ "a3c1f1aed5512df9ba4400f77c95b085" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 6 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_6a70ee977655", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "6a70ee977655", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-43-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788782641, "last_seen": 1788782641, "transport": "t", "ja3_hash": "4ba7f28d2e6a2f4c4b06527ca9104d73", "ja3_variant_count": 1, "ja3_variants": [ "4ba7f28d2e6a2f4c4b06527ca9104d73" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_6c3ff7140b10", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "6c3ff7140b10", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790244248, "last_seen": 1790244248, "transport": "t", "ja3_hash": "537ec178825613ad0075b482c8b19588", "ja3_variant_count": 1, "ja3_variants": [ "537ec178825613ad0075b482c8b19588" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_73ef849fbad4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "73ef849fbad4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-51764-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789747790, "last_seen": 1789747790, "transport": "t", "ja3_hash": "42591962c830534399cc2ec82178f108", "ja3_variant_count": 1, "ja3_variants": [ "42591962c830534399cc2ec82178f108" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_8891d76966e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "8891d76966e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789538321, "last_seen": 1789538321, "transport": "t", "ja3_hash": "14f01e7828874750aa26022eca335702", "ja3_variant_count": 1, "ja3_variants": [ "14f01e7828874750aa26022eca335702" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 59 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_892401fda62e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "892401fda62e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790794842, "last_seen": 1790794842, "transport": "t", "ja3_hash": "c33cd8215a9c978fb3096efec623013c", "ja3_variant_count": 1, "ja3_variants": [ "c33cd8215a9c978fb3096efec623013c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 14 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_8fa7a5ed17e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "8fa7a5ed17e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-27-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789146209, "last_seen": 1789146209, "transport": "t", "ja3_hash": "0afa4dfd98c78cd4d8910a6af79e9cbc", "ja3_variant_count": 1, "ja3_variants": [ "0afa4dfd98c78cd4d8910a6af79e9cbc" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 15_7 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Criw/120.0.0.0 Mobile/15E148 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_90c05a137740", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "90c05a137740", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790235449, "last_seen": 1790235449, "transport": "t", "ja3_hash": "22b90157c0fca5213b25072297f7d695", "ja3_variant_count": 1, "ja3_variants": [ "22b90157c0fca5213b25072297f7d695" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_91f9f683c041", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "91f9f683c041", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-10-51-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788931105, "last_seen": 1788931105, "transport": "t", "ja3_hash": "5edb0eeb0b8ea0d9c074446528995db2", "ja3_variant_count": 1, "ja3_variants": [ "5edb0eeb0b8ea0d9c074446528995db2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 45 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_9c553a857f86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "9c553a857f86", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-51-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788839944, "last_seen": 1791135535, "transport": "t", "ja3_hash": "a537c318fe6862b9e26e0a4b0ee507b1", "ja3_variant_count": 2, "ja3_variants": [ "a537c318fe6862b9e26e0a4b0ee507b1", "9d92efafed0b31c0273cdeba27c05f18" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_9c6644f65607", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "9c6644f65607", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-17613-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790227685, "last_seen": 1790252455, "transport": "t", "ja3_hash": "fda3d0b3bd49d243b93938186ab2cb3d", "ja3_variant_count": 2, "ja3_variants": [ "fda3d0b3bd49d243b93938186ab2cb3d", "6274d480ba1e11d22847ae029b75f466" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 18, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_9d94d47317e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "9d94d47317e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-11-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790738575, "last_seen": 1790738575, "transport": "t", "ja3_hash": "65f2560677130dca4ae79b623268ed18", "ja3_variant_count": 1, "ja3_variants": [ "65f2560677130dca4ae79b623268ed18" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_af268b714c95", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "af268b714c95", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790690788, "last_seen": 1790690788, "transport": "t", "ja3_hash": "a6841b09735cab300ecf7761d17bff42", "ja3_variant_count": 1, "ja3_variants": [ "a6841b09735cab300ecf7761d17bff42" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_b249e5273553", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "b249e5273553", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789022820, "last_seen": 1789022820, "transport": "t", "ja3_hash": "1db509858fd525ca6f8fe927e72a2594", "ja3_variant_count": 1, "ja3_variants": [ "1db509858fd525ca6f8fe927e72a2594" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_b41f38bac23b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "b41f38bac23b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788708547, "last_seen": 1788708547, "transport": "t", "ja3_hash": "2443788e2edb08587aa9429462004484", "ja3_variant_count": 1, "ja3_variants": [ "2443788e2edb08587aa9429462004484" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_bb0e4a07f19e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "bb0e4a07f19e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-43-51-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790231649, "last_seen": 1790231649, "transport": "t", "ja3_hash": "9ef9de723304523758c6481732c3289e", "ja3_variant_count": 1, "ja3_variants": [ "9ef9de723304523758c6481732c3289e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_bd5fcd05759c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "bd5fcd05759c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-45-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790650310, "last_seen": 1790650310, "transport": "t", "ja3_hash": "8ef9d4f14d3c2824eb41f55055e9ef86", "ja3_variant_count": 1, "ja3_variants": [ "8ef9d4f14d3c2824eb41f55055e9ef86" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_bff685590d0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "bff685590d0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-17613-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202367, "last_seen": 1790202367, "transport": "t", "ja3_hash": "b520ce6c5a56db6012e2b1d899c70074", "ja3_variant_count": 1, "ja3_variants": [ "b520ce6c5a56db6012e2b1d899c70074" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_c762b4e0cbd7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "c762b4e0cbd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-65281-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790689827, "last_seen": 1790715752, "transport": "t", "ja3_hash": "e6d942bb9afa318b1bdec689cf14713b", "ja3_variant_count": 2, "ja3_variants": [ "e6d942bb9afa318b1bdec689cf14713b", "d83a5a7800198997050a3a3a3a83d4f2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 3 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_cbef948a75eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "cbef948a75eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-51-43-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790577015, "last_seen": 1790577015, "transport": "t", "ja3_hash": "f4c350c9d9974f3fc0ef790d05cd58db", "ja3_variant_count": 1, "ja3_variants": [ "f4c350c9d9974f3fc0ef790d05cd58db" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_d2288c6fc1ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "d2288c6fc1ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790238133, "last_seen": 1790238133, "transport": "t", "ja3_hash": "958bed3aea326fa0035ac44eeaf0c3f9", "ja3_variant_count": 1, "ja3_variants": [ "958bed3aea326fa0035ac44eeaf0c3f9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_d8002ef6da56", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "d8002ef6da56", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-43-45-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791162430, "last_seen": 1791162430, "transport": "t", "ja3_hash": "a1ac8c1b695788357b17de76766118bb", "ja3_variant_count": 1, "ja3_variants": [ "a1ac8c1b695788357b17de76766118bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) QQEX/9.9.36-53644 Chrome/144.0.7559.60 Safari/537.36 OS/win32,x64 QQAppId/537391628 QQEXBrowser/1.": 4 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_dc3da7a2dee2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "dc3da7a2dee2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-35-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789497472, "last_seen": 1790366102, "transport": "t", "ja3_hash": "387542fd572d5c3835229b76feff4241", "ja3_variant_count": 2, "ja3_variants": [ "387542fd572d5c3835229b76feff4241", "e95b4c4040592906ea223d1539695230" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_dde9317eac23", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "dde9317eac23", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788980905, "last_seen": 1788980905, "transport": "t", "ja3_hash": "f569cefcf48d69c7932b1f6595817bc5", "ja3_variant_count": 1, "ja3_variants": [ "f569cefcf48d69c7932b1f6595817bc5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_e626fda20b4c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "e626fda20b4c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-43-23-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790704873, "last_seen": 1790704873, "transport": "t", "ja3_hash": "6e989b76386b33dd8c5595245941a2fe", "ja3_variant_count": 1, "ja3_variants": [ "6e989b76386b33dd8c5595245941a2fe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_f0c919a2e8f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "f0c919a2e8f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-10-43-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790720026, "last_seen": 1790720026, "transport": "t", "ja3_hash": "47eb65177a453b8e40bf10923f2cd12f", "ja3_variant_count": 1, "ja3_variants": [ "47eb65177a453b8e40bf10923f2cd12f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_fab4f4eadf42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "fab4f4eadf42", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-43-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790366316, "last_seen": 1790366316, "transport": "t", "ja3_hash": "3d870624808815bddb6c8f8e56e91cdf", "ja3_variant_count": 1, "ja3_variants": [ "3d870624808815bddb6c8f8e56e91cdf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_fac2efa4a0c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "fac2efa4a0c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790650442, "last_seen": 1790650442, "transport": "t", "ja3_hash": "9d74200f6ba784658685f4f69ab386ec", "ja3_variant_count": 1, "ja3_variants": [ "9d74200f6ba784658685f4f69ab386ec" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_fe946d04140a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "fe946d04140a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-45-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788861599, "last_seen": 1791302370, "transport": "t", "ja3_hash": "c5f54dfa76384695ca7219f4db7b30a0", "ja3_variant_count": 2, "ja3_variants": [ "c5f54dfa76384695ca7219f4db7b30a0", "df9a07f0d5dc35b2faec41c53264fb37" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h1_8daaf6152771_ffda38ea41c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h1", "b": "8daaf6152771", "c": "ffda38ea41c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790554262, "last_seen": 1790554262, "transport": "t", "ja3_hash": "97c0e534d049f6fec8f2a555974ffe9d", "ja3_variant_count": 1, "ja3_variants": [ "97c0e534d049f6fec8f2a555974ffe9d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_18986fa0fc71", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "18986fa0fc71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790222386, "last_seen": 1790222386, "transport": "t", "ja3_hash": "bc3847fb2b2f83108470e51e48167e20", "ja3_variant_count": 1, "ja3_variants": [ "bc3847fb2b2f83108470e51e48167e20" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_2f443318fcf0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "2f443318fcf0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-13-43-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790541816, "last_seen": 1790541816, "transport": "t", "ja3_hash": "83210a58525ab23cf1630c1a15f8eb4f", "ja3_variant_count": 1, "ja3_variants": [ "83210a58525ab23cf1630c1a15f8eb4f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_34ac82bc92ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "34ac82bc92ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-65281-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790175356, "last_seen": 1790730663, "transport": "t", "ja3_hash": "6cc45a3752c29d9043bcd9d544d5f1c7", "ja3_variant_count": 2, "ja3_variants": [ "6cc45a3752c29d9043bcd9d544d5f1c7", "954f7b3b389816baa46dc0f6982568b1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_3fbc8b58284f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "3fbc8b58284f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788727194, "last_seen": 1788727194, "transport": "t", "ja3_hash": "4cf21f9125b010e2ad81ba46d9876220", "ja3_variant_count": 1, "ja3_variants": [ "4cf21f9125b010e2ad81ba46d9876220" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_40d5251d8300", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "40d5251d8300", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789694205, "last_seen": 1789694205, "transport": "t", "ja3_hash": "0e2b7a9f57005a2e490b39e1396dcfd8", "ja3_variant_count": 1, "ja3_variants": [ "0e2b7a9f57005a2e490b39e1396dcfd8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_619acf434f21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "619acf434f21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-17613-16-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790229898, "last_seen": 1790229898, "transport": "t", "ja3_hash": "5a4fa8562f7d3ff6a27bb8d1cfca11e3", "ja3_variant_count": 1, "ja3_variants": [ "5a4fa8562f7d3ff6a27bb8d1cfca11e3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_7c2e8594758a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "7c2e8594758a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790260496, "last_seen": 1790260496, "transport": "t", "ja3_hash": "ab86ff62dd8b42160b21a6379d8c4b76", "ja3_variant_count": 1, "ja3_variants": [ "ab86ff62dd8b42160b21a6379d8c4b76" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 44 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_8492fe99efbf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "8492fe99efbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-16-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788812129, "last_seen": 1790773541, "transport": "t", "ja3_hash": "a1a83b428e4331509319f1461953f2e7", "ja3_variant_count": 2, "ja3_variants": [ "a1a83b428e4331509319f1461953f2e7", "d9d77e8a1c169ee87616fc17570d81b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_9f1804aca672", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "9f1804aca672", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-18-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789092677, "last_seen": 1789092677, "transport": "t", "ja3_hash": "47040b8396e5d0844ee8edd75b90a0ae", "ja3_variant_count": 1, "ja3_variants": [ "47040b8396e5d0844ee8edd75b90a0ae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_c07ff3e70664", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "c07ff3e70664", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-10-43-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790337424, "last_seen": 1790337424, "transport": "t", "ja3_hash": "4f75eab16e2f6e7de0426bcfc8296a5c", "ja3_variant_count": 1, "ja3_variants": [ "4f75eab16e2f6e7de0426bcfc8296a5c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_d65de64846ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "d65de64846ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-51-16-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790662473, "last_seen": 1790662473, "transport": "t", "ja3_hash": "37d96bd84157f74793a615aa8a57806c", "ja3_variant_count": 1, "ja3_variants": [ "37d96bd84157f74793a615aa8a57806c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 179 }, "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_ffda38ea41c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (ffda38ea41c2) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "ffda38ea41c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789701008, "last_seen": 1789701008, "transport": "t", "ja3_hash": "e67dee91595be601a988d65c46ef4ec7", "ja3_variant_count": 1, "ja3_variants": [ "e67dee91595be601a988d65c46ef4ec7" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13i150600_8daaf6152771_051b56eadc23", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "051b56eadc23", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-23-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790690721, "last_seen": 1790690721, "transport": "t", "ja3_hash": "9fd75b28f5c66ffc57948c478083748a", "ja3_variant_count": 1, "ja3_variants": [ "9fd75b28f5c66ffc57948c478083748a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_07d96117b32f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "07d96117b32f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-45-5-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789151468, "last_seen": 1789151468, "transport": "t", "ja3_hash": "bba8a0700508838b1f2a50d1bb0b3e3e", "ja3_variant_count": 1, "ja3_variants": [ "bba8a0700508838b1f2a50d1bb0b3e3e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_0b502eaac743", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "0b502eaac743", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-27-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789766888, "last_seen": 1789766888, "transport": "t", "ja3_hash": "d857e9fc2e20c3ee0fcd6902dc201647", "ja3_variant_count": 1, "ja3_variants": [ "d857e9fc2e20c3ee0fcd6902dc201647" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_1ca0c75991c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "1ca0c75991c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-65037-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789201595, "last_seen": 1789201595, "transport": "t", "ja3_hash": "f4a249c0923007e07a0592687fb981b2", "ja3_variant_count": 1, "ja3_variants": [ "f4a249c0923007e07a0592687fb981b2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_1d5172b2b5d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "1d5172b2b5d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-43-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790556355, "last_seen": 1790556355, "transport": "t", "ja3_hash": "5b2b6d2e8ccfad5709b5ad658f72da22", "ja3_variant_count": 1, "ja3_variants": [ "5b2b6d2e8ccfad5709b5ad658f72da22" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_27842348f9b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "27842348f9b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-35-13-43-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669069, "last_seen": 1789669069, "transport": "t", "ja3_hash": "6564c42c57adb840600022c673cc6f29", "ja3_variant_count": 1, "ja3_variants": [ "6564c42c57adb840600022c673cc6f29" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_2c530c0f7d68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "2c530c0f7d68", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-45-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789626391, "last_seen": 1789626391, "transport": "t", "ja3_hash": "b811326fb9caa3c6c6b2124a92072d2f", "ja3_variant_count": 1, "ja3_variants": [ "b811326fb9caa3c6c6b2124a92072d2f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 64 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_2cbfc4ff1375", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "2cbfc4ff1375", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-23-51-5-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790188583, "last_seen": 1790188583, "transport": "t", "ja3_hash": "62e7869fcd302ca58829c5725e563abb", "ja3_variant_count": 1, "ja3_variants": [ "62e7869fcd302ca58829c5725e563abb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_3203b57f2c1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "3203b57f2c1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-65281-23-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789592005, "last_seen": 1789592005, "transport": "t", "ja3_hash": "355867d29d254521b2a77ab361a63e3c", "ja3_variant_count": 1, "ja3_variants": [ "355867d29d254521b2a77ab361a63e3c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_350219e77f28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "350219e77f28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-65281-11-43-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791242763, "last_seen": 1791242763, "transport": "t", "ja3_hash": "78bf5d2065c555c3faf6c9e4f8cfc540", "ja3_variant_count": 1, "ja3_variants": [ "78bf5d2065c555c3faf6c9e4f8cfc540" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_373703c477c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "373703c477c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-65037-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790653366, "last_seen": 1790653366, "transport": "t", "ja3_hash": "117d1db3e18ecb0004f59fc4091feaee", "ja3_variant_count": 1, "ja3_variants": [ "117d1db3e18ecb0004f59fc4091feaee" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_3e560cfa9037", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "3e560cfa9037", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-13-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790160115, "last_seen": 1790160115, "transport": "t", "ja3_hash": "c4cf62d4f1cf7126266376180b86e8f6", "ja3_variant_count": 1, "ja3_variants": [ "c4cf62d4f1cf7126266376180b86e8f6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_42ab1f98e003", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "42ab1f98e003", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-51-43-5-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790683976, "last_seen": 1791084165, "transport": "t", "ja3_hash": "2e948d470e5916999fe7f10ec2930334", "ja3_variant_count": 2, "ja3_variants": [ "2e948d470e5916999fe7f10ec2930334", "70d9e06b6d17e46bf1d50d0f637df470" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_48e98d83bc77", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "48e98d83bc77", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-13-27-43-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791210950, "last_seen": 1791210950, "transport": "t", "ja3_hash": "7ac1dceb2f3e852524470dd4bcc6e928", "ja3_variant_count": 1, "ja3_variants": [ "7ac1dceb2f3e852524470dd4bcc6e928" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_50bf6c8c12da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "50bf6c8c12da", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-65037-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791082908, "last_seen": 1791082908, "transport": "t", "ja3_hash": "3f1a277f0424133466185e5941e24583", "ja3_variant_count": 1, "ja3_variants": [ "3f1a277f0424133466185e5941e24583" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_54c27ae86188", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "54c27ae86188", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-43-13-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790532634, "last_seen": 1790532634, "transport": "t", "ja3_hash": "8e6595bf15cf611fb7adda63855523bb", "ja3_variant_count": 1, "ja3_variants": [ "8e6595bf15cf611fb7adda63855523bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_64c18b55cf28", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "64c18b55cf28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-11-45-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790181740, "last_seen": 1790181740, "transport": "t", "ja3_hash": "faf1ce4aa4d33014ff5ae326877d3697", "ja3_variant_count": 1, "ja3_variants": [ "faf1ce4aa4d33014ff5ae326877d3697" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_78c105cf673b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "78c105cf673b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-11-51-13-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789923987, "last_seen": 1789923987, "transport": "t", "ja3_hash": "5903deb2c780df674fc26542ec2383d0", "ja3_variant_count": 1, "ja3_variants": [ "5903deb2c780df674fc26542ec2383d0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_7bd2674389b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "7bd2674389b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-43-5-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790309695, "last_seen": 1790309695, "transport": "t", "ja3_hash": "4a4959c20f5703e9113e5dce3d16114a", "ja3_variant_count": 1, "ja3_variants": [ "4a4959c20f5703e9113e5dce3d16114a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 17 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_7bd2fc624f24", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "7bd2fc624f24", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-43-45-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790771377, "last_seen": 1790771377, "transport": "t", "ja3_hash": "9287635d1cc547cdd55b4fbb11fc6a08", "ja3_variant_count": 1, "ja3_variants": [ "9287635d1cc547cdd55b4fbb11fc6a08" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 34 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_7e58f2fee93b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "7e58f2fee93b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-45-43-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788827819, "last_seen": 1791089160, "transport": "t", "ja3_hash": "69f6b633b7c96a83adfccfe89ac2d5a0", "ja3_variant_count": 2, "ja3_variants": [ "69f6b633b7c96a83adfccfe89ac2d5a0", "f1b6ffe14ada82bf2e41886f3cad27f0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8145f83b0ecf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8145f83b0ecf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-23-45-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790580894, "last_seen": 1790580894, "transport": "t", "ja3_hash": "7373dd46defe9f2b93b8f2aa96d1a0d7", "ja3_variant_count": 1, "ja3_variants": [ "7373dd46defe9f2b93b8f2aa96d1a0d7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_82d1954f6027", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "82d1954f6027", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-13-5-43-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790253570, "last_seen": 1790253570, "transport": "t", "ja3_hash": "46022cff7a4f6243944024c34eb8dfe5", "ja3_variant_count": 1, "ja3_variants": [ "46022cff7a4f6243944024c34eb8dfe5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_82f18a043b62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "82f18a043b62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-13-27-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790562006, "last_seen": 1790562006, "transport": "t", "ja3_hash": "5e383695406b7f9c478826981aa1d79b", "ja3_variant_count": 1, "ja3_variants": [ "5e383695406b7f9c478826981aa1d79b" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_846256baf396", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "846256baf396", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-43-45-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790195275, "last_seen": 1790195275, "transport": "t", "ja3_hash": "92c965093323fb2fe744df7958a16fd9", "ja3_variant_count": 1, "ja3_variants": [ "92c965093323fb2fe744df7958a16fd9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_847de1141634", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "847de1141634", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-5-11-43-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790340037, "last_seen": 1790979361, "transport": "t", "ja3_hash": "246a05cc84d631613a0bd751cac72bb1", "ja3_variant_count": 2, "ja3_variants": [ "246a05cc84d631613a0bd751cac72bb1", "4a69ea6f7709043d27f73ad506916cd6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8581c893be5d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8581c893be5d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-45-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790320416, "last_seen": 1790320416, "transport": "t", "ja3_hash": "71886f88dba566266f80d8c800225cbf", "ja3_variant_count": 1, "ja3_variants": [ "71886f88dba566266f80d8c800225cbf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.162 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8a001cd973d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8a001cd973d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-10-13-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790179610, "last_seen": 1790179610, "transport": "t", "ja3_hash": "eacb9393a582e6dd69bfa6dade5e6a04", "ja3_variant_count": 1, "ja3_variants": [ "eacb9393a582e6dd69bfa6dade5e6a04" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8a92ca05af84", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8a92ca05af84", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-5-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789146147, "last_seen": 1789146147, "transport": "t", "ja3_hash": "80b9a4c86db990c44a760b1297180728", "ja3_variant_count": 1, "ja3_variants": [ "80b9a4c86db990c44a760b1297180728" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8c2492ec3524", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8c2492ec3524", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-18-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788761902, "last_seen": 1789565231, "transport": "t", "ja3_hash": "48528a192aef948988fd3c5c643a5d8e", "ja3_variant_count": 2, "ja3_variants": [ "48528a192aef948988fd3c5c643a5d8e", "6a5395a7700e8660628e2504b9bb539d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8d7285a10dac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8d7285a10dac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-65281-11-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789401791, "last_seen": 1789401791, "transport": "t", "ja3_hash": "19c452e24e8762ae5d8fb9d76bdcb364", "ja3_variant_count": 1, "ja3_variants": [ "19c452e24e8762ae5d8fb9d76bdcb364" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 26 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_96842793f520", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "96842793f520", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-43-13-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791141433, "last_seen": 1791141433, "transport": "t", "ja3_hash": "85c357325721e7de57dd7c2e7d8140df", "ja3_variant_count": 1, "ja3_variants": [ "85c357325721e7de57dd7c2e7d8140df" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 2 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_997be1c44112", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "997be1c44112", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-10-51-23-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791131685, "last_seen": 1791131685, "transport": "t", "ja3_hash": "f7116a72664bbc9ee513f19065e24053", "ja3_variant_count": 1, "ja3_variants": [ "f7116a72664bbc9ee513f19065e24053" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_9d902c2ccf52", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "9d902c2ccf52", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-51-35-13-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790367707, "last_seen": 1790367707, "transport": "t", "ja3_hash": "19ba0e325bbf912dd24cd2188abba150", "ja3_variant_count": 1, "ja3_variants": [ "19ba0e325bbf912dd24cd2188abba150" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_a0dc428e30c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "a0dc428e30c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-51764-51-5-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791035960, "last_seen": 1791035960, "transport": "t", "ja3_hash": "8819343ff434820f754393b8166740fe", "ja3_variant_count": 1, "ja3_variants": [ "8819343ff434820f754393b8166740fe" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_a27ec7c2bb60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "a27ec7c2bb60", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-43-45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789879904, "last_seen": 1789879904, "transport": "t", "ja3_hash": "4c4498149b878037e096855210d52c13", "ja3_variant_count": 1, "ja3_variants": [ "4c4498149b878037e096855210d52c13" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_a3ae913e739f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "a3ae913e739f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-65037-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788867625, "last_seen": 1788867625, "transport": "t", "ja3_hash": "f8ea049f5988980c6e755bd1ff5c75d8", "ja3_variant_count": 1, "ja3_variants": [ "f8ea049f5988980c6e755bd1ff5c75d8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_ab6991f436d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "ab6991f436d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-35-51-17613-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656589, "last_seen": 1789656589, "transport": "t", "ja3_hash": "5fd7f3d044ff38001550a440a5d65fe4", "ja3_variant_count": 1, "ja3_variants": [ "5fd7f3d044ff38001550a440a5d65fe4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_af800d75af69", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "af800d75af69", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-43-65037-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788792340, "last_seen": 1788792340, "transport": "t", "ja3_hash": "91bbf9c65fcdc1905752b868ed6d9629", "ja3_variant_count": 1, "ja3_variants": [ "91bbf9c65fcdc1905752b868ed6d9629" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_b4083d5bca2c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "b4083d5bca2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-11-45-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790068693, "last_seen": 1790068693, "transport": "t", "ja3_hash": "36a4e40fe787aba8eb3d3755768f5e59", "ja3_variant_count": 1, "ja3_variants": [ "36a4e40fe787aba8eb3d3755768f5e59" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_c0e903e951bd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "c0e903e951bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-43-10-51-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789140040, "last_seen": 1789140040, "transport": "t", "ja3_hash": "51253adcb505c2a23bbd9797d5b7c57a", "ja3_variant_count": 1, "ja3_variants": [ "51253adcb505c2a23bbd9797d5b7c57a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_c41a7ccc58de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "c41a7ccc58de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-5-43-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790615509, "last_seen": 1790615509, "transport": "t", "ja3_hash": "768458bba66f7a6633a7f344c2bdad6c", "ja3_variant_count": 1, "ja3_variants": [ "768458bba66f7a6633a7f344c2bdad6c" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_d0a1effc40bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "d0a1effc40bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-10-43-11-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790221279, "last_seen": 1790221279, "transport": "t", "ja3_hash": "1f86d598e4e91d0c244600489791a400", "ja3_variant_count": 1, "ja3_variants": [ "1f86d598e4e91d0c244600489791a400" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_d4396d9aed62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "d4396d9aed62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-45-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197412, "last_seen": 1790197412, "transport": "t", "ja3_hash": "bff8ad220dbd492b25e6a5954460810e", "ja3_variant_count": 1, "ja3_variants": [ "bff8ad220dbd492b25e6a5954460810e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_d4538eff8a5d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "d4538eff8a5d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-18-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791046329, "last_seen": 1791046329, "transport": "t", "ja3_hash": "c38f7ffb3451bd8d8c87081357d33f78", "ja3_variant_count": 1, "ja3_variants": [ "c38f7ffb3451bd8d8c87081357d33f78" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_d4bcbfba44ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "d4bcbfba44ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-5-27-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788858839, "last_seen": 1788858839, "transport": "t", "ja3_hash": "6e608dab500da178dff5ec2bfaa1a223", "ja3_variant_count": 1, "ja3_variants": [ "6e608dab500da178dff5ec2bfaa1a223" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_d504b2181910", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "d504b2181910", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-10-43-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790168186, "last_seen": 1790168186, "transport": "t", "ja3_hash": "47d00dcc4fd1386e60bfce590572d4b5", "ja3_variant_count": 1, "ja3_variants": [ "47d00dcc4fd1386e60bfce590572d4b5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_d8db6c13e46c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "d8db6c13e46c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-65037-13-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790727349, "last_seen": 1790727349, "transport": "t", "ja3_hash": "7f84182e6b6a2e3faa2d2714648185d7", "ja3_variant_count": 1, "ja3_variants": [ "7f84182e6b6a2e3faa2d2714648185d7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_dda9b54544f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "dda9b54544f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-35-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790798856, "last_seen": 1790798856, "transport": "t", "ja3_hash": "2b32e396617621eb01204e0b79ff64ae", "ja3_variant_count": 1, "ja3_variants": [ "2b32e396617621eb01204e0b79ff64ae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_e1f6edc47329", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "e1f6edc47329", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-27-45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791134320, "last_seen": 1791134320, "transport": "t", "ja3_hash": "dd414c9cac12c3348d791cfbc51b0a2f", "ja3_variant_count": 1, "ja3_variants": [ "dd414c9cac12c3348d791cfbc51b0a2f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_e6b9c1a084a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "e6b9c1a084a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-51-17613-10-5,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790043263, "last_seen": 1790043263, "transport": "t", "ja3_hash": "65ba42309c2f168e7a83c88e8cc36e99", "ja3_variant_count": 1, "ja3_variants": [ "65ba42309c2f168e7a83c88e8cc36e99" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_e8dc25b04468", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "e8dc25b04468", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-11-65281-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789625568, "last_seen": 1789625568, "transport": "t", "ja3_hash": "0120c6420fcea060884c6f7ac286d9f6", "ja3_variant_count": 1, "ja3_variants": [ "0120c6420fcea060884c6f7ac286d9f6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_ed381e847915", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "ed381e847915", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-43-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790560564, "last_seen": 1790778297, "transport": "t", "ja3_hash": "9e06841bda19ed12134bf123649c0db7", "ja3_variant_count": 3, "ja3_variants": [ "9e06841bda19ed12134bf123649c0db7", "4fd9efa121f45c5cd7dca76bd66fb3da", "a415d31b4225d1fb45f098e1db28c596" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_f57b6c2bcd86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "f57b6c2bcd86", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-35-5-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790435305, "last_seen": 1790435305, "transport": "t", "ja3_hash": "f1f8604ae33c476b746a822f1d65f276", "ja3_variant_count": 1, "ja3_variants": [ "f1f8604ae33c476b746a822f1d65f276" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_fc8a12d8b690", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "fc8a12d8b690", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-65037-17613-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790307871, "last_seen": 1790307871, "transport": "t", "ja3_hash": "fb391bde60d1da644c11151856207c75", "ja3_variant_count": 1, "ja3_variants": [ "fb391bde60d1da644c11151856207c75" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_febd682b6ce7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "febd682b6ce7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-10-65281-43-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788582210, "last_seen": 1788582210, "transport": "t", "ja3_hash": "9f82ca3d75a469683d809612191acabc", "ja3_variant_count": 1, "ja3_variants": [ "9f82ca3d75a469683d809612191acabc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_ff3933a4e55e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "ff3933a4e55e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-18-13-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791293674, "last_seen": 1791293674, "transport": "t", "ja3_hash": "6ae9c6fbf988ddd7cc3e80bf6795a2ed", "ja3_variant_count": 1, "ja3_variants": [ "6ae9c6fbf988ddd7cc3e80bf6795a2ed" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1506h1_8daaf6152771_80c842537e79", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h1", "b": "8daaf6152771", "c": "80c842537e79", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-65281-23-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790556075, "last_seen": 1790556075, "transport": "t", "ja3_hash": "3d3f26ab1f897cee2df35a7ad50df689", "ja3_variant_count": 1, "ja3_variants": [ "3d3f26ab1f897cee2df35a7ad50df689" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_0cc47d9663ae", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "0cc47d9663ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-10-65281-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788785797, "last_seen": 1788785797, "transport": "t", "ja3_hash": "29c06e0c7a9e535f1f2eac6ebfb625d4", "ja3_variant_count": 1, "ja3_variants": [ "29c06e0c7a9e535f1f2eac6ebfb625d4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_11efd38d667e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "11efd38d667e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-17613-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791251601, "last_seen": 1791251601, "transport": "t", "ja3_hash": "d1bd46d8f6cdb6e1b0559b2492b0f18f", "ja3_variant_count": 1, "ja3_variants": [ "d1bd46d8f6cdb6e1b0559b2492b0f18f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_150eb2813d6d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "150eb2813d6d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-35-45-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789698150, "last_seen": 1789698150, "transport": "t", "ja3_hash": "2590387dfd2dec3035dd96af1ad7fac4", "ja3_variant_count": 1, "ja3_variants": [ "2590387dfd2dec3035dd96af1ad7fac4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_1fafdbdda43f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "1fafdbdda43f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-16-43-5-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790386765, "last_seen": 1790386765, "transport": "t", "ja3_hash": "55289054f43d52e950bb5cf75489ff2e", "ja3_variant_count": 1, "ja3_variants": [ "55289054f43d52e950bb5cf75489ff2e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_474714bfeb6c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "474714bfeb6c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-17613-43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790735622, "last_seen": 1790735622, "transport": "t", "ja3_hash": "8f7e0208689f3fb78d3b505819124923", "ja3_variant_count": 1, "ja3_variants": [ "8f7e0208689f3fb78d3b505819124923" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 33 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_4a58e3695fa8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "4a58e3695fa8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-18-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790218390, "last_seen": 1790218390, "transport": "t", "ja3_hash": "1069ed97c24b4804e6d93ddb9e765b81", "ja3_variant_count": 1, "ja3_variants": [ "1069ed97c24b4804e6d93ddb9e765b81" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_4b5109766495", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "4b5109766495", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-45-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790234372, "last_seen": 1790234372, "transport": "t", "ja3_hash": "92828f2c6f9c3c97b0c314340c7af570", "ja3_variant_count": 1, "ja3_variants": [ "92828f2c6f9c3c97b0c314340c7af570" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_58bd7423d0cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "58bd7423d0cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-43-45-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788775516, "last_seen": 1788775516, "transport": "t", "ja3_hash": "7a70876d5193e2a49674fddcd21cdd91", "ja3_variant_count": 1, "ja3_variants": [ "7a70876d5193e2a49674fddcd21cdd91" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_5e0b32e8def7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "5e0b32e8def7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-43-51-16-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790365878, "last_seen": 1790365878, "transport": "t", "ja3_hash": "70f19586ab32ee85b57d2ec6bf99fbc0", "ja3_variant_count": 1, "ja3_variants": [ "70f19586ab32ee85b57d2ec6bf99fbc0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_60c320a0119b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "60c320a0119b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-43-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790226377, "last_seen": 1790226377, "transport": "t", "ja3_hash": "588a4e4b16f5eb15f78b9327a0c700e1", "ja3_variant_count": 1, "ja3_variants": [ "588a4e4b16f5eb15f78b9327a0c700e1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_6896342285d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "6896342285d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-65281-16-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788771307, "last_seen": 1788771307, "transport": "t", "ja3_hash": "305303c58ea1acab1b6712afc421b3e1", "ja3_variant_count": 1, "ja3_variants": [ "305303c58ea1acab1b6712afc421b3e1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_68e30e573997", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "68e30e573997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-16-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790282665, "last_seen": 1790282665, "transport": "t", "ja3_hash": "dbc3058af36c47e89bd8990c0ada55db", "ja3_variant_count": 1, "ja3_variants": [ "dbc3058af36c47e89bd8990c0ada55db" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_a0128d5c8140", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "a0128d5c8140", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-45-51-43-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790689773, "last_seen": 1790689773, "transport": "t", "ja3_hash": "5ccd8050dd8a9d6bb2146a4e90d36b36", "ja3_variant_count": 1, "ja3_variants": [ "5ccd8050dd8a9d6bb2146a4e90d36b36" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_a288482acbd7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "a288482acbd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-65037-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790577455, "last_seen": 1790577455, "transport": "t", "ja3_hash": "180f14fd89c6b21f5d4eb6001863c26d", "ja3_variant_count": 1, "ja3_variants": [ "180f14fd89c6b21f5d4eb6001863c26d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_a7219bd7587b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "a7219bd7587b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-16-51-27-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790226845, "last_seen": 1790226845, "transport": "t", "ja3_hash": "37eba5a6946de26eb66f60db0a92d43b", "ja3_variant_count": 1, "ja3_variants": [ "37eba5a6946de26eb66f60db0a92d43b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_b43d6105d122", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "b43d6105d122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-17613-45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788791324, "last_seen": 1788791324, "transport": "t", "ja3_hash": "b729a47ebcbb4ee7b6aa2db6c3be41f5", "ja3_variant_count": 1, "ja3_variants": [ "b729a47ebcbb4ee7b6aa2db6c3be41f5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_ea968fbdba49", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "ea968fbdba49", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-65281-35-43-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788535348, "last_seen": 1788535348, "transport": "t", "ja3_hash": "38ad2dae2f2c97d6b0ef94b4d71b85c3", "ja3_variant_count": 1, "ja3_variants": [ "38ad2dae2f2c97d6b0ef94b4d71b85c3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_ebb08d83d7fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "ebb08d83d7fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-11-17613-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790273615, "last_seen": 1790273615, "transport": "t", "ja3_hash": "e98f1a3ec8b7d10170c5f92d1b80f5e0", "ja3_variant_count": 1, "ja3_variants": [ "e98f1a3ec8b7d10170c5f92d1b80f5e0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_f882640564ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "f882640564ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-43-16-13-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790457836, "last_seen": 1790457836, "transport": "t", "ja3_hash": "fc6b7a43c1b75def13ad35984c053d7f", "ja3_variant_count": 1, "ja3_variants": [ "fc6b7a43c1b75def13ad35984c053d7f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_04af2224c526", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "04af2224c526", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-11-51-45-43-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790575705, "last_seen": 1790575705, "transport": "t", "ja3_hash": "136a651d13c586711f208d3f4f822c18", "ja3_variant_count": 1, "ja3_variants": [ "136a651d13c586711f208d3f4f822c18" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_14999f56e34e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "14999f56e34e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-65037-43-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789049535, "last_seen": 1789049535, "transport": "t", "ja3_hash": "90782ce33beb28ddbb259c85c7ece3c5", "ja3_variant_count": 1, "ja3_variants": [ "90782ce33beb28ddbb259c85c7ece3c5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_1604a4b3572d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "1604a4b3572d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-5-51764-35-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791117623, "last_seen": 1791117623, "transport": "t", "ja3_hash": "553830709bca6f3e486a47ea153e61bb", "ja3_variant_count": 1, "ja3_variants": [ "553830709bca6f3e486a47ea153e61bb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_1ab3cc48dfa2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "1ab3cc48dfa2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-45-5-43-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790963986, "last_seen": 1790963986, "transport": "t", "ja3_hash": "49bfa2066678943236aff935e54f0fdf", "ja3_variant_count": 1, "ja3_variants": [ "49bfa2066678943236aff935e54f0fdf" ], "user_agents": { "\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"": 2 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_1d81a53c55b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "1d81a53c55b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-10-43-5-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791010216, "last_seen": 1791010216, "transport": "t", "ja3_hash": "5302d6098b5600c37465c68844db0249", "ja3_variant_count": 1, "ja3_variants": [ "5302d6098b5600c37465c68844db0249" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_2631ae54760b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "2631ae54760b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-17613-43-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202333, "last_seen": 1790202333, "transport": "t", "ja3_hash": "a1a8dd36614db879e28787d85563a2d7", "ja3_variant_count": 1, "ja3_variants": [ "a1a8dd36614db879e28787d85563a2d7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_2812d2562093", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "2812d2562093", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-18-65281-45-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789631397, "last_seen": 1789631397, "transport": "t", "ja3_hash": "0b77f6bffe96dc7e35c7622e37e62160", "ja3_variant_count": 1, "ja3_variants": [ "0b77f6bffe96dc7e35c7622e37e62160" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_2ed8aa6197ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "2ed8aa6197ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-35-10-43-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790669837, "last_seen": 1790669837, "transport": "t", "ja3_hash": "e00dbfe3debbb7e5f9aa9882c0276dc0", "ja3_variant_count": 1, "ja3_variants": [ "e00dbfe3debbb7e5f9aa9882c0276dc0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_3107948df00b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "3107948df00b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-23-43-10-11-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790220222, "last_seen": 1790220222, "transport": "t", "ja3_hash": "bf7d5896026913e5224491116a378002", "ja3_variant_count": 1, "ja3_variants": [ "bf7d5896026913e5224491116a378002" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_3205287afbfc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "3205287afbfc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-23-43-45-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790354433, "last_seen": 1790354433, "transport": "t", "ja3_hash": "347c9018ed4f8788cb6158b7d0d49d07", "ja3_variant_count": 1, "ja3_variants": [ "347c9018ed4f8788cb6158b7d0d49d07" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_3a1aba1cf808", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "3a1aba1cf808", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-10-11-43-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788767341, "last_seen": 1788767341, "transport": "t", "ja3_hash": "4c310a0146304cd55e8f38299257fcc6", "ja3_variant_count": 1, "ja3_variants": [ "4c310a0146304cd55e8f38299257fcc6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_3de507b98069", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "3de507b98069", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-18-35-65037-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790158154, "last_seen": 1790158154, "transport": "t", "ja3_hash": "1212ee04ed16c4858f0d3bbf3aab3e8b", "ja3_variant_count": 1, "ja3_variants": [ "1212ee04ed16c4858f0d3bbf3aab3e8b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_43e31e334869", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "43e31e334869", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-65281-11-27-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791303823, "last_seen": 1791303823, "transport": "t", "ja3_hash": "8b2677af98152bf8c48eff691a9a1e4c", "ja3_variant_count": 1, "ja3_variants": [ "8b2677af98152bf8c48eff691a9a1e4c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_4b7351c6e4a2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "4b7351c6e4a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-13-5-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790532478, "last_seen": 1790532478, "transport": "t", "ja3_hash": "97b9688ce3d7a7e36c257b58fbec7f1c", "ja3_variant_count": 1, "ja3_variants": [ "97b9688ce3d7a7e36c257b58fbec7f1c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_4d7a63c27637", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "4d7a63c27637", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-45-43-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789938451, "last_seen": 1789938451, "transport": "t", "ja3_hash": "2992be65801bde4320797d5c1a242d90", "ja3_variant_count": 1, "ja3_variants": [ "2992be65801bde4320797d5c1a242d90" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_50200da7cc2f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "50200da7cc2f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-45-27-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789711529, "last_seen": 1789711529, "transport": "t", "ja3_hash": "4a4f7df7f835200fa74326f3a3a9c7a8", "ja3_variant_count": 1, "ja3_variants": [ "4a4f7df7f835200fa74326f3a3a9c7a8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_547f055cdb4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "547f055cdb4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-35-65281-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789418925, "last_seen": 1789418925, "transport": "t", "ja3_hash": "042af20b858b5de081740ab84689e526", "ja3_variant_count": 1, "ja3_variants": [ "042af20b858b5de081740ab84689e526" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_55e0631d3216", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "55e0631d3216", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-5-65281-51-43-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790650996, "last_seen": 1790650996, "transport": "t", "ja3_hash": "aa3b126e9f5a9961236bc3cbef29b024", "ja3_variant_count": 1, "ja3_variants": [ "aa3b126e9f5a9961236bc3cbef29b024" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_57cc270822f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "57cc270822f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-35-18-43-51-16,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789109331, "last_seen": 1789109331, "transport": "t", "ja3_hash": "a1e13b5b936ab61a478329d055736d8e", "ja3_variant_count": 1, "ja3_variants": [ "a1e13b5b936ab61a478329d055736d8e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_5c1cecb137ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "5c1cecb137ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-43-10-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789979298, "last_seen": 1789979298, "transport": "t", "ja3_hash": "902de53538f43152ac5a5a48cf2bdc76", "ja3_variant_count": 1, "ja3_variants": [ "902de53538f43152ac5a5a48cf2bdc76" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_61647b8093ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "61647b8093ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-13-23-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790596403, "last_seen": 1790596403, "transport": "t", "ja3_hash": "116ddaffebfad2a94f955969c46b04ad", "ja3_variant_count": 1, "ja3_variants": [ "116ddaffebfad2a94f955969c46b04ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_627e3b60aa8a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "627e3b60aa8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-65281-27-65037-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788776872, "last_seen": 1791208449, "transport": "t", "ja3_hash": "2ab5ed661b9141cbd1851a4d77ff6da0", "ja3_variant_count": 2, "ja3_variants": [ "2ab5ed661b9141cbd1851a4d77ff6da0", "9ebb3e9ad3c6f6d23e23fcde44657e0f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_69013921c227", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "69013921c227", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-13-43-35-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790617045, "last_seen": 1790617045, "transport": "t", "ja3_hash": "67e29e1a37190da6c89a60fa1052a709", "ja3_variant_count": 1, "ja3_variants": [ "67e29e1a37190da6c89a60fa1052a709" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 40 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_6aeefddbf1c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "6aeefddbf1c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-23-10-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790496071, "last_seen": 1790496071, "transport": "t", "ja3_hash": "3f69c3ad3594f8912339fa3aadf4f84b", "ja3_variant_count": 1, "ja3_variants": [ "3f69c3ad3594f8912339fa3aadf4f84b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Vivaldi/7.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_6b1f6105df43", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "6b1f6105df43", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-43-13-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790103020, "last_seen": 1790103020, "transport": "t", "ja3_hash": "3d3c54874607eac74b867d4c726c9736", "ja3_variant_count": 1, "ja3_variants": [ "3d3c54874607eac74b867d4c726c9736" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_6cd6e6aad5b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "6cd6e6aad5b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-51-11-43-45-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790477779, "last_seen": 1790477779, "transport": "t", "ja3_hash": "ce4debc34ea9ca8fa2e69057f765d288", "ja3_variant_count": 1, "ja3_variants": [ "ce4debc34ea9ca8fa2e69057f765d288" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_7c3e28ec6004", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "7c3e28ec6004", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-27-13-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788788481, "last_seen": 1788788481, "transport": "t", "ja3_hash": "12df6789272ff35f384c719faba92542", "ja3_variant_count": 1, "ja3_variants": [ "12df6789272ff35f384c719faba92542" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_7d49d8d4b0e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "7d49d8d4b0e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,51764-18-27-17613-45-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789841708, "last_seen": 1789841708, "transport": "t", "ja3_hash": "2fec933d50ec470c6ee6ff37d5f8ec42", "ja3_variant_count": 1, "ja3_variants": [ "2fec933d50ec470c6ee6ff37d5f8ec42" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_8be7c3f56a9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "8be7c3f56a9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-18-23-65281-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791101377, "last_seen": 1791101377, "transport": "t", "ja3_hash": "8a1e10b86f7c2bd0edd3f52f81c7fe73", "ja3_variant_count": 1, "ja3_variants": [ "8a1e10b86f7c2bd0edd3f52f81c7fe73" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_8d945f2ed19d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "8d945f2ed19d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-10-35-13-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789971471, "last_seen": 1790332848, "transport": "t", "ja3_hash": "a42c5092f8b305685024df1d7aebee9d", "ja3_variant_count": 2, "ja3_variants": [ "a42c5092f8b305685024df1d7aebee9d", "78fb723b02b7449fb9d5d9d9424e6c30" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_942197fac025", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "942197fac025", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-17613-51-35-11-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790876493, "last_seen": 1790876493, "transport": "t", "ja3_hash": "7406dfd38c6fb428f0d61878c21f3fe6", "ja3_variant_count": 1, "ja3_variants": [ "7406dfd38c6fb428f0d61878c21f3fe6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_985a50fcdaa9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "985a50fcdaa9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-43-65281-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790544717, "last_seen": 1790544717, "transport": "t", "ja3_hash": "211c47000406c359b787126395579fcf", "ja3_variant_count": 1, "ja3_variants": [ "211c47000406c359b787126395579fcf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_9c5fe9d0f94a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "9c5fe9d0f94a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-23-51-11-10-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788843486, "last_seen": 1788843486, "transport": "t", "ja3_hash": "57fde5a81159f835b12e1fbed7f2cf44", "ja3_variant_count": 1, "ja3_variants": [ "57fde5a81159f835b12e1fbed7f2cf44" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_a957cb98a53f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "a957cb98a53f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-43-65281-35-51-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791040273, "last_seen": 1791040273, "transport": "t", "ja3_hash": "7ab29a3da12ded49b09af0522ae130fb", "ja3_variant_count": 1, "ja3_variants": [ "7ab29a3da12ded49b09af0522ae130fb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_ad454b251b66", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "ad454b251b66", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-65281-17613-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788801242, "last_seen": 1788801242, "transport": "t", "ja3_hash": "106ce899f50265b37744ba913ee4b51e", "ja3_variant_count": 1, "ja3_variants": [ "106ce899f50265b37744ba913ee4b51e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_af323119c6c7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "af323119c6c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-43-11-35-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790986833, "last_seen": 1790986833, "transport": "t", "ja3_hash": "598713542b24840ede2a107be96f45cc", "ja3_variant_count": 1, "ja3_variants": [ "598713542b24840ede2a107be96f45cc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_b1f5a02ea05e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "b1f5a02ea05e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-18-43-13-23-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790314032, "last_seen": 1790314032, "transport": "t", "ja3_hash": "6614e975d4036d53030ee9b5dadc1136", "ja3_variant_count": 1, "ja3_variants": [ "6614e975d4036d53030ee9b5dadc1136" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_b3db04a37961", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "b3db04a37961", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-11-43-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790536575, "last_seen": 1790536575, "transport": "t", "ja3_hash": "ddc898d4243844552bc5e0585caef553", "ja3_variant_count": 1, "ja3_variants": [ "ddc898d4243844552bc5e0585caef553" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_b5c41e43d591", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "b5c41e43d591", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-23-11-35-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789747795, "last_seen": 1790456818, "transport": "t", "ja3_hash": "5621ca4c4541b537047fd06037d04765", "ja3_variant_count": 2, "ja3_variants": [ "5621ca4c4541b537047fd06037d04765", "7b2fdf36d151f2a657031f4b06a023c9" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_b7d0bc79fdc5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "b7d0bc79fdc5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-43-10-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788715620, "last_seen": 1788715620, "transport": "t", "ja3_hash": "891b4956079d656c097e2e18b759ccd7", "ja3_variant_count": 1, "ja3_variants": [ "891b4956079d656c097e2e18b759ccd7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_b8ba02607524", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "b8ba02607524", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-51-43-11-65037-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790961569, "last_seen": 1790961569, "transport": "t", "ja3_hash": "13f8da5f95c97848cd6f8c21aa0b6b8e", "ja3_variant_count": 1, "ja3_variants": [ "13f8da5f95c97848cd6f8c21aa0b6b8e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_bf4ab279fbb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "bf4ab279fbb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-27-45-23-18-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790337426, "last_seen": 1790337426, "transport": "t", "ja3_hash": "40bae50af773bd68674cde2ce183ed1e", "ja3_variant_count": 1, "ja3_variants": [ "40bae50af773bd68674cde2ce183ed1e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_c0d1c8f9847b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "c0d1c8f9847b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-18-13-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788852805, "last_seen": 1788852805, "transport": "t", "ja3_hash": "a3967fce74f468fbbbe78389e475bc39", "ja3_variant_count": 1, "ja3_variants": [ "a3967fce74f468fbbbe78389e475bc39" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_c8403b629d80", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "c8403b629d80", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-35-43-17613-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790675747, "last_seen": 1790675747, "transport": "t", "ja3_hash": "78ce0d752e23f690e81ff04463b32aa0", "ja3_variant_count": 1, "ja3_variants": [ "78ce0d752e23f690e81ff04463b32aa0" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_ca98a246c5c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "ca98a246c5c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-23-11-35-45-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789626859, "last_seen": 1789626859, "transport": "t", "ja3_hash": "29647e496e797340ad0f588ea765c48c", "ja3_variant_count": 1, "ja3_variants": [ "29647e496e797340ad0f588ea765c48c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_cbd15a882afb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "cbd15a882afb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-65281-5-43-45-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790257090, "last_seen": 1790257090, "transport": "t", "ja3_hash": "7a710caf73e269fca79d9226bafbfa7b", "ja3_variant_count": 1, "ja3_variants": [ "7a710caf73e269fca79d9226bafbfa7b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_cca87d30bc92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "cca87d30bc92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-17613-18-43-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788714051, "last_seen": 1788714051, "transport": "t", "ja3_hash": "cc04c6a50c5948277377d7bd147f97d7", "ja3_variant_count": 1, "ja3_variants": [ "cc04c6a50c5948277377d7bd147f97d7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_d2b82c37d27d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "d2b82c37d27d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-43-23-65037-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790612930, "last_seen": 1790612930, "transport": "t", "ja3_hash": "1fbc2dcb4f0e951ac0a9693db8a38c50", "ja3_variant_count": 1, "ja3_variants": [ "1fbc2dcb4f0e951ac0a9693db8a38c50" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_d42f186072f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "d42f186072f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-23-18-11-43-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750657, "last_seen": 1789750657, "transport": "t", "ja3_hash": "78a7dc871454e29a1c64e22e77833558", "ja3_variant_count": 1, "ja3_variants": [ "78a7dc871454e29a1c64e22e77833558" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_d8683c3acf2c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "d8683c3acf2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-13-5-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241712, "last_seen": 1790241712, "transport": "t", "ja3_hash": "0d297e6a471352095511529c417be900", "ja3_variant_count": 1, "ja3_variants": [ "0d297e6a471352095511529c417be900" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_dea85b3dae42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "dea85b3dae42", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-18-17613-5-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788819022, "last_seen": 1788824699, "transport": "t", "ja3_hash": "fec032dd6ad2e23c5d5811be8a582c87", "ja3_variant_count": 2, "ja3_variants": [ "fec032dd6ad2e23c5d5811be8a582c87", "06635f85af8fc1cf9b99e20a771a2003" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_df0708bddc57", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "df0708bddc57", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-43-13-45-11-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788830041, "last_seen": 1790293368, "transport": "t", "ja3_hash": "07b74962fdd6e3d04f9ce9836ad0f0e3", "ja3_variant_count": 2, "ja3_variants": [ "07b74962fdd6e3d04f9ce9836ad0f0e3", "3f61276fafe0f4d601d35f45a650dddd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_e0243d11bc2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "e0243d11bc2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-43-18-10-11-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789627306, "last_seen": 1789627306, "transport": "t", "ja3_hash": "c22550ffcf043750313e3e4d66a0c346", "ja3_variant_count": 1, "ja3_variants": [ "c22550ffcf043750313e3e4d66a0c346" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_e04448979512", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "e04448979512", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-65281-18-51-13-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669077, "last_seen": 1789669077, "transport": "t", "ja3_hash": "6fc5a91988713b098b08aaabc362de04", "ja3_variant_count": 1, "ja3_variants": [ "6fc5a91988713b098b08aaabc362de04" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_e2dd93164c3f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "e2dd93164c3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-43-13-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788570124, "last_seen": 1788570124, "transport": "t", "ja3_hash": "1adf406338f8e6b68e10257c5cd9cb80", "ja3_variant_count": 1, "ja3_variants": [ "1adf406338f8e6b68e10257c5cd9cb80" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_e7262b2f9424", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "e7262b2f9424", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-43-10-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790218763, "last_seen": 1790218763, "transport": "t", "ja3_hash": "ca5ce1b1dc8f7d671acdc4b59c1950d9", "ja3_variant_count": 1, "ja3_variants": [ "ca5ce1b1dc8f7d671acdc4b59c1950d9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_ec406718d266", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "ec406718d266", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-43-51-35-13-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789838659, "last_seen": 1789838659, "transport": "t", "ja3_hash": "c5344231fb43ef334ac38442e0094b1f", "ja3_variant_count": 1, "ja3_variants": [ "c5344231fb43ef334ac38442e0094b1f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_f0165680e07a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "f0165680e07a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-27-43-13-11-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197414, "last_seen": 1790197414, "transport": "t", "ja3_hash": "15c12cefb0512c39fd0d34b99b8ecac7", "ja3_variant_count": 1, "ja3_variants": [ "15c12cefb0512c39fd0d34b99b8ecac7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_f6ee005369b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "f6ee005369b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-23-35-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790146144, "last_seen": 1790146144, "transport": "t", "ja3_hash": "4ef0749eb07cb378f34b758e7ca73e44", "ja3_variant_count": 1, "ja3_variants": [ "4ef0749eb07cb378f34b758e7ca73e44" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_f953e29ac03a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "f953e29ac03a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-23-11-45-43-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789688470, "last_seen": 1789688470, "transport": "t", "ja3_hash": "aae802acf7334ca10af2fa4da6501649", "ja3_variant_count": 1, "ja3_variants": [ "aae802acf7334ca10af2fa4da6501649" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_fb00e1ca9b63", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "fb00e1ca9b63", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-17613-43-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791133015, "last_seen": 1791133015, "transport": "t", "ja3_hash": "c02e446a2a0c31ab6843ab3d6dd3fb93", "ja3_variant_count": 1, "ja3_variants": [ "c02e446a2a0c31ab6843ab3d6dd3fb93" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 25 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_fbad43ae38b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "fbad43ae38b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-11-5-45-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789683767, "last_seen": 1789683767, "transport": "t", "ja3_hash": "1a9d79e69ebb3d416165bf3f784f1758", "ja3_variant_count": 1, "ja3_variants": [ "1a9d79e69ebb3d416165bf3f784f1758" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1507h1_8daaf6152771_0839b838a037", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h1", "b": "8daaf6152771", "c": "0839b838a037", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-18-43-51-13-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790522749, "last_seen": 1790522749, "transport": "t", "ja3_hash": "c9188b770cc1bcf43040500ba881932e", "ja3_variant_count": 1, "ja3_variants": [ "c9188b770cc1bcf43040500ba881932e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h1_8daaf6152771_5b2c29254690", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h1", "b": "8daaf6152771", "c": "5b2c29254690", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-43-65037-16-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524731, "last_seen": 1790524731, "transport": "t", "ja3_hash": "2fe05cafd98ae720bb0f8857709c5c99", "ja3_variant_count": 1, "ja3_variants": [ "2fe05cafd98ae720bb0f8857709c5c99" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h1_8daaf6152771_fab567f5aac1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h1", "b": "8daaf6152771", "c": "fab567f5aac1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-5-51-65281-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790534213, "last_seen": 1790534213, "transport": "t", "ja3_hash": "cd12e365f710e0e9a8ff1ccdf88f51a0", "ja3_variant_count": 1, "ja3_variants": [ "cd12e365f710e0e9a8ff1ccdf88f51a0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_037e30ce60d7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "037e30ce60d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-13-17613-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789058353, "last_seen": 1789058353, "transport": "t", "ja3_hash": "e36f5ae7cc4289d7afe950fc40ddbb16", "ja3_variant_count": 1, "ja3_variants": [ "e36f5ae7cc4289d7afe950fc40ddbb16" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_126056c0cbca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "126056c0cbca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-23-35-18-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790219041, "last_seen": 1790219041, "transport": "t", "ja3_hash": "847028c82ef2a7410c66331e58cee8b5", "ja3_variant_count": 1, "ja3_variants": [ "847028c82ef2a7410c66331e58cee8b5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_2efb05040239", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "2efb05040239", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-13-18-10-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110373, "last_seen": 1791110373, "transport": "t", "ja3_hash": "271eee9bf1b483722754e15274a74240", "ja3_variant_count": 1, "ja3_variants": [ "271eee9bf1b483722754e15274a74240" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_3aaab0ba5b05", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "3aaab0ba5b05", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-18-11-65281-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789033935, "last_seen": 1789033935, "transport": "t", "ja3_hash": "3c90017593a30e9b9602d58d52e0737c", "ja3_variant_count": 1, "ja3_variants": [ "3c90017593a30e9b9602d58d52e0737c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_4954ab98b428", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "4954ab98b428", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-16-43-51-10-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789501599, "last_seen": 1789501599, "transport": "t", "ja3_hash": "6f4d539db85535b1a48f51b7dd921cb9", "ja3_variant_count": 1, "ja3_variants": [ "6f4d539db85535b1a48f51b7dd921cb9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_58be889b0f8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "58be889b0f8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-18-10-51-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790948045, "last_seen": 1790948045, "transport": "t", "ja3_hash": "4ca9d213553d286b62c69763a6ae78c3", "ja3_variant_count": 1, "ja3_variants": [ "4ca9d213553d286b62c69763a6ae78c3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_5d6252693bbf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "5d6252693bbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-43-5-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789796463, "last_seen": 1789796463, "transport": "t", "ja3_hash": "3c503a8cb593dd22c7ff1a9a96901378", "ja3_variant_count": 1, "ja3_variants": [ "3c503a8cb593dd22c7ff1a9a96901378" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_631c97e87732", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "631c97e87732", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-65281-43-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788784451, "last_seen": 1788784451, "transport": "t", "ja3_hash": "0b3fa4bee11542c14defad851dfa8c68", "ja3_variant_count": 1, "ja3_variants": [ "0b3fa4bee11542c14defad851dfa8c68" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_637da8953776", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "637da8953776", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-23-65037-18-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789685659, "last_seen": 1789685659, "transport": "t", "ja3_hash": "e9224578d7d7cd396cd7f221174409cc", "ja3_variant_count": 1, "ja3_variants": [ "e9224578d7d7cd396cd7f221174409cc" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_696dcad8b88a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "696dcad8b88a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-27-11-51-43-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789992988, "last_seen": 1789992988, "transport": "t", "ja3_hash": "3f892bbe06ff497dba2a3e49c07b5ebd", "ja3_variant_count": 1, "ja3_variants": [ "3f892bbe06ff497dba2a3e49c07b5ebd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_7e3905d93d65", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "7e3905d93d65", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-45-27-16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789680769, "last_seen": 1789680769, "transport": "t", "ja3_hash": "361bec099f2a7defbe87286a2c721031", "ja3_variant_count": 1, "ja3_variants": [ "361bec099f2a7defbe87286a2c721031" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_8349cb20f5d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "8349cb20f5d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-10-43-65281-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788760618, "last_seen": 1788760618, "transport": "t", "ja3_hash": "e5fff30529417f4c315e05a3e3fff816", "ja3_variant_count": 1, "ja3_variants": [ "e5fff30529417f4c315e05a3e3fff816" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_87dde60cb784", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "87dde60cb784", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-18-45-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788731306, "last_seen": 1788731306, "transport": "t", "ja3_hash": "b8efaab2625b9022fc61829efa0a9417", "ja3_variant_count": 1, "ja3_variants": [ "b8efaab2625b9022fc61829efa0a9417" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_8d68da67a364", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "8d68da67a364", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-43-10-18-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790959673, "last_seen": 1790959673, "transport": "t", "ja3_hash": "a6bb92fb40e7f3355c6d3a99d95cc24a", "ja3_variant_count": 1, "ja3_variants": [ "a6bb92fb40e7f3355c6d3a99d95cc24a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_91504945e8dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "91504945e8dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-43-11-18-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790286683, "last_seen": 1790286683, "transport": "t", "ja3_hash": "5261586f69adaf91d066fd7e8072e449", "ja3_variant_count": 1, "ja3_variants": [ "5261586f69adaf91d066fd7e8072e449" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_943a4b011374", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "943a4b011374", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-65281-18-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790244404, "last_seen": 1790244404, "transport": "t", "ja3_hash": "2dcea56ccd711cc49236bd1f78330d47", "ja3_variant_count": 1, "ja3_variants": [ "2dcea56ccd711cc49236bd1f78330d47" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_9dcd131ab656", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "9dcd131ab656", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-5-35-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790729622, "last_seen": 1790729622, "transport": "t", "ja3_hash": "3e4f128b320bcfc963be3e8bfc747b94", "ja3_variant_count": 1, "ja3_variants": [ "3e4f128b320bcfc963be3e8bfc747b94" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_aa7af84a9908", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "aa7af84a9908", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-65281-16-43-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791145551, "last_seen": 1791145551, "transport": "t", "ja3_hash": "a0e7920fe53c54404a9c6657037663a4", "ja3_variant_count": 1, "ja3_variants": [ "a0e7920fe53c54404a9c6657037663a4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.1.0 Safari/537.36 Edg/128.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_ac14bacc7fef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "ac14bacc7fef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-65281-65037-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789033858, "last_seen": 1789033858, "transport": "t", "ja3_hash": "ff313738030eb61d0ddfecc122662a60", "ja3_variant_count": 1, "ja3_variants": [ "ff313738030eb61d0ddfecc122662a60" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_d8152d091001", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "d8152d091001", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-10-35-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790853417, "last_seen": 1790853417, "transport": "t", "ja3_hash": "804a3036630337e327f30b1f2e6e0ecc", "ja3_variant_count": 1, "ja3_variants": [ "804a3036630337e327f30b1f2e6e0ecc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_db227dce0b70", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "db227dce0b70", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-35-43-23-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788711044, "last_seen": 1788711044, "transport": "t", "ja3_hash": "eec8c5228bc7e7e61d378921f6df7339", "ja3_variant_count": 1, "ja3_variants": [ "eec8c5228bc7e7e61d378921f6df7339" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_e85a43562631", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "e85a43562631", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-16-43-11-18-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788931279, "last_seen": 1788931279, "transport": "t", "ja3_hash": "b5a6a17a660911f8c28de2ec2854c9b6", "ja3_variant_count": 1, "ja3_variants": [ "b5a6a17a660911f8c28de2ec2854c9b6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_e8fbccb2f52a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "e8fbccb2f52a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-65281-35-23-43-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788721865, "last_seen": 1788721865, "transport": "t", "ja3_hash": "3f92a5784af559baa5437603b1008c87", "ja3_variant_count": 1, "ja3_variants": [ "3f92a5784af559baa5437603b1008c87" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_f04b735a243d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "f04b735a243d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-16-27-43-51-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790197012, "last_seen": 1790200953, "transport": "t", "ja3_hash": "a1b933bd487ac5477b43aa652ae0fe30", "ja3_variant_count": 2, "ja3_variants": [ "a1b933bd487ac5477b43aa652ae0fe30", "15c32b1aa2618ff67c1d274a98ec03f0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_f3fb270e081c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "f3fb270e081c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-51-43-27-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790228387, "last_seen": 1790228387, "transport": "t", "ja3_hash": "a67e292e8bdd3fb2dcb42bc1be3ae018", "ja3_variant_count": 1, "ja3_variants": [ "a67e292e8bdd3fb2dcb42bc1be3ae018" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_f5b19b5fc5fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "f5b19b5fc5fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-45-16-27-51-43-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790806528, "last_seen": 1790806528, "transport": "t", "ja3_hash": "3349a8482aa4d7fba440cf6960d3a83b", "ja3_variant_count": 1, "ja3_variants": [ "3349a8482aa4d7fba440cf6960d3a83b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_f7f40c1fd32f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "f7f40c1fd32f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-43-10-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789444995, "last_seen": 1789444995, "transport": "t", "ja3_hash": "3ff8d7a8e758fee131033d00b334df3f", "ja3_variant_count": 1, "ja3_variants": [ "3ff8d7a8e758fee131033d00b334df3f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_0157773c0b88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "0157773c0b88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-17613-65037-5-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789061274, "last_seen": 1789061274, "transport": "t", "ja3_hash": "51615fef6019aa21d621e56623808d00", "ja3_variant_count": 1, "ja3_variants": [ "51615fef6019aa21d621e56623808d00" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_01acb826410e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "01acb826410e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-43-27-18-65281-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791103986, "last_seen": 1791103986, "transport": "t", "ja3_hash": "167167b18507b228271c05dd1e8ab977", "ja3_variant_count": 1, "ja3_variants": [ "167167b18507b228271c05dd1e8ab977" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_01ee78502bc8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "01ee78502bc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-51-11-65281-23-43-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790911904, "last_seen": 1790911904, "transport": "t", "ja3_hash": "1c39c9495272b9ab16c6bf736c94dfe1", "ja3_variant_count": 1, "ja3_variants": [ "1c39c9495272b9ab16c6bf736c94dfe1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_0319242fcb3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "0319242fcb3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-43-11-23-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788768418, "last_seen": 1788768418, "transport": "t", "ja3_hash": "3fa804ce736066f51661fc7716626ba1", "ja3_variant_count": 1, "ja3_variants": [ "3fa804ce736066f51661fc7716626ba1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_04441fba79bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "04441fba79bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-17613-51-18-11-43-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787964823, "last_seen": 1789710334, "transport": "t", "ja3_hash": "fe339b81fc4398430d4cc0a0b6da8022", "ja3_variant_count": 1, "ja3_variants": [ "fe339b81fc4398430d4cc0a0b6da8022" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3333.52 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3861.109 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.2415.180 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_0457fa46aba6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "0457fa46aba6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-45-43-10-51-5-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790590240, "last_seen": 1790590240, "transport": "t", "ja3_hash": "24560853ac0153993b6d34428c12754d", "ja3_variant_count": 1, "ja3_variants": [ "24560853ac0153993b6d34428c12754d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_112865d3f29b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "112865d3f29b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-13-10-43-45-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790777800, "last_seen": 1790777800, "transport": "t", "ja3_hash": "2e480873f92fa4477afd910a9283a24e", "ja3_variant_count": 1, "ja3_variants": [ "2e480873f92fa4477afd910a9283a24e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_17f0974b08b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "17f0974b08b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-11-18-17613-23-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790229660, "last_seen": 1790229660, "transport": "t", "ja3_hash": "f8ce41130b4657465188d2a4cd60bc44", "ja3_variant_count": 1, "ja3_variants": [ "f8ce41130b4657465188d2a4cd60bc44" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_26e5c5e50624", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "26e5c5e50624", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-13-23-43-51-35-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789677567, "last_seen": 1789677567, "transport": "t", "ja3_hash": "52828423351d44ae552dc79147d8952b", "ja3_variant_count": 1, "ja3_variants": [ "52828423351d44ae552dc79147d8952b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 14 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_27b25b779a0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "27b25b779a0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-10-43-65281-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789849772, "last_seen": 1789849772, "transport": "t", "ja3_hash": "c913be15fe494319f28f943c1aa6e92f", "ja3_variant_count": 1, "ja3_variants": [ "c913be15fe494319f28f943c1aa6e92f" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_2bad6e4ab4c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "2bad6e4ab4c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-17613-51-27-45-43-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790730244, "last_seen": 1790730244, "transport": "t", "ja3_hash": "e947d97eee58aa8d05789d490663b77c", "ja3_variant_count": 1, "ja3_variants": [ "e947d97eee58aa8d05789d490663b77c" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_3692c4e0d45f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "3692c4e0d45f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-23-10-45-18-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789626377, "last_seen": 1789626377, "transport": "t", "ja3_hash": "b0a13f51f1ea5bf27455a19cfb0ec0f1", "ja3_variant_count": 1, "ja3_variants": [ "b0a13f51f1ea5bf27455a19cfb0ec0f1" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 10 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_3d002c925e43", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "3d002c925e43", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-65281-5-27-18-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790575227, "last_seen": 1790575227, "transport": "t", "ja3_hash": "08e3501051de744b9bc86e8e9c3351cb", "ja3_variant_count": 1, "ja3_variants": [ "08e3501051de744b9bc86e8e9c3351cb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_46065d64d004", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "46065d64d004", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-18-65281-43-27-35-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790117416, "last_seen": 1790117416, "transport": "t", "ja3_hash": "b6d929735c2c35f7733abbd6059a8bce", "ja3_variant_count": 1, "ja3_variants": [ "b6d929735c2c35f7733abbd6059a8bce" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_4656f2800040", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "4656f2800040", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-43-35-45-23-65281-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790501769, "last_seen": 1790501769, "transport": "t", "ja3_hash": "01ffbf19dccbce095923d0543deaabdd", "ja3_variant_count": 1, "ja3_variants": [ "01ffbf19dccbce095923d0543deaabdd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_466034d13688", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "466034d13688", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-17613-27-18-13-5-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790103377, "last_seen": 1790103377, "transport": "t", "ja3_hash": "41245851a8763f191a6c69653065fdd7", "ja3_variant_count": 1, "ja3_variants": [ "41245851a8763f191a6c69653065fdd7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 7 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_470212178a82", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "470212178a82", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-43-10-65281-65037-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790728492, "last_seen": 1791168044, "transport": "t", "ja3_hash": "88592c01c9f62ef006af25ebf404985c", "ja3_variant_count": 2, "ja3_variants": [ "88592c01c9f62ef006af25ebf404985c", "610dc001bce02219853e39c043ac7ead" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_470fd7a5b7f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "470fd7a5b7f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-18-27-17613-43-13-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789766388, "last_seen": 1789766388, "transport": "t", "ja3_hash": "dc96c1aa469ed779dac2047285fcfbb8", "ja3_variant_count": 1, "ja3_variants": [ "dc96c1aa469ed779dac2047285fcfbb8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 9 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_4c62a3dec0f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "4c62a3dec0f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-45-18-51-23-5-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789161297, "last_seen": 1789161297, "transport": "t", "ja3_hash": "72d367a65f2ab2c5700b068e1defab2b", "ja3_variant_count": 1, "ja3_variants": [ "72d367a65f2ab2c5700b068e1defab2b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_4e49027f7c35", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "4e49027f7c35", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-11-35-5-43-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790160950, "last_seen": 1790160950, "transport": "t", "ja3_hash": "05660a1027d62bf53c65735170153ac8", "ja3_variant_count": 1, "ja3_variants": [ "05660a1027d62bf53c65735170153ac8" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_50a562f80a92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "50a562f80a92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-10-5-51764-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789635383, "last_seen": 1789635383, "transport": "t", "ja3_hash": "4bb2e5441ec8a59e5b00f31a59a665f9", "ja3_variant_count": 1, "ja3_variants": [ "4bb2e5441ec8a59e5b00f31a59a665f9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_55ddb6e11ca6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "55ddb6e11ca6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-10-5-51-45-18-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790173802, "last_seen": 1790173802, "transport": "t", "ja3_hash": "5c5bb97889ad35ffd0f4a68b2ce896f7", "ja3_variant_count": 1, "ja3_variants": [ "5c5bb97889ad35ffd0f4a68b2ce896f7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_56353598d97e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "56353598d97e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-51-18-27-10-35-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790437755, "last_seen": 1790437755, "transport": "t", "ja3_hash": "2cbb1e09c04b3398c12d189695d4dcca", "ja3_variant_count": 1, "ja3_variants": [ "2cbb1e09c04b3398c12d189695d4dcca" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_6375ae0c06e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "6375ae0c06e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-18-23-35-43-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790760006, "last_seen": 1790760006, "transport": "t", "ja3_hash": "ee1860eb996577b7882e957a95e7941f", "ja3_variant_count": 1, "ja3_variants": [ "ee1860eb996577b7882e957a95e7941f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_63f4f7aca286", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "63f4f7aca286", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-18-45-23-65281-5-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790540331, "last_seen": 1790540331, "transport": "t", "ja3_hash": "70d127581eb29d3e8ed3bf1277ec2794", "ja3_variant_count": 1, "ja3_variants": [ "70d127581eb29d3e8ed3bf1277ec2794" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_6ec1b5901fe8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "6ec1b5901fe8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-51-17613-11-27-10-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790876658, "last_seen": 1790876658, "transport": "t", "ja3_hash": "73a002ec8042bca5b6a4aa10eb6742ee", "ja3_variant_count": 1, "ja3_variants": [ "73a002ec8042bca5b6a4aa10eb6742ee" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_71f86d770c1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "71f86d770c1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-17613-43-5-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790173050, "last_seen": 1790173050, "transport": "t", "ja3_hash": "4c25fac7d2862763605343b897581094", "ja3_variant_count": 1, "ja3_variants": [ "4c25fac7d2862763605343b897581094" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 22 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_748031af65d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "748031af65d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-10-43-35-45-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790499961, "last_seen": 1790499961, "transport": "t", "ja3_hash": "8806a92ff562ce0901b97205dbba5889", "ja3_variant_count": 1, "ja3_variants": [ "8806a92ff562ce0901b97205dbba5889" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_7b1919dfb7b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "7b1919dfb7b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-27-43-35-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790531417, "last_seen": 1790531417, "transport": "t", "ja3_hash": "f668ab5e5c026bd0770c224ed875494a", "ja3_variant_count": 1, "ja3_variants": [ "f668ab5e5c026bd0770c224ed875494a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_7dd4f199b43a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "7dd4f199b43a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-65281-43-35-23-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789882832, "last_seen": 1789882832, "transport": "t", "ja3_hash": "c2c0a2bff2963910811c6f0e3ef98983", "ja3_variant_count": 1, "ja3_variants": [ "c2c0a2bff2963910811c6f0e3ef98983" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_81d0aafbbaf8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "81d0aafbbaf8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-43-35-10-18-27-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790533893, "last_seen": 1790533893, "transport": "t", "ja3_hash": "a9bcb0b92636d6b2c4a7137bd21ba20d", "ja3_variant_count": 1, "ja3_variants": [ "a9bcb0b92636d6b2c4a7137bd21ba20d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_825b3d2a77c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "825b3d2a77c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-23-43-45-5-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788773877, "last_seen": 1790124003, "transport": "t", "ja3_hash": "54642f0090aa745a668b25a349d58f68", "ja3_variant_count": 2, "ja3_variants": [ "54642f0090aa745a668b25a349d58f68", "4c06a8a33c0f5e520d4018282929e661" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_849bde8d7fdc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "849bde8d7fdc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-43-13-51-23-11-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790780637, "last_seen": 1790780637, "transport": "t", "ja3_hash": "a93c15d180bf43f054c34e8c65c8f81c", "ja3_variant_count": 1, "ja3_variants": [ "a93c15d180bf43f054c34e8c65c8f81c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_854398f86dae", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "854398f86dae", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-17613-10-35-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789482776, "last_seen": 1789482776, "transport": "t", "ja3_hash": "06e944b3e4d8d61904d87410007f1eb4", "ja3_variant_count": 1, "ja3_variants": [ "06e944b3e4d8d61904d87410007f1eb4" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/133.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_8db08fe09f65", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "8db08fe09f65", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-43-11-5-18-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788848440, "last_seen": 1788848440, "transport": "t", "ja3_hash": "21e68a33e497aa2e3778ecdbe0320a2d", "ja3_variant_count": 1, "ja3_variants": [ "21e68a33e497aa2e3778ecdbe0320a2d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_90e4111e005c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "90e4111e005c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-43-27-65281-10-51-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790210521, "last_seen": 1790210521, "transport": "t", "ja3_hash": "d6478ed1b10beffd1ccf0cc344a2f70d", "ja3_variant_count": 1, "ja3_variants": [ "d6478ed1b10beffd1ccf0cc344a2f70d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_92f7105013cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "92f7105013cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-10-23-45-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789690507, "last_seen": 1789690507, "transport": "t", "ja3_hash": "935ca81bab02ef9292660d24515fc739", "ja3_variant_count": 1, "ja3_variants": [ "935ca81bab02ef9292660d24515fc739" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_9484f0b9c43f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "9484f0b9c43f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-43-17613-13-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789698610, "last_seen": 1789698610, "transport": "t", "ja3_hash": "e29592edc59577cd81cd1471c1302f5a", "ja3_variant_count": 1, "ja3_variants": [ "e29592edc59577cd81cd1471c1302f5a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_9749eab3bf86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "9749eab3bf86", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-17613-23-45-43-5-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790261220, "last_seen": 1790261220, "transport": "t", "ja3_hash": "cc048a3ce06138122b9e47dd10e7529a", "ja3_variant_count": 1, "ja3_variants": [ "cc048a3ce06138122b9e47dd10e7529a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_9a4aaf17e4b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "9a4aaf17e4b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-35-11-5-65281-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790941892, "last_seen": 1790941892, "transport": "t", "ja3_hash": "e839adeec490289e3f961e88d9ebf268", "ja3_variant_count": 1, "ja3_variants": [ "e839adeec490289e3f961e88d9ebf268" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_9acccf079cfa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "9acccf079cfa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-35-13-23-5-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790266619, "last_seen": 1790266619, "transport": "t", "ja3_hash": "f42ddef8fb8890cd1fea5db93bba2fda", "ja3_variant_count": 1, "ja3_variants": [ "f42ddef8fb8890cd1fea5db93bba2fda" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_9b18823f6dbd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "9b18823f6dbd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-10-51-35-5-43-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730646, "last_seen": 1789730646, "transport": "t", "ja3_hash": "9feb20784b5943cf60c209902b0630dd", "ja3_variant_count": 1, "ja3_variants": [ "9feb20784b5943cf60c209902b0630dd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_a1482d6b24e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "a1482d6b24e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-43-51-23-65281-35-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788847016, "last_seen": 1788847016, "transport": "t", "ja3_hash": "1939ea702fe7953a68bf2bd09ed87d16", "ja3_variant_count": 1, "ja3_variants": [ "1939ea702fe7953a68bf2bd09ed87d16" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_aa1ce34e7aff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "aa1ce34e7aff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-23-35-51-11-43-13,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790554105, "last_seen": 1790554105, "transport": "t", "ja3_hash": "f2ec8a86f8e080172bf47f27b83785da", "ja3_variant_count": 1, "ja3_variants": [ "f2ec8a86f8e080172bf47f27b83785da" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_abb06822f10d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "abb06822f10d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-43-10-45-27-51-65281,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790573657, "last_seen": 1790573657, "transport": "t", "ja3_hash": "ff6bb18fb59bdf10ffd15271d5f2ca91", "ja3_variant_count": 1, "ja3_variants": [ "ff6bb18fb59bdf10ffd15271d5f2ca91" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_ac2248f4d986", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "ac2248f4d986", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-65281-11-51764-5-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791117650, "last_seen": 1791117650, "transport": "t", "ja3_hash": "d3063a9856cdc757e42894888afb3e27", "ja3_variant_count": 1, "ja3_variants": [ "d3063a9856cdc757e42894888afb3e27" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_b216a2e42f87", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "b216a2e42f87", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-23-11-17613-5-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790219861, "last_seen": 1790219861, "transport": "t", "ja3_hash": "dc33da2a7eeaabaf16881b0833b3f7d2", "ja3_variant_count": 1, "ja3_variants": [ "dc33da2a7eeaabaf16881b0833b3f7d2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_bb1f695b2fcd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "bb1f695b2fcd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-17613-13-35-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789761572, "last_seen": 1789761572, "transport": "t", "ja3_hash": "3455bf75b7e41235690c999972600651", "ja3_variant_count": 1, "ja3_variants": [ "3455bf75b7e41235690c999972600651" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.2941.68 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_bdb84f149853", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "bdb84f149853", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-5-27-23-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789381786, "last_seen": 1789381786, "transport": "t", "ja3_hash": "434c101e463fb28549631940adca76be", "ja3_variant_count": 1, "ja3_variants": [ "434c101e463fb28549631940adca76be" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_c6cb37701b45", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "c6cb37701b45", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-35-17613-27-65281-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788769945, "last_seen": 1788769945, "transport": "t", "ja3_hash": "09d68a56deace160fbf36a177ae2b2f7", "ja3_variant_count": 1, "ja3_variants": [ "09d68a56deace160fbf36a177ae2b2f7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_c98dc5579bff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "c98dc5579bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-17613-13-23-45-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790215719, "last_seen": 1790215719, "transport": "t", "ja3_hash": "615e8c60dc33599dd3193f28b13a2b70", "ja3_variant_count": 1, "ja3_variants": [ "615e8c60dc33599dd3193f28b13a2b70" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_c9af5d46db58", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "c9af5d46db58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-18-43-11-5-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790992813, "last_seen": 1790992813, "transport": "t", "ja3_hash": "31dbc190f6f2f542be18f1529dd8a1b3", "ja3_variant_count": 1, "ja3_variants": [ "31dbc190f6f2f542be18f1529dd8a1b3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_cab9e5c4dc3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "cab9e5c4dc3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-11-18-23-45-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791122027, "last_seen": 1791122027, "transport": "t", "ja3_hash": "1cd1f93e7c9d26d4ccb0697f8605728e", "ja3_variant_count": 1, "ja3_variants": [ "1cd1f93e7c9d26d4ccb0697f8605728e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_d1c9124a92e9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "d1c9124a92e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-45-51-13-27-5-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790985467, "last_seen": 1790985467, "transport": "t", "ja3_hash": "188b67b7e2f7c91d5a7af82317eacb74", "ja3_variant_count": 1, "ja3_variants": [ "188b67b7e2f7c91d5a7af82317eacb74" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_d2b561af6b79", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "d2b561af6b79", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-10-27-65281-23-35-17613,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790879632, "last_seen": 1790879632, "transport": "t", "ja3_hash": "53739d680e598637fd85127de2fddfdb", "ja3_variant_count": 1, "ja3_variants": [ "53739d680e598637fd85127de2fddfdb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_d6a5d8d0e978", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "d6a5d8d0e978", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-11-51-18-43-35-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788848233, "last_seen": 1788848233, "transport": "t", "ja3_hash": "c3edd3ec4c01ab391a01b7fd177e8f2d", "ja3_variant_count": 1, "ja3_variants": [ "c3edd3ec4c01ab391a01b7fd177e8f2d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_e9b7e720556c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "e9b7e720556c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-65037-5-65281-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788816315, "last_seen": 1788816315, "transport": "t", "ja3_hash": "a6d547ba49f7489b56a0f1111bba0ede", "ja3_variant_count": 1, "ja3_variants": [ "a6d547ba49f7489b56a0f1111bba0ede" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_eafd788fd6d4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "eafd788fd6d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-27-43-18-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790527372, "last_seen": 1790527372, "transport": "t", "ja3_hash": "20c96ee21b3b20c04fd54203d5010b42", "ja3_variant_count": 1, "ja3_variants": [ "20c96ee21b3b20c04fd54203d5010b42" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_ecfffe6b3306", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "ecfffe6b3306", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-35-43-5-10-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791135413, "last_seen": 1791135413, "transport": "t", "ja3_hash": "9201c6cc79128352d720ec29628386da", "ja3_variant_count": 1, "ja3_variants": [ "9201c6cc79128352d720ec29628386da" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_ee5e25f7891b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "ee5e25f7891b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-35-23-13-51-17613-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789974938, "last_seen": 1789974938, "transport": "t", "ja3_hash": "72a46d8980ea21bc418c382a0c8d1ed9", "ja3_variant_count": 1, "ja3_variants": [ "72a46d8980ea21bc418c382a0c8d1ed9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1508h1_8daaf6152771_5820e0c0a217", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h1", "b": "8daaf6152771", "c": "5820e0c0a217", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-27-16-43-51-5-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791135509, "last_seen": 1791135509, "transport": "t", "ja3_hash": "26414107211a69d0ca9f9b43c9a6c346", "ja3_variant_count": 1, "ja3_variants": [ "26414107211a69d0ca9f9b43c9a6c346" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h1_8daaf6152771_902d6843a9d3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h1", "b": "8daaf6152771", "c": "902d6843a9d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-16-35-51-43-18-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790990124, "last_seen": 1790990124, "transport": "t", "ja3_hash": "e329186c1fb2c861227ad9388434de38", "ja3_variant_count": 1, "ja3_variants": [ "e329186c1fb2c861227ad9388434de38" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h1_8daaf6152771_b0bb3d71f514", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h1", "b": "8daaf6152771", "c": "b0bb3d71f514", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-45-43-18-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790526499, "last_seen": 1790526499, "transport": "t", "ja3_hash": "87cb1d6b344c3ce434d5bfeea9cb1c94", "ja3_variant_count": 1, "ja3_variants": [ "87cb1d6b344c3ce434d5bfeea9cb1c94" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h1_8daaf6152771_e64ef1b6e6ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h1", "b": "8daaf6152771", "c": "e64ef1b6e6ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-16-35-5-43-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790524913, "last_seen": 1790524913, "transport": "t", "ja3_hash": "1b657cab405ba68a1d23cbac38ca6f8b", "ja3_variant_count": 1, "ja3_variants": [ "1b657cab405ba68a1d23cbac38ca6f8b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_0e331938d5d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "0e331938d5d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-45-65281-43-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790188475, "last_seen": 1790188475, "transport": "t", "ja3_hash": "fa047c962b714fcc33922e5af6973cdf", "ja3_variant_count": 1, "ja3_variants": [ "fa047c962b714fcc33922e5af6973cdf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_2024fd07f62f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "2024fd07f62f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-18-65037-43-5-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788797843, "last_seen": 1788797843, "transport": "t", "ja3_hash": "632c697079a785b180f04c83369f4d26", "ja3_variant_count": 1, "ja3_variants": [ "632c697079a785b180f04c83369f4d26" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_2170bf2d10f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "2170bf2d10f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-45-51-43-5-11-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790741058, "last_seen": 1790741058, "transport": "t", "ja3_hash": "478d81135831f4ea25acc2aae498c6ae", "ja3_variant_count": 1, "ja3_variants": [ "478d81135831f4ea25acc2aae498c6ae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 9 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_31653fa47728", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "31653fa47728", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-45-17613-43-5-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790007278, "last_seen": 1790007278, "transport": "t", "ja3_hash": "b8ebc5d135f475bbf30d8dc1cdcec494", "ja3_variant_count": 1, "ja3_variants": [ "b8ebc5d135f475bbf30d8dc1cdcec494" ], "user_agents": { "Mozilla/5.0 (Linux; Android 13; SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_383962a84d16", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "383962a84d16", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-18-45-16-43-65281-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790256350, "last_seen": 1790256350, "transport": "t", "ja3_hash": "530161f6da4326e93e984332c41a5b4a", "ja3_variant_count": 1, "ja3_variants": [ "530161f6da4326e93e984332c41a5b4a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_3edd108ea731", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "3edd108ea731", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-5-43-17613-65281-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789689005, "last_seen": 1789689005, "transport": "t", "ja3_hash": "413466cc77b327228122f04a3f728812", "ja3_variant_count": 1, "ja3_variants": [ "413466cc77b327228122f04a3f728812" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_42a5f55c3c67", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "42a5f55c3c67", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-35-10-16-65281-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791099404, "last_seen": 1791099404, "transport": "t", "ja3_hash": "5781660295190b3d34d068dd784d5641", "ja3_variant_count": 1, "ja3_variants": [ "5781660295190b3d34d068dd784d5641" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_664d3adf355c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "664d3adf355c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-43-16-35-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788831993, "last_seen": 1788831993, "transport": "t", "ja3_hash": "26853a243449d8f042a964e419512091", "ja3_variant_count": 1, "ja3_variants": [ "26853a243449d8f042a964e419512091" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_6bc6d2d9a3b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "6bc6d2d9a3b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-11-43-27-16-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789928984, "last_seen": 1789928984, "transport": "t", "ja3_hash": "7037ded95d2cabacbb2bdb3d3e534aa8", "ja3_variant_count": 1, "ja3_variants": [ "7037ded95d2cabacbb2bdb3d3e534aa8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_6c51202144b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "6c51202144b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-65281-16-43-18-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789056518, "last_seen": 1789056518, "transport": "t", "ja3_hash": "781a9e326d47fd005dd21ae8a1fc581e", "ja3_variant_count": 1, "ja3_variants": [ "781a9e326d47fd005dd21ae8a1fc581e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_6eec34b0c163", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "6eec34b0c163", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-17613-10-16-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788620873, "last_seen": 1788620873, "transport": "t", "ja3_hash": "77d4c9e32097e00498b153be8a286afb", "ja3_variant_count": 1, "ja3_variants": [ "77d4c9e32097e00498b153be8a286afb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_739a3768ca63", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "739a3768ca63", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-16-43-13-65037-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790941795, "last_seen": 1790941795, "transport": "t", "ja3_hash": "fe3af6a1ebed87b4d2f857088ad5c03c", "ja3_variant_count": 1, "ja3_variants": [ "fe3af6a1ebed87b4d2f857088ad5c03c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_77fec7fee953", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "77fec7fee953", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-43-11-16-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791014511, "last_seen": 1791014511, "transport": "t", "ja3_hash": "27edaccc39f69e0d036d21e16e1c681c", "ja3_variant_count": 1, "ja3_variants": [ "27edaccc39f69e0d036d21e16e1c681c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_7b3110328f63", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "7b3110328f63", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-23-16-43-65281-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790256352, "last_seen": 1790256352, "transport": "t", "ja3_hash": "aa95c30313e31fd45260e2dc103dccae", "ja3_variant_count": 1, "ja3_variants": [ "aa95c30313e31fd45260e2dc103dccae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_7bf7ec51ad58", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "7bf7ec51ad58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-51-43-5-16-65037-11,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791105140, "last_seen": 1791105140, "transport": "t", "ja3_hash": "6bb6a0af2021c8e80655dbbdc2893e22", "ja3_variant_count": 1, "ja3_variants": [ "6bb6a0af2021c8e80655dbbdc2893e22" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_84f88c2b2c82", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "84f88c2b2c82", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-45-18-16-65281-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790340040, "last_seen": 1790340040, "transport": "t", "ja3_hash": "f905555283418bec889e53a5d3dcd336", "ja3_variant_count": 1, "ja3_variants": [ "f905555283418bec889e53a5d3dcd336" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_896f8fd8b012", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "896f8fd8b012", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-17613-43-18-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789292863, "last_seen": 1789292863, "transport": "t", "ja3_hash": "33e8587dc7b7c7d81afd0e61cabef4e0", "ja3_variant_count": 1, "ja3_variants": [ "33e8587dc7b7c7d81afd0e61cabef4e0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_9073fef586a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "9073fef586a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-23-16-10-45-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790495870, "last_seen": 1790495870, "transport": "t", "ja3_hash": "dd9f96fabfa3a1295e24dc62a08dbb26", "ja3_variant_count": 1, "ja3_variants": [ "dd9f96fabfa3a1295e24dc62a08dbb26" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_9a9d883b042f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "9a9d883b042f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-65037-10-17613-43-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791209404, "last_seen": 1791209404, "transport": "t", "ja3_hash": "76cb20330855f8b822c59787f39900e4", "ja3_variant_count": 1, "ja3_variants": [ "76cb20330855f8b822c59787f39900e4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_9f71f55598b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "9f71f55598b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-18-23-51-43-17613-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790316793, "last_seen": 1790316793, "transport": "t", "ja3_hash": "08efe6a5b15756b2d16166447b78cdb3", "ja3_variant_count": 1, "ja3_variants": [ "08efe6a5b15756b2d16166447b78cdb3" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_a5cdebaf66ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "a5cdebaf66ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-5-35-13-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789849727, "last_seen": 1789849727, "transport": "t", "ja3_hash": "6a2b7390df3a95fef686e7d9ee3cc329", "ja3_variant_count": 1, "ja3_variants": [ "6a2b7390df3a95fef686e7d9ee3cc329" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_b25aea451ce0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "b25aea451ce0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-16-11-65281-43-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788769303, "last_seen": 1788769303, "transport": "t", "ja3_hash": "f69b4b8f9c51d6c4b24e542ca651d1de", "ja3_variant_count": 1, "ja3_variants": [ "f69b4b8f9c51d6c4b24e542ca651d1de" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_b8f51d14fad6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "b8f51d14fad6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-65281-18-65037-23-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788796772, "last_seen": 1788796772, "transport": "t", "ja3_hash": "6c9e4965f5dacced726d65e5d848b3bb", "ja3_variant_count": 1, "ja3_variants": [ "6c9e4965f5dacced726d65e5d848b3bb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_bee4687425bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "bee4687425bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-18-65281-51-5-16-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789047157, "last_seen": 1789047157, "transport": "t", "ja3_hash": "b95e696ef10b51ff179ede26ad7c0555", "ja3_variant_count": 1, "ja3_variants": [ "b95e696ef10b51ff179ede26ad7c0555" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_c0dd755a67c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "c0dd755a67c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-45-18-65281-23-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789812184, "last_seen": 1789812184, "transport": "t", "ja3_hash": "60dd8328d6f5e461d0938bdf794c3b4a", "ja3_variant_count": 1, "ja3_variants": [ "60dd8328d6f5e461d0938bdf794c3b4a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_cddafaa9f985", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "cddafaa9f985", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-65037-23-65281-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790035327, "last_seen": 1790035327, "transport": "t", "ja3_hash": "89847662bb4aec51195a2c2e3b9c259b", "ja3_variant_count": 1, "ja3_variants": [ "89847662bb4aec51195a2c2e3b9c259b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 33 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_d985b85588fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "d985b85588fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-43-10-13-45-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790163780, "last_seen": 1790163780, "transport": "t", "ja3_hash": "1b7c7a990c14ffabebae601e134d1edc", "ja3_variant_count": 1, "ja3_variants": [ "1b7c7a990c14ffabebae601e134d1edc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_e6496156a8de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "e6496156a8de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-11-17613-5-45-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790068286, "last_seen": 1790068286, "transport": "t", "ja3_hash": "f56f243902332b9b47d8f47aff99e6b3", "ja3_variant_count": 1, "ja3_variants": [ "f56f243902332b9b47d8f47aff99e6b3" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_e973911b812e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "e973911b812e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-11-5-43-23-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791135706, "last_seen": 1791135706, "transport": "t", "ja3_hash": "b19929c7de0c9df04819e82905f1e077", "ja3_variant_count": 1, "ja3_variants": [ "b19929c7de0c9df04819e82905f1e077" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_ec221713e9aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "ec221713e9aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-43-13-27-17613-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790364199, "last_seen": 1790364199, "transport": "t", "ja3_hash": "0b8695234761bdcbafe65e8f90d5a281", "ja3_variant_count": 1, "ja3_variants": [ "0b8695234761bdcbafe65e8f90d5a281" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_f97add32df94", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "f97add32df94", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-43-16-13-45-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790479945, "last_seen": 1790479945, "transport": "t", "ja3_hash": "951a1262a3572d858ad11c86a4158268", "ja3_variant_count": 1, "ja3_variants": [ "951a1262a3572d858ad11c86a4158268" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_fea3baef3968", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "fea3baef3968", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-13-43-16-27-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788738732, "last_seen": 1788738732, "transport": "t", "ja3_hash": "315df1467560c20dc1a2d7d90618fd5c", "ja3_variant_count": 1, "ja3_variants": [ "315df1467560c20dc1a2d7d90618fd5c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 8 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_03e4cd2b7f11", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "03e4cd2b7f11", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-11-43-13-23-27-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791043736, "last_seen": 1791043736, "transport": "t", "ja3_hash": "7d3cd83156ad614edb2cf0b998421854", "ja3_variant_count": 1, "ja3_variants": [ "7d3cd83156ad614edb2cf0b998421854" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_05a24d4823bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "05a24d4823bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-65037-35-65281-10-18-27-13,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791103443, "last_seen": 1791103443, "transport": "t", "ja3_hash": "3eba4240d800423c84216f5c92abf6b7", "ja3_variant_count": 1, "ja3_variants": [ "3eba4240d800423c84216f5c92abf6b7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_090fa50e3377", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "090fa50e3377", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-51-45-18-5-27-43-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790237486, "last_seen": 1790237486, "transport": "t", "ja3_hash": "aeffffe1acb225b28af9e0e03936fc70", "ja3_variant_count": 1, "ja3_variants": [ "aeffffe1acb225b28af9e0e03936fc70" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_0e84436bf021", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "0e84436bf021", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-17613-43-27-23-11-45-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790260421, "last_seen": 1790260421, "transport": "t", "ja3_hash": "abbf40ee986b6cfbaea7c46c474d87fc", "ja3_variant_count": 1, "ja3_variants": [ "abbf40ee986b6cfbaea7c46c474d87fc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_136f5a52b485", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "136f5a52b485", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-5-27-65281-43-45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788839095, "last_seen": 1789950624, "transport": "t", "ja3_hash": "f85fb3577182048f00064cbe5612d7bf", "ja3_variant_count": 2, "ja3_variants": [ "f85fb3577182048f00064cbe5612d7bf", "ca1264c020d92115e88cb7785f0bca4d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_1381467e1eca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "1381467e1eca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-23-65037-43-45-35-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790340037, "last_seen": 1790340037, "transport": "t", "ja3_hash": "0372aa0cc179c8dd1f5b54edf267458c", "ja3_variant_count": 1, "ja3_variants": [ "0372aa0cc179c8dd1f5b54edf267458c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_167f84999455", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "167f84999455", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-45-18-11-27-51-35-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791153852, "last_seen": 1791153852, "transport": "t", "ja3_hash": "0c88e644d18dc7d83f58f68d6b645b9c", "ja3_variant_count": 1, "ja3_variants": [ "0c88e644d18dc7d83f58f68d6b645b9c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.1 Safari/537.36 Edg/128.0.1": 2 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_169c43f0c655", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "169c43f0c655", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-10-43-27-5-35-45-18,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789455555, "last_seen": 1789455555, "transport": "t", "ja3_hash": "7ca7dba3ef2f5874f295df86bb9c7f05", "ja3_variant_count": 1, "ja3_variants": [ "7ca7dba3ef2f5874f295df86bb9c7f05" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_18e8a06d9b2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "18e8a06d9b2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-11-35-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789527584, "last_seen": 1791196533, "transport": "t", "ja3_hash": "02fc9e6401d2c8c1bf8f91bd21b8e17e", "ja3_variant_count": 1, "ja3_variants": [ "02fc9e6401d2c8c1bf8f91bd21b8e17e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_1b2ebd8136d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "1b2ebd8136d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-43-65281-45-18-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791007085, "last_seen": 1791007085, "transport": "t", "ja3_hash": "4fbf919ccb99071146e99e8a83db5633", "ja3_variant_count": 1, "ja3_variants": [ "4fbf919ccb99071146e99e8a83db5633" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_1b787d9203d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "1b787d9203d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-35-45-18-23-5-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788820502, "last_seen": 1789398564, "transport": "t", "ja3_hash": "bd0171072729aad9cafe25295b44914c", "ja3_variant_count": 2, "ja3_variants": [ "bd0171072729aad9cafe25295b44914c", "21bf29d13870b8ba753c665a03c79197" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_1fdc80070b59", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "1fdc80070b59", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-65037-43-35-11-23-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790313006, "last_seen": 1790313006, "transport": "t", "ja3_hash": "1905c19e6a21920d7f5a186bddf266b5", "ja3_variant_count": 1, "ja3_variants": [ "1905c19e6a21920d7f5a186bddf266b5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_24fee6b10870", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "24fee6b10870", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-23-45-43-65281-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788861556, "last_seen": 1788861556, "transport": "t", "ja3_hash": "ad81501d8763ffbd8ac86934e7dbd599", "ja3_variant_count": 1, "ja3_variants": [ "ad81501d8763ffbd8ac86934e7dbd599" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_2d9d6794095e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "2d9d6794095e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-65037-27-11-65281-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790737188, "last_seen": 1790737188, "transport": "t", "ja3_hash": "aa9786f294c3d712405a5d166f8dc61a", "ja3_variant_count": 1, "ja3_variants": [ "aa9786f294c3d712405a5d166f8dc61a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_2eda05ad38e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "2eda05ad38e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-51-10-5-45-18-23-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790219060, "last_seen": 1790219060, "transport": "t", "ja3_hash": "8f055125c5181a62e7939eb8a3fe5105", "ja3_variant_count": 1, "ja3_variants": [ "8f055125c5181a62e7939eb8a3fe5105" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_31339261f2c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "31339261f2c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-65281-11-17613-18-10-43-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789457618, "last_seen": 1789457618, "transport": "t", "ja3_hash": "0fc122a7eff27d6fd53dd0e8def2b75f", "ja3_variant_count": 1, "ja3_variants": [ "0fc122a7eff27d6fd53dd0e8def2b75f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_3420bc0d87bd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "3420bc0d87bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-23-10-18-65037-65281-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790534628, "last_seen": 1790534628, "transport": "t", "ja3_hash": "263bf03067770ca60907b3ac92c330c9", "ja3_variant_count": 1, "ja3_variants": [ "263bf03067770ca60907b3ac92c330c9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_38f8d17e50a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "38f8d17e50a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-23-17613-65037-43-51764-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790862351, "last_seen": 1790862351, "transport": "t", "ja3_hash": "284089fed2321674300405c621ccd329", "ja3_variant_count": 1, "ja3_variants": [ "284089fed2321674300405c621ccd329" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_3d624f8550f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "3d624f8550f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-13-17613-11-51-43-35-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789778221, "last_seen": 1789778221, "transport": "t", "ja3_hash": "fab5b188f23c8fc258e960e07130b66a", "ja3_variant_count": 1, "ja3_variants": [ "fab5b188f23c8fc258e960e07130b66a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_3ef68c5cde83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "3ef68c5cde83", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,65281-45-65037-27-10-43-51764-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790950079, "last_seen": 1790950079, "transport": "t", "ja3_hash": "d127c1b6e65e5fb0e1556da4c1460b57", "ja3_variant_count": 1, "ja3_variants": [ "d127c1b6e65e5fb0e1556da4c1460b57" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_3f98e0d6e645", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "3f98e0d6e645", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-5-11-43-51-23-65281-16,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788830038, "last_seen": 1788830038, "transport": "t", "ja3_hash": "a0d6f7799b4df14321b68808849851bb", "ja3_variant_count": 1, "ja3_variants": [ "a0d6f7799b4df14321b68808849851bb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_45b52d6e46c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "45b52d6e46c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-51764-13-11-27-35-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790320644, "last_seen": 1790320644, "transport": "t", "ja3_hash": "a6e15b65b4b6c49cb323f5f1f158f580", "ja3_variant_count": 1, "ja3_variants": [ "a6e15b65b4b6c49cb323f5f1f158f580" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_470bdc6f5a35", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "470bdc6f5a35", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-23-43-13-65281-51-35-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790261219, "last_seen": 1790261219, "transport": "t", "ja3_hash": "d245352ba847657c85b1d62190b2643e", "ja3_variant_count": 1, "ja3_variants": [ "d245352ba847657c85b1d62190b2643e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_58313540c316", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "58313540c316", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-35-51-43-18-27-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788809096, "last_seen": 1788809096, "transport": "t", "ja3_hash": "9bda882451b95228d0b0de37ebb28f6d", "ja3_variant_count": 1, "ja3_variants": [ "9bda882451b95228d0b0de37ebb28f6d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_7a5ea7bfb2de", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "7a5ea7bfb2de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-23-13-43-11-35-18-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241127, "last_seen": 1790241127, "transport": "t", "ja3_hash": "f1f8ed62b02898d73f1be51928033170", "ja3_variant_count": 1, "ja3_variants": [ "f1f8ed62b02898d73f1be51928033170" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_89d52f3fd914", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "89d52f3fd914", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65037-18-35-13-43-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790638633, "last_seen": 1790638633, "transport": "t", "ja3_hash": "a8b753c908744a2a30eb1dade1176914", "ja3_variant_count": 1, "ja3_variants": [ "a8b753c908744a2a30eb1dade1176914" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 23 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_956264f26fea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "956264f26fea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-10-43-65281-5-13-18-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789882120, "last_seen": 1789882120, "transport": "t", "ja3_hash": "337efb5e3dba3b1485427ca276198678", "ja3_variant_count": 1, "ja3_variants": [ "337efb5e3dba3b1485427ca276198678" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_962dce9d9db9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "962dce9d9db9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-23-13-11-43-45-51-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788830033, "last_seen": 1788830033, "transport": "t", "ja3_hash": "d9278752ecc207b05e3efc0a44c0199a", "ja3_variant_count": 1, "ja3_variants": [ "d9278752ecc207b05e3efc0a44c0199a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_98da8991e810", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "98da8991e810", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-5-11-23-27-43-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790230039, "last_seen": 1790230039, "transport": "t", "ja3_hash": "8e03167c1d58566bfd96e8446665166e", "ja3_variant_count": 1, "ja3_variants": [ "8e03167c1d58566bfd96e8446665166e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_a27cdad178a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "a27cdad178a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-43-65037-45-18-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788962825, "last_seen": 1788962825, "transport": "t", "ja3_hash": "69524524783523778b9f2eb0079cd85a", "ja3_variant_count": 1, "ja3_variants": [ "69524524783523778b9f2eb0079cd85a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_a6f12aa33795", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "a6f12aa33795", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-23-13-10-18-45-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790333472, "last_seen": 1790333472, "transport": "t", "ja3_hash": "69e87c567416397aefa1afec0645f772", "ja3_variant_count": 1, "ja3_variants": [ "69e87c567416397aefa1afec0645f772" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_ae6054a40379", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "ae6054a40379", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-17613-27-11-51-5-65281-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791271904, "last_seen": 1791271904, "transport": "t", "ja3_hash": "cdeabbf2c00c9e721c71cddf3baf770e", "ja3_variant_count": 1, "ja3_variants": [ "cdeabbf2c00c9e721c71cddf3baf770e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_bb563522fc3c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "bb563522fc3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-23-65281-5-27-11-43-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789155739, "last_seen": 1789155739, "transport": "t", "ja3_hash": "788627c591c30c612a5db85b392f2be4", "ja3_variant_count": 1, "ja3_variants": [ "788627c591c30c612a5db85b392f2be4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_c11fabcd8eb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "c11fabcd8eb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-45-17513-23-5-65281-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791235269, "last_seen": 1791235269, "transport": "t", "ja3_hash": "637f5deb5c270f96e3361e55f7e5ac75", "ja3_variant_count": 1, "ja3_variants": [ "637f5deb5c270f96e3361e55f7e5ac75" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_c3134a358148", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "c3134a358148", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-51-11-23-45-43-5-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724241, "last_seen": 1788724241, "transport": "t", "ja3_hash": "5d7123e9bf111087d6910b4de50b9550", "ja3_variant_count": 1, "ja3_variants": [ "5d7123e9bf111087d6910b4de50b9550" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_c693b9784a07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "c693b9784a07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-18-65281-10-51-35-17613-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788459870, "last_seen": 1788459870, "transport": "t", "ja3_hash": "a51b9a2d9bb6aa744c6e3909c6351c2d", "ja3_variant_count": 1, "ja3_variants": [ "a51b9a2d9bb6aa744c6e3909c6351c2d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_ca69c7a70ce2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "ca69c7a70ce2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-45-23-43-27-35-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790598740, "last_seen": 1790598740, "transport": "t", "ja3_hash": "153a56d7f70016c854f02f1602f2ee88", "ja3_variant_count": 1, "ja3_variants": [ "153a56d7f70016c854f02f1602f2ee88" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_cc617d22c5c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "cc617d22c5c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-65037-17613-13-43-45-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790775710, "last_seen": 1790775710, "transport": "t", "ja3_hash": "f8c1023811e2d9c9207f2e9051f649fc", "ja3_variant_count": 1, "ja3_variants": [ "f8c1023811e2d9c9207f2e9051f649fc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_ccd855a783a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "ccd855a783a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-10-43-65281-5-35-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790208500, "last_seen": 1790208500, "transport": "t", "ja3_hash": "7c7ed29f1a4d8e2a1459219155a7a484", "ja3_variant_count": 1, "ja3_variants": [ "7c7ed29f1a4d8e2a1459219155a7a484" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_db53d0f97cb1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "db53d0f97cb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-35-27-17613-43-23-45-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790707091, "last_seen": 1790707091, "transport": "t", "ja3_hash": "805973ebdcaf487c19ef7f468af9be16", "ja3_variant_count": 1, "ja3_variants": [ "805973ebdcaf487c19ef7f468af9be16" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_e1163d874ee5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "e1163d874ee5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-5-10-18-51-43-35-16,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791292623, "last_seen": 1791292623, "transport": "t", "ja3_hash": "aaad879e126603bcc04845eaaaca3e5f", "ja3_variant_count": 1, "ja3_variants": [ "aaad879e126603bcc04845eaaaca3e5f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_e5dc7e7bac65", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "e5dc7e7bac65", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-65281-17613-5-65037-43-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789533250, "last_seen": 1789910585, "transport": "t", "ja3_hash": "6bceed5bbbb2cb1c77a07fa356e7b193", "ja3_variant_count": 2, "ja3_variants": [ "6bceed5bbbb2cb1c77a07fa356e7b193", "240383522d0dda6d127060c8b623b8d8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_e9c33f75c79b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "e9c33f75c79b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-51764-65037-43-45-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790735817, "last_seen": 1790735817, "transport": "t", "ja3_hash": "b84fc1d102cfeda38db5b3dac98863e9", "ja3_variant_count": 1, "ja3_variants": [ "b84fc1d102cfeda38db5b3dac98863e9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 13; SM-A037U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_ec4389d4719b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "ec4389d4719b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-11-65037-27-65281-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789124621, "last_seen": 1789124621, "transport": "t", "ja3_hash": "7f61e2bea3f8d989d7ae8efd7fc2b873", "ja3_variant_count": 1, "ja3_variants": [ "7f61e2bea3f8d989d7ae8efd7fc2b873" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 11 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_f267570e2b39", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "f267570e2b39", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-11-27-10-51764-35-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790709779, "last_seen": 1790709779, "transport": "t", "ja3_hash": "8cc071d105ae0da649a6d78ae1ab40d2", "ja3_variant_count": 1, "ja3_variants": [ "8cc071d105ae0da649a6d78ae1ab40d2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_f46dd8a8a119", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "f46dd8a8a119", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-5-17513-10-23-18-65037-0,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791116699, "last_seen": 1791116699, "transport": "t", "ja3_hash": "66f49fb4800b4f19b22a407805c03d34", "ja3_variant_count": 1, "ja3_variants": [ "66f49fb4800b4f19b22a407805c03d34" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_f81770197382", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "f81770197382", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-11-10-35-65037-43-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791249126, "last_seen": 1791249126, "transport": "t", "ja3_hash": "368bf0ee75ecb76689dba734054f997c", "ja3_variant_count": 1, "ja3_variants": [ "368bf0ee75ecb76689dba734054f997c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_fe26a5da872e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "fe26a5da872e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-17613-65281-23-65037-43-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790298040, "last_seen": 1790298040, "transport": "t", "ja3_hash": "cf46fa81061c4bfed32c41022c37d90a", "ja3_variant_count": 1, "ja3_variants": [ "cf46fa81061c4bfed32c41022c37d90a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_feded775de4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "feded775de4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-51-27-65281-45-11-43-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790204492, "last_seen": 1790204492, "transport": "t", "ja3_hash": "0685051984ade128ea4c33e8f6dd0a0f", "ja3_variant_count": 1, "ja3_variants": [ "0685051984ade128ea4c33e8f6dd0a0f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_ff9003539e5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "ff9003539e5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-45-17613-18-23-27-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790186694, "last_seen": 1790186694, "transport": "t", "ja3_hash": "d7f2ba9913da0ec9dcd11876d3719aca", "ja3_variant_count": 1, "ja3_variants": [ "d7f2ba9913da0ec9dcd11876d3719aca" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1509h1_8daaf6152771_bb92d2ee44ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h1", "b": "8daaf6152771", "c": "bb92d2ee44ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-27-51-18-16-10-65281-0,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790532379, "last_seen": 1790532379, "transport": "t", "ja3_hash": "95c25264999534bb701107a1de7bd471", "ja3_variant_count": 1, "ja3_variants": [ "95c25264999534bb701107a1de7bd471" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_082737226558", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "082737226558", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-45-65281-27-23-16-51-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789457139, "last_seen": 1789457139, "transport": "t", "ja3_hash": "a962ea441e614d559688d8b3e9e780ae", "ja3_variant_count": 1, "ja3_variants": [ "a962ea441e614d559688d8b3e9e780ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_1146970dabcc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "1146970dabcc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-13-45-11-43-5-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789613778, "last_seen": 1789613778, "transport": "t", "ja3_hash": "290021a3f337b661ee32d8c38c8c278d", "ja3_variant_count": 1, "ja3_variants": [ "290021a3f337b661ee32d8c38c8c278d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_1c1299de0eb7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "1c1299de0eb7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-65037-51-27-35-11-5-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791273426, "last_seen": 1791273426, "transport": "t", "ja3_hash": "61a3ce0d87881bc0613737982ba829a7", "ja3_variant_count": 1, "ja3_variants": [ "61a3ce0d87881bc0613737982ba829a7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_1c3b17e32b6c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "1c3b17e32b6c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-45-11-5-35-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790690004, "last_seen": 1790690004, "transport": "t", "ja3_hash": "6e7d882d5a46f113d38d83c04c56fe41", "ja3_variant_count": 1, "ja3_variants": [ "6e7d882d5a46f113d38d83c04c56fe41" ], "user_agents": { "Mozilla/5.0 (Android 14; Mobile; rv:135.0) Gecko/135.0 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_1f976d1ecfb0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "1f976d1ecfb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-65281-10-43-35-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791088458, "last_seen": 1791088458, "transport": "t", "ja3_hash": "33c45a15b21eafff4acb73a149297eed", "ja3_variant_count": 1, "ja3_variants": [ "33c45a15b21eafff4acb73a149297eed" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_2064fb73c865", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "2064fb73c865", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-10-65037-43-65281-18-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790577539, "last_seen": 1790577539, "transport": "t", "ja3_hash": "d443afeabf82fec049dbd6d4e5373a0b", "ja3_variant_count": 1, "ja3_variants": [ "d443afeabf82fec049dbd6d4e5373a0b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_2a211ab5dcdd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "2a211ab5dcdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-13-17613-43-5-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789098851, "last_seen": 1789098851, "transport": "t", "ja3_hash": "2c3d55929368a8d481fe5ee2d82b9680", "ja3_variant_count": 1, "ja3_variants": [ "2c3d55929368a8d481fe5ee2d82b9680" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_348496746a52", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "348496746a52", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-18-10-43-45-23-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788773007, "last_seen": 1788773007, "transport": "t", "ja3_hash": "f0a71397aeb21f4e594532ed54937390", "ja3_variant_count": 1, "ja3_variants": [ "f0a71397aeb21f4e594532ed54937390" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_38e3ddd3bdd3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "38e3ddd3bdd3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-16-27-35-13-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788622083, "last_seen": 1788622083, "transport": "t", "ja3_hash": "e61d7897bb407eb719b222855ce4a255", "ja3_variant_count": 1, "ja3_variants": [ "e61d7897bb407eb719b222855ce4a255" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_3eb03e6ed44f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "3eb03e6ed44f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-18-16-5-17613-35-65281-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789327248, "last_seen": 1789327248, "transport": "t", "ja3_hash": "af9827eb91637c74183519ad4af8cb9c", "ja3_variant_count": 1, "ja3_variants": [ "af9827eb91637c74183519ad4af8cb9c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_49688b787dc6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "49688b787dc6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-43-16-11-17613-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790229619, "last_seen": 1790229619, "transport": "t", "ja3_hash": "7a8c0597fd4d8f52e5c72075daafb114", "ja3_variant_count": 1, "ja3_variants": [ "7a8c0597fd4d8f52e5c72075daafb114" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_4f12d22ca752", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "4f12d22ca752", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-5-43-65281-17613-27-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790705337, "last_seen": 1790705337, "transport": "t", "ja3_hash": "9a363d17a055949b864280519794086a", "ja3_variant_count": 1, "ja3_variants": [ "9a363d17a055949b864280519794086a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_52f7f2e3e7bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "52f7f2e3e7bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-17613-16-43-18-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788794961, "last_seen": 1788794961, "transport": "t", "ja3_hash": "2da4acfddf5e94ac2585953989c63f33", "ja3_variant_count": 1, "ja3_variants": [ "2da4acfddf5e94ac2585953989c63f33" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_5c07be71c360", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "5c07be71c360", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-17613-65037-16-13-43-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789869223, "last_seen": 1789869223, "transport": "t", "ja3_hash": "bb6d036656cc79f959e701e99c85ad57", "ja3_variant_count": 1, "ja3_variants": [ "bb6d036656cc79f959e701e99c85ad57" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_6f0f81c12627", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "6f0f81c12627", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-43-65037-5-35-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790594280, "last_seen": 1790594280, "transport": "t", "ja3_hash": "ac180056489feda3a47ef1568ed56048", "ja3_variant_count": 1, "ja3_variants": [ "ac180056489feda3a47ef1568ed56048" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_70adb2012f92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "70adb2012f92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-65281-43-18-11-13-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791258990, "last_seen": 1791258990, "transport": "t", "ja3_hash": "7ed0abf89b979afb889065f4e571dc99", "ja3_variant_count": 1, "ja3_variants": [ "7ed0abf89b979afb889065f4e571dc99" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_74edabe0f5d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "74edabe0f5d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-16-17613-18-11-5-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789354741, "last_seen": 1789354741, "transport": "t", "ja3_hash": "f6bfe4c8dfc0a7f48dc06ae8a05721a9", "ja3_variant_count": 1, "ja3_variants": [ "f6bfe4c8dfc0a7f48dc06ae8a05721a9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_7b19cbee2306", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "7b19cbee2306", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-10-45-16-35-43-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791169183, "last_seen": 1791169183, "transport": "t", "ja3_hash": "c408a72fb9e8b79dd99a1701a4f78961", "ja3_variant_count": 1, "ja3_variants": [ "c408a72fb9e8b79dd99a1701a4f78961" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_953d758f3107", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "953d758f3107", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-18-35-16-17613-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790226844, "last_seen": 1790226844, "transport": "t", "ja3_hash": "4ecfc226f921c4984a122b714cf7e226", "ja3_variant_count": 1, "ja3_variants": [ "4ecfc226f921c4984a122b714cf7e226" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_96e6de69f2ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "96e6de69f2ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-35-27-43-51-10-16-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209118, "last_seen": 1790209118, "transport": "t", "ja3_hash": "82f75059568d91da5b3df3cee6ec4d07", "ja3_variant_count": 1, "ja3_variants": [ "82f75059568d91da5b3df3cee6ec4d07" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_9b3d4ac944dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "9b3d4ac944dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-11-23-43-16-10-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791225945, "last_seen": 1791225945, "transport": "t", "ja3_hash": "a93143397cbb15ada87c86bbebfd1645", "ja3_variant_count": 1, "ja3_variants": [ "a93143397cbb15ada87c86bbebfd1645" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_ac0b7df654b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "ac0b7df654b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-43-11-16-18-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791250813, "last_seen": 1791250813, "transport": "t", "ja3_hash": "2bc4f5a6fb59a5847921bc2ff0beac53", "ja3_variant_count": 1, "ja3_variants": [ "2bc4f5a6fb59a5847921bc2ff0beac53" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_ae19025836a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "ae19025836a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-17613-5-23-11-27-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791224190, "last_seen": 1791224190, "transport": "t", "ja3_hash": "d97efeb9847893553e22e773b4f22e70", "ja3_variant_count": 1, "ja3_variants": [ "d97efeb9847893553e22e773b4f22e70" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_bbdcaf8036bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "bbdcaf8036bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-16-65281-13-17613-18-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789665114, "last_seen": 1789665114, "transport": "t", "ja3_hash": "045aef86fc5de5a37456b6278421e34b", "ja3_variant_count": 1, "ja3_variants": [ "045aef86fc5de5a37456b6278421e34b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_c062c8d43054", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "c062c8d43054", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-10-16-17613-65281-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790810586, "last_seen": 1791129473, "transport": "t", "ja3_hash": "430b15d94c78adced3381dbc451a8d8f", "ja3_variant_count": 2, "ja3_variants": [ "430b15d94c78adced3381dbc451a8d8f", "2c1d9dcc9e28ed4962135e2e57ccee6f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 1, "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_c6bc9f917603", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "c6bc9f917603", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-23-43-18-16-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791295421, "last_seen": 1791295421, "transport": "t", "ja3_hash": "2d7b3281b2e5d274aee3bfb133770961", "ja3_variant_count": 1, "ja3_variants": [ "2d7b3281b2e5d274aee3bfb133770961" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_cc73be0af4d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "cc73be0af4d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-51764-16-45-17613-65281-51-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790905735, "last_seen": 1790905735, "transport": "t", "ja3_hash": "9a9b50209683cf02d5f4bc28074ce69b", "ja3_variant_count": 1, "ja3_variants": [ "9a9b50209683cf02d5f4bc28074ce69b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_d8830e00e271", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "d8830e00e271", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-45-13-16-43-27-65281-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077837, "last_seen": 1791077837, "transport": "t", "ja3_hash": "10f5957437110a8f85b6cf6ce0015b06", "ja3_variant_count": 1, "ja3_variants": [ "10f5957437110a8f85b6cf6ce0015b06" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_e4e445fafda0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "e4e445fafda0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-45-16-10-51-43-11-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789516979, "last_seen": 1791303752, "transport": "t", "ja3_hash": "85e6a78c9f47bb64cf6c850f36198054", "ja3_variant_count": 2, "ja3_variants": [ "85e6a78c9f47bb64cf6c850f36198054", "bba9d916c080c1019f2cc818d4a5f57d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_e68e9a819b76", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "e68e9a819b76", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-65281-65037-35-10-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789704276, "last_seen": 1789704276, "transport": "t", "ja3_hash": "11ee33d3b83d4b6f5e5820ef022ab2bf", "ja3_variant_count": 1, "ja3_variants": [ "11ee33d3b83d4b6f5e5820ef022ab2bf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_e74f36c55f02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "e74f36c55f02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-43-35-17613-11-18-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790246275, "last_seen": 1790246275, "transport": "t", "ja3_hash": "8982f6f95acf2380a9417c8ebbe89184", "ja3_variant_count": 1, "ja3_variants": [ "8982f6f95acf2380a9417c8ebbe89184" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_ef2efad446c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "ef2efad446c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-27-43-10-13-5-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790728940, "last_seen": 1790728940, "transport": "t", "ja3_hash": "d56f432a04a4670055d58cabaf2ba275", "ja3_variant_count": 1, "ja3_variants": [ "d56f432a04a4670055d58cabaf2ba275" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_f13b0ca88a14", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "f13b0ca88a14", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-35-16-18-51-43-45-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790155856, "last_seen": 1790155856, "transport": "t", "ja3_hash": "6aaa607678d0eb77ab8a91c2660efc3b", "ja3_variant_count": 1, "ja3_variants": [ "6aaa607678d0eb77ab8a91c2660efc3b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_f20501bb8f66", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "f20501bb8f66", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-13-43-16-51764-27-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790129506, "last_seen": 1790129506, "transport": "t", "ja3_hash": "4fa8ac07d9170b1972e66b40cd63b671", "ja3_variant_count": 1, "ja3_variants": [ "4fa8ac07d9170b1972e66b40cd63b671" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_fc4c620187c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "fc4c620187c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-11-45-16-17613-65281-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790652049, "last_seen": 1790652049, "transport": "t", "ja3_hash": "9ac4ee5921f6cc7657c552ffc198310e", "ja3_variant_count": 1, "ja3_variants": [ "9ac4ee5921f6cc7657c552ffc198310e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 20 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_0480efd56e7d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "0480efd56e7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-11-35-10-23-13-43-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789017992, "last_seen": 1789017992, "transport": "t", "ja3_hash": "814857f18ea3c74352eefe08b3b4f2b5", "ja3_variant_count": 1, "ja3_variants": [ "814857f18ea3c74352eefe08b3b4f2b5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_04dc51f5588f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "04dc51f5588f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-10-45-18-43-17613-27-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790085017, "last_seen": 1790085017, "transport": "t", "ja3_hash": "0619ba5b1850cdf79ac630fe707791ac", "ja3_variant_count": 1, "ja3_variants": [ "0619ba5b1850cdf79ac630fe707791ac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 YaBrowser/25.1.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_059f1e0f57df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "059f1e0f57df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-65037-43-27-45-35-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790794874, "last_seen": 1790794874, "transport": "t", "ja3_hash": "23e9f42429aa2eb8997243412b6aba66", "ja3_variant_count": 1, "ja3_variants": [ "23e9f42429aa2eb8997243412b6aba66" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_07d4c546ea27", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "07d4c546ea27", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-65281-17613-45-43-11-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788744454, "last_seen": 1790219043, "transport": "t", "ja3_hash": "0aa3147fa0d253087205133f16cdb560", "ja3_variant_count": 2, "ja3_variants": [ "0aa3147fa0d253087205133f16cdb560", "18f64a4777f2e8d7e61d625f08110a91" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_0b790480e98e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "0b790480e98e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-13-65281-10-23-5-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789416942, "last_seen": 1789416942, "transport": "t", "ja3_hash": "a714a2dedb4c230e7267d7b41687ef58", "ja3_variant_count": 1, "ja3_variants": [ "a714a2dedb4c230e7267d7b41687ef58" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_102ed2a2267b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "102ed2a2267b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-65281-18-17613-27-51-45-43-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790791789, "last_seen": 1790791789, "transport": "t", "ja3_hash": "560c25f7d327f8734304d4af114bf733", "ja3_variant_count": 1, "ja3_variants": [ "560c25f7d327f8734304d4af114bf733" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_196bfe4641a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "196bfe4641a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-45-10-43-11-5-65037-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790794729, "last_seen": 1790794729, "transport": "t", "ja3_hash": "4729755655d6baefa9c98c22c4628774", "ja3_variant_count": 1, "ja3_variants": [ "4729755655d6baefa9c98c22c4628774" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_1f5259b7c27f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "1f5259b7c27f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-5-18-65281-13-65037-43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789613752, "last_seen": 1789613752, "transport": "t", "ja3_hash": "e09a92945119e9a7c13b056d4be063ca", "ja3_variant_count": 1, "ja3_variants": [ "e09a92945119e9a7c13b056d4be063ca" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_2434268a88f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "2434268a88f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-35-10-18-45-5-43-17513-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791288294, "last_seen": 1791288294, "transport": "t", "ja3_hash": "cfe38557231c365d37de61c2be1d3ba0", "ja3_variant_count": 1, "ja3_variants": [ "cfe38557231c365d37de61c2be1d3ba0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_25060c2801cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "25060c2801cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-13-35-65281-45-43-17613-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788779841, "last_seen": 1789681474, "transport": "t", "ja3_hash": "84474d8668435474b3a7099b77c968a3", "ja3_variant_count": 2, "ja3_variants": [ "84474d8668435474b3a7099b77c968a3", "02384f34fffb93cc7bf77fb08f2e66f9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_2515f938fa8f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "2515f938fa8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-18-45-43-10-51-65281-27-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790854954, "last_seen": 1790854954, "transport": "t", "ja3_hash": "50f79babe09a215cc324d943e14a4c17", "ja3_variant_count": 1, "ja3_variants": [ "50f79babe09a215cc324d943e14a4c17" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_4e9ae4b94bda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "4e9ae4b94bda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-13-11-5-10-65037-35-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790526814, "last_seen": 1790526814, "transport": "t", "ja3_hash": "4580580325ef58e11117b8e8f4cd7f49", "ja3_variant_count": 1, "ja3_variants": [ "4580580325ef58e11117b8e8f4cd7f49" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_4f2e70c50333", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "4f2e70c50333", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-18-13-5-43-27-17513-23-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791276532, "last_seen": 1791276532, "transport": "t", "ja3_hash": "fa8a189daa62e3a241baff8e9ff9d78d", "ja3_variant_count": 1, "ja3_variants": [ "fa8a189daa62e3a241baff8e9ff9d78d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_5c470b4c6c88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "5c470b4c6c88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-27-35-23-10-13-18-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788789363, "last_seen": 1788789363, "transport": "t", "ja3_hash": "3ce090e20d70343f4f614a4b8a58b6cd", "ja3_variant_count": 1, "ja3_variants": [ "3ce090e20d70343f4f614a4b8a58b6cd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_618953183c6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "618953183c6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-5-43-23-45-27-51-17613-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790704800, "last_seen": 1790704800, "transport": "t", "ja3_hash": "818145f652423ecb17de793692ec478f", "ja3_variant_count": 1, "ja3_variants": [ "818145f652423ecb17de793692ec478f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_68d52dacf6e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "68d52dacf6e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-43-65281-10-5-65037-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788857807, "last_seen": 1788857807, "transport": "t", "ja3_hash": "8aba27b5d7c4ca2a854fe5d26e4ff9cf", "ja3_variant_count": 1, "ja3_variants": [ "8aba27b5d7c4ca2a854fe5d26e4ff9cf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_742f84ecedf8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "742f84ecedf8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-13-18-65281-23-35-43-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788704892, "last_seen": 1788704892, "transport": "t", "ja3_hash": "0ef6e8f0fd1efa161c3d8f271f4c9201", "ja3_variant_count": 1, "ja3_variants": [ "0ef6e8f0fd1efa161c3d8f271f4c9201" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_7786f0f3f384", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "7786f0f3f384", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-10-17613-5-43-13-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789330067, "last_seen": 1789330067, "transport": "t", "ja3_hash": "e3c6131d481e716625c720b9dd1f3d65", "ja3_variant_count": 1, "ja3_variants": [ "e3c6131d481e716625c720b9dd1f3d65" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_7d530b7ce2d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "7d530b7ce2d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-23-11-17613-45-18-5-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790224230, "last_seen": 1790224230, "transport": "t", "ja3_hash": "62460b35ba6ad2dc66423c3a165ce63d", "ja3_variant_count": 1, "ja3_variants": [ "62460b35ba6ad2dc66423c3a165ce63d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_817f014f60f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "817f014f60f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-45-10-5-43-17613-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197942, "last_seen": 1790197942, "transport": "t", "ja3_hash": "d0729e9afaf1b2b587bc46a99e14a1a2", "ja3_variant_count": 1, "ja3_variants": [ "d0729e9afaf1b2b587bc46a99e14a1a2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_85c01d96e81d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "85c01d96e81d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-35-10-43-5-65281-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790673691, "last_seen": 1790673691, "transport": "t", "ja3_hash": "64f63c369258eac7bd3ed17ddf27b986", "ja3_variant_count": 1, "ja3_variants": [ "64f63c369258eac7bd3ed17ddf27b986" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_8acea6979e16", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "8acea6979e16", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-27-65037-13-18-43-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789849652, "last_seen": 1789849652, "transport": "t", "ja3_hash": "5cc4100496ea8e4f23f7aad6485466c0", "ja3_variant_count": 1, "ja3_variants": [ "5cc4100496ea8e4f23f7aad6485466c0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_8afb3a864bbc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "8afb3a864bbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-27-51764-23-13-65037-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788499355, "last_seen": 1788499355, "transport": "t", "ja3_hash": "5ca8353e8de2a60eabde5cbce9d9692a", "ja3_variant_count": 1, "ja3_variants": [ "5ca8353e8de2a60eabde5cbce9d9692a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_92fd269a5148", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "92fd269a5148", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-11-5-10-65037-45-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789867041, "last_seen": 1789867041, "transport": "t", "ja3_hash": "1f5945928e0a3630c867556698dad476", "ja3_variant_count": 1, "ja3_variants": [ "1f5945928e0a3630c867556698dad476" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 8 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_94580b509cf7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "94580b509cf7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-13-18-5-45-27-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790198879, "last_seen": 1790198879, "transport": "t", "ja3_hash": "4db5e7089998d13b73df48eeae662b4b", "ja3_variant_count": 1, "ja3_variants": [ "4db5e7089998d13b73df48eeae662b4b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 54 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_990cf36d01db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "990cf36d01db", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-5-11-23-13-65281-43-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789635487, "last_seen": 1789635487, "transport": "t", "ja3_hash": "0f3cac440ac7a653c83bfbd7e1c9be92", "ja3_variant_count": 1, "ja3_variants": [ "0f3cac440ac7a653c83bfbd7e1c9be92" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_9de1a5ff98db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "9de1a5ff98db", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-65037-11-17613-45-18-43-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790371725, "last_seen": 1790371725, "transport": "t", "ja3_hash": "5141db2859a00e4b02f813ae485db619", "ja3_variant_count": 1, "ja3_variants": [ "5141db2859a00e4b02f813ae485db619" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_a03f38a30f75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "a03f38a30f75", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-51-65281-11-23-10-27-43-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789647936, "last_seen": 1789647936, "transport": "t", "ja3_hash": "26629cab00b8853f13bcbb72435e9a8f", "ja3_variant_count": 1, "ja3_variants": [ "26629cab00b8853f13bcbb72435e9a8f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_a4556128c9dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "a4556128c9dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-18-65281-10-11-27-35-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790643516, "last_seen": 1790643516, "transport": "t", "ja3_hash": "05485959d9ee9cedfbd9198e35a2d2aa", "ja3_variant_count": 1, "ja3_variants": [ "05485959d9ee9cedfbd9198e35a2d2aa" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_b2df4b604e4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "b2df4b604e4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-45-35-27-5-65037-13-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789011493, "last_seen": 1789011493, "transport": "t", "ja3_hash": "ba3890555fd9720b476b8af2de02c3ab", "ja3_variant_count": 1, "ja3_variants": [ "ba3890555fd9720b476b8af2de02c3ab" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_c493349ab2c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "c493349ab2c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-27-23-13-51-18-43-45-17613,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790707007, "last_seen": 1790707007, "transport": "t", "ja3_hash": "55bcbba1cf00e123d5982f1261a08045", "ja3_variant_count": 1, "ja3_variants": [ "55bcbba1cf00e123d5982f1261a08045" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_c99b756607d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "c99b756607d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-35-65281-10-18-51-23-17613-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789537591, "last_seen": 1789537591, "transport": "t", "ja3_hash": "402ad77e5269d19e68b5572a5c941a55", "ja3_variant_count": 1, "ja3_variants": [ "402ad77e5269d19e68b5572a5c941a55" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.96 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_cb8f23c345ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "cb8f23c345ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-43-23-11-65037-65281-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789267478, "last_seen": 1789267478, "transport": "t", "ja3_hash": "86018a434acd882f2514c931de665c1d", "ja3_variant_count": 1, "ja3_variants": [ "86018a434acd882f2514c931de665c1d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Vivaldi/7.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_d29412d71dbb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "d29412d71dbb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-43-18-45-51-5-13-65281-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790236141, "last_seen": 1790236141, "transport": "t", "ja3_hash": "6b493a0d9fb21b832fb1319722cafe6b", "ja3_variant_count": 1, "ja3_variants": [ "6b493a0d9fb21b832fb1319722cafe6b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_d6221eaa17ae", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "d6221eaa17ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-51-35-27-18-10-45-11-16,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790994656, "last_seen": 1790994656, "transport": "t", "ja3_hash": "a07a82b42e57a4a17f4a201abe533ad5", "ja3_variant_count": 1, "ja3_variants": [ "a07a82b42e57a4a17f4a201abe533ad5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_d86ff2857c8c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "d86ff2857c8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-17613-35-11-18-10-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790470570, "last_seen": 1790470570, "transport": "t", "ja3_hash": "b58c948b9cd2f95f7cd29451d69e02ae", "ja3_variant_count": 1, "ja3_variants": [ "b58c948b9cd2f95f7cd29451d69e02ae" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.1 Safari/537.36 Edg/128.0.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_d90867bd29ef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "d90867bd29ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-18-35-51-17613-65281-23-11-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241354, "last_seen": 1790241354, "transport": "t", "ja3_hash": "7b62cac73773210d3a5a085e7b769185", "ja3_variant_count": 1, "ja3_variants": [ "7b62cac73773210d3a5a085e7b769185" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 8 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_d911c8dfd53d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "d911c8dfd53d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-35-17613-10-51-45-18-65281-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788550146, "last_seen": 1788550146, "transport": "t", "ja3_hash": "c97efa4c809867fc5b044adea135273d", "ja3_variant_count": 1, "ja3_variants": [ "c97efa4c809867fc5b044adea135273d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_dbebe983155f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "dbebe983155f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-65281-11-45-35-18-27-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788959680, "last_seen": 1788959680, "transport": "t", "ja3_hash": "4e0d0c106a3e1ef3e816940a1701aba7", "ja3_variant_count": 1, "ja3_variants": [ "4e0d0c106a3e1ef3e816940a1701aba7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_dd1445eb6ebf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "dd1445eb6ebf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-23-17613-65037-10-5-65281-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789063159, "last_seen": 1789063159, "transport": "t", "ja3_hash": "c575514322ebf77d6f28021ccbde967e", "ja3_variant_count": 1, "ja3_variants": [ "c575514322ebf77d6f28021ccbde967e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_e23a3b1148df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "e23a3b1148df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-23-51-43-27-35-11-5-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790648093, "last_seen": 1790648093, "transport": "t", "ja3_hash": "eabd88fcde54a138c26bdd766ded49e7", "ja3_variant_count": 1, "ja3_variants": [ "eabd88fcde54a138c26bdd766ded49e7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_e558674a30f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "e558674a30f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-35-13-45-10-65281-43-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789635366, "last_seen": 1789635366, "transport": "t", "ja3_hash": "7e25c56f03841cc84ec6ab99a0752bd7", "ja3_variant_count": 1, "ja3_variants": [ "7e25c56f03841cc84ec6ab99a0752bd7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_e64a2ca0c19f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "e64a2ca0c19f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-10-35-18-5-45-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790365770, "last_seen": 1790365770, "transport": "t", "ja3_hash": "9c49a561a0173eb869d4c3e6acd524b5", "ja3_variant_count": 1, "ja3_variants": [ "9c49a561a0173eb869d4c3e6acd524b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_e6c018fbd29b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "e6c018fbd29b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-43-23-51764-11-45-5-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790230951, "last_seen": 1790230951, "transport": "t", "ja3_hash": "089a8e5dcb33a31170917f2d4ab8aa68", "ja3_variant_count": 1, "ja3_variants": [ "089a8e5dcb33a31170917f2d4ab8aa68" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_e77ed8dc1429", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "e77ed8dc1429", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-27-65037-5-35-65281-45-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789629746, "last_seen": 1789629746, "transport": "t", "ja3_hash": "bdf2daff882c4eeab6e3716b08a00658", "ja3_variant_count": 1, "ja3_variants": [ "bdf2daff882c4eeab6e3716b08a00658" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_eb513c3e0717", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "eb513c3e0717", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-5-11-23-35-10-65037-65281-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788847801, "last_seen": 1788847801, "transport": "t", "ja3_hash": "4f85e5691c596f3cbcb6d153843e90b5", "ja3_variant_count": 1, "ja3_variants": [ "4f85e5691c596f3cbcb6d153843e90b5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_f2ad119d8bc9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "f2ad119d8bc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-45-65281-43-18-35-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788781228, "last_seen": 1788781228, "transport": "t", "ja3_hash": "2c536d8883bce1723a2591348a3775d9", "ja3_variant_count": 1, "ja3_variants": [ "2c536d8883bce1723a2591348a3775d9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_f4dfcdddf392", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "f4dfcdddf392", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-13-27-43-10-23-5-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788790365, "last_seen": 1788790365, "transport": "t", "ja3_hash": "a7fcaaf762f90b89f10d5f3db003f337", "ja3_variant_count": 1, "ja3_variants": [ "a7fcaaf762f90b89f10d5f3db003f337" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h1_8daaf6152771_159d578d7fd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h1", "b": "8daaf6152771", "c": "159d578d7fd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-65037-23-18-11-65281-5-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790532478, "last_seen": 1790532478, "transport": "t", "ja3_hash": "2e6cfe9a979b2ccbb3c06a7f06ba4c81", "ja3_variant_count": 1, "ja3_variants": [ "2e6cfe9a979b2ccbb3c06a7f06ba4c81" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h1_8daaf6152771_41f621d9df38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h1", "b": "8daaf6152771", "c": "41f621d9df38", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-5-27-43-45-16-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790648849, "last_seen": 1790648849, "transport": "t", "ja3_hash": "dac9a7ae4f0b2001134109eb52bb4d32", "ja3_variant_count": 1, "ja3_variants": [ "dac9a7ae4f0b2001134109eb52bb4d32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h1_8daaf6152771_59a43a54cf1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h1", "b": "8daaf6152771", "c": "59a43a54cf1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-35-43-18-65281-13-16-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790644136, "last_seen": 1790644136, "transport": "t", "ja3_hash": "dbeb96bc05f56fbfa36eaa46f59a2462", "ja3_variant_count": 1, "ja3_variants": [ "dbeb96bc05f56fbfa36eaa46f59a2462" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_08ecd3b10d9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "08ecd3b10d9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-23-18-13-65281-16-5-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789695423, "last_seen": 1789695423, "transport": "t", "ja3_hash": "abfcd164f22c493d2fc59f419e3c9939", "ja3_variant_count": 1, "ja3_variants": [ "abfcd164f22c493d2fc59f419e3c9939" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_0b7e5b2c516e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "0b7e5b2c516e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-35-18-16-45-5-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789837734, "last_seen": 1789837734, "transport": "t", "ja3_hash": "ab317a5329b8f1c966cd99e0918f5507", "ja3_variant_count": 1, "ja3_variants": [ "ab317a5329b8f1c966cd99e0918f5507" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 6 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_17f6d9f85e1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "17f6d9f85e1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-11-43-27-16-18-17613-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788508292, "last_seen": 1791021143, "transport": "t", "ja3_hash": "94f8389df786ba333343a6f0387538b1", "ja3_variant_count": 2, "ja3_variants": [ "94f8389df786ba333343a6f0387538b1", "47a606a914d3d72902d1e7aff20c5472" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_199aa72fe2b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "199aa72fe2b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-43-11-65281-35-5-16-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788779551, "last_seen": 1788779551, "transport": "t", "ja3_hash": "4f2e61b033911f277f6cfab73ed061bc", "ja3_variant_count": 1, "ja3_variants": [ "4f2e61b033911f277f6cfab73ed061bc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_1b84e56ec76d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "1b84e56ec76d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-65037-23-65281-18-16-5-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791135130, "last_seen": 1791135130, "transport": "t", "ja3_hash": "2a70d7529570434dcc94821024372ccd", "ja3_variant_count": 1, "ja3_variants": [ "2a70d7529570434dcc94821024372ccd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_21459a9612e7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "21459a9612e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-43-16-5-13-65281-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789696993, "last_seen": 1789696993, "transport": "t", "ja3_hash": "09575c72e0cd71728d0bb42604b9c58e", "ja3_variant_count": 1, "ja3_variants": [ "09575c72e0cd71728d0bb42604b9c58e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_273ed36db397", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "273ed36db397", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-43-18-17613-45-13-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788825881, "last_seen": 1788825881, "transport": "t", "ja3_hash": "8bcead03d0414de8d7a66069cecbec9f", "ja3_variant_count": 1, "ja3_variants": [ "8bcead03d0414de8d7a66069cecbec9f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 33 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_2e3f9fd495b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "2e3f9fd495b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-18-65037-35-16-10-43-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789396352, "last_seen": 1789396352, "transport": "t", "ja3_hash": "c8f545583c2c9ed2a740472f726be6b0", "ja3_variant_count": 1, "ja3_variants": [ "c8f545583c2c9ed2a740472f726be6b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_30204a7840d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "30204a7840d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-65037-11-27-45-17613-13-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790203731, "last_seen": 1790203731, "transport": "t", "ja3_hash": "a3d765ca00c2a6489cb5cf52f0f510a6", "ja3_variant_count": 1, "ja3_variants": [ "a3d765ca00c2a6489cb5cf52f0f510a6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_3646ec23ad25", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "3646ec23ad25", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-16-43-10-51-27-5-13-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791142253, "last_seen": 1791142253, "transport": "t", "ja3_hash": "c3766a8e78b91a682031d2611f7b79ed", "ja3_variant_count": 1, "ja3_variants": [ "c3766a8e78b91a682031d2611f7b79ed" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_3d03bdfe82c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "3d03bdfe82c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-23-43-45-16-35-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789267397, "last_seen": 1789267397, "transport": "t", "ja3_hash": "f5fb6cef4d44a06607d96f6feb3904fc", "ja3_variant_count": 1, "ja3_variants": [ "f5fb6cef4d44a06607d96f6feb3904fc" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_3f19e5725af6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "3f19e5725af6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-43-65281-27-23-16-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790163785, "last_seen": 1790163785, "transport": "t", "ja3_hash": "20f469dfb401b86288a1c77b826a1902", "ja3_variant_count": 1, "ja3_variants": [ "20f469dfb401b86288a1c77b826a1902" ], "user_agents": { "Mozilla/5.0 (Android 14; Mobile; rv:136.0) Gecko/136.0 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_3fd1a28acef4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "3fd1a28acef4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-27-5-11-43-17613-13-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790235349, "last_seen": 1790235349, "transport": "t", "ja3_hash": "32a569df90e6db1c8d7d7deec63f6f34", "ja3_variant_count": 1, "ja3_variants": [ "32a569df90e6db1c8d7d7deec63f6f34" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_402c1448a2e6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "402c1448a2e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-10-27-17613-13-5-16-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791241331, "last_seen": 1791241331, "transport": "t", "ja3_hash": "e83b9a8bf74f24439041a602365d52c8", "ja3_variant_count": 1, "ja3_variants": [ "e83b9a8bf74f24439041a602365d52c8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_42cd88e06348", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "42cd88e06348", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-18-16-17613-65281-51764-35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789479763, "last_seen": 1789479763, "transport": "t", "ja3_hash": "466daf093c486ac51262fbf3a5d066f8", "ja3_variant_count": 1, "ja3_variants": [ "466daf093c486ac51262fbf3a5d066f8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_4324905969a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "4324905969a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-17613-27-18-35-16-5-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789613596, "last_seen": 1789613596, "transport": "t", "ja3_hash": "3b97a9dc1de3dce7e5e692b71708d666", "ja3_variant_count": 1, "ja3_variants": [ "3b97a9dc1de3dce7e5e692b71708d666" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_4e68cdb5f915", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "4e68cdb5f915", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-16-65037-43-10-5-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789928870, "last_seen": 1789928870, "transport": "t", "ja3_hash": "d07d5953a3efb48b7f405ec3dcee9d7f", "ja3_variant_count": 1, "ja3_variants": [ "d07d5953a3efb48b7f405ec3dcee9d7f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_54c82ddae11f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "54c82ddae11f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-23-10-27-18-45-35-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790036411, "last_seen": 1790036411, "transport": "t", "ja3_hash": "a58fd1ab24704818a757fd8bb17ccc49", "ja3_variant_count": 1, "ja3_variants": [ "a58fd1ab24704818a757fd8bb17ccc49" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_60d86369702e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "60d86369702e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-13-16-10-43-35-5-11-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791263496, "last_seen": 1791263496, "transport": "t", "ja3_hash": "de7833b1a449e178eb725becaa552a89", "ja3_variant_count": 1, "ja3_variants": [ "de7833b1a449e178eb725becaa552a89" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_616a1ede9e9f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "616a1ede9e9f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-16-65281-23-5-27-11-43-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790274496, "last_seen": 1790274496, "transport": "t", "ja3_hash": "c209e21b5c98e7230ee718e55a55655c", "ja3_variant_count": 1, "ja3_variants": [ "c209e21b5c98e7230ee718e55a55655c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_63cd8f3e8102", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "63cd8f3e8102", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-10-11-16-23-27-13-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788511548, "last_seen": 1788511548, "transport": "t", "ja3_hash": "3d8b142c8a4a934cc87bb10c6781d43f", "ja3_variant_count": 1, "ja3_variants": [ "3d8b142c8a4a934cc87bb10c6781d43f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_66a30c8f921c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "66a30c8f921c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-18-16-27-35-11-65281-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789172605, "last_seen": 1789172605, "transport": "t", "ja3_hash": "24a1753d512a68ebdb909b183c1b0348", "ja3_variant_count": 1, "ja3_variants": [ "24a1753d512a68ebdb909b183c1b0348" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_6820e895548d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "6820e895548d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-65281-13-23-11-35-43-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790357383, "last_seen": 1790357383, "transport": "t", "ja3_hash": "bf7c49ebb778d6fdff7b88ba08a44014", "ja3_variant_count": 1, "ja3_variants": [ "bf7c49ebb778d6fdff7b88ba08a44014" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_6ba4f5224245", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "6ba4f5224245", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-13-65037-43-16-10-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791150842, "last_seen": 1791150842, "transport": "t", "ja3_hash": "f156372e6e9f329bb73f4f8680581725", "ja3_variant_count": 1, "ja3_variants": [ "f156372e6e9f329bb73f4f8680581725" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_714f89ce5142", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "714f89ce5142", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-23-18-16-45-43-65281-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790214495, "last_seen": 1790214495, "transport": "t", "ja3_hash": "4288ffb9a0d9662a3dc220140d624d76", "ja3_variant_count": 1, "ja3_variants": [ "4288ffb9a0d9662a3dc220140d624d76" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_7e9c2c569ca9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "7e9c2c569ca9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-18-43-45-16-35-65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790234018, "last_seen": 1790234018, "transport": "t", "ja3_hash": "58c20781169521e101e3ea43fdf815a2", "ja3_variant_count": 1, "ja3_variants": [ "58c20781169521e101e3ea43fdf815a2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_81e3018c4f35", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "81e3018c4f35", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-13-16-17613-35-27-65281-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790650408, "last_seen": 1790650408, "transport": "t", "ja3_hash": "8a956e24f968e00b11cc64b8d47086ad", "ja3_variant_count": 1, "ja3_variants": [ "8a956e24f968e00b11cc64b8d47086ad" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_854e75ccfa4f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "854e75ccfa4f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-65037-17613-16-13-5-43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790495911, "last_seen": 1790495911, "transport": "t", "ja3_hash": "c5eac967085d78b8750a7999b3446afa", "ja3_variant_count": 1, "ja3_variants": [ "c5eac967085d78b8750a7999b3446afa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_878b5fbfda70", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "878b5fbfda70", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-23-45-43-65037-11-35-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790661099, "last_seen": 1790661099, "transport": "t", "ja3_hash": "c81e934195b0bec0ce4a1d41952ae770", "ja3_variant_count": 1, "ja3_variants": [ "c81e934195b0bec0ce4a1d41952ae770" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_87c600696bdb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "87c600696bdb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-11-17613-5-13-23-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789967041, "last_seen": 1790935630, "transport": "t", "ja3_hash": "8527d6800760eefd83f89503d3c10131", "ja3_variant_count": 2, "ja3_variants": [ "8527d6800760eefd83f89503d3c10131", "faa4745369e3a9fdef11811f0e8c93da" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_8966843b4b06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "8966843b4b06", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-10-16-43-11-45-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789396334, "last_seen": 1789396334, "transport": "t", "ja3_hash": "3cc17e9f4661297709c5c137c48c3677", "ja3_variant_count": 1, "ja3_variants": [ "3cc17e9f4661297709c5c137c48c3677" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_901b5ca7d282", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "901b5ca7d282", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-10-43-16-65037-35-45-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790552010, "last_seen": 1790552010, "transport": "t", "ja3_hash": "dd8f8aa2220ee6c7927efe8bca6b158f", "ja3_variant_count": 1, "ja3_variants": [ "dd8f8aa2220ee6c7927efe8bca6b158f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_9319d999aaea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "9319d999aaea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-5-18-27-23-16-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791209377, "last_seen": 1791209377, "transport": "t", "ja3_hash": "95a6b2dd521584a119a889d882804195", "ja3_variant_count": 1, "ja3_variants": [ "95a6b2dd521584a119a889d882804195" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 17 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_93e3d6013cee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "93e3d6013cee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-10-17613-27-18-5-43-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789757229, "last_seen": 1789757229, "transport": "t", "ja3_hash": "d087d914a41be7b441e868ad4923a676", "ja3_variant_count": 1, "ja3_variants": [ "d087d914a41be7b441e868ad4923a676" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_994be4a20346", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "994be4a20346", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-23-5-43-17613-27-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790216272, "last_seen": 1790216272, "transport": "t", "ja3_hash": "b00c367e8ed13bdd6b7f1f4085d3daeb", "ja3_variant_count": 1, "ja3_variants": [ "b00c367e8ed13bdd6b7f1f4085d3daeb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_9b0ed6256b93", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "9b0ed6256b93", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-5-16-65037-10-35-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789168635, "last_seen": 1789168635, "transport": "t", "ja3_hash": "ea846969b61e358d5e4402a7792f33b0", "ja3_variant_count": 1, "ja3_variants": [ "ea846969b61e358d5e4402a7792f33b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_a8eceb5170e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "a8eceb5170e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-10-23-35-65281-27-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790689895, "last_seen": 1790689895, "transport": "t", "ja3_hash": "2b6e818592f4b87095b66a5bad3665be", "ja3_variant_count": 1, "ja3_variants": [ "2b6e818592f4b87095b66a5bad3665be" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_ada6b514a232", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "ada6b514a232", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-65281-11-10-16-65037-45-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790290937, "last_seen": 1790290937, "transport": "t", "ja3_hash": "741a46ffeb6da901aa94bc10f7e468a3", "ja3_variant_count": 1, "ja3_variants": [ "741a46ffeb6da901aa94bc10f7e468a3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 102 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_af228f1ab827", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "af228f1ab827", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-10-45-17613-16-51764-65281-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790866608, "last_seen": 1790866608, "transport": "t", "ja3_hash": "38dac644a373d98219f3f928d974437d", "ja3_variant_count": 1, "ja3_variants": [ "38dac644a373d98219f3f928d974437d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_b001f0826343", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "b001f0826343", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-10-65281-5-16-35-65037-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790244505, "last_seen": 1790244505, "transport": "t", "ja3_hash": "5763f68ca42a1a69abb1da150869d136", "ja3_variant_count": 1, "ja3_variants": [ "5763f68ca42a1a69abb1da150869d136" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_b18ba6013cf2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "b18ba6013cf2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-16-27-43-65281-35-13-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788634418, "last_seen": 1788634418, "transport": "t", "ja3_hash": "f259cf2e9bed3921a6ada917e43239c7", "ja3_variant_count": 1, "ja3_variants": [ "f259cf2e9bed3921a6ada917e43239c7" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_b5b2726095ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "b5b2726095ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-43-35-51764-65281-27-5-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790595262, "last_seen": 1790595262, "transport": "t", "ja3_hash": "74d4c74637dc12fa157484b07f46de3f", "ja3_variant_count": 1, "ja3_variants": [ "74d4c74637dc12fa157484b07f46de3f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_b812b983751b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "b812b983751b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-16-17613-10-27-23-65281-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790794874, "last_seen": 1790794874, "transport": "t", "ja3_hash": "f46121fe770c2c308c60e3ca69b91a06", "ja3_variant_count": 1, "ja3_variants": [ "f46121fe770c2c308c60e3ca69b91a06" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_b9c5db101816", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "b9c5db101816", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-16-18-45-11-65037-65281-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790222321, "last_seen": 1790222321, "transport": "t", "ja3_hash": "0979f8780509342d198fe503e1e01b12", "ja3_variant_count": 1, "ja3_variants": [ "0979f8780509342d198fe503e1e01b12" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.5.3 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_bc6aebf19aa9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "bc6aebf19aa9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-35-65037-11-16-65281-43-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790702452, "last_seen": 1790702452, "transport": "t", "ja3_hash": "8c26b77b51f24928b673f539a5cc37a0", "ja3_variant_count": 1, "ja3_variants": [ "8c26b77b51f24928b673f539a5cc37a0" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_c21e6828b5da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "c21e6828b5da", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-23-16-13-18-65037-43-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789678837, "last_seen": 1789678837, "transport": "t", "ja3_hash": "9bf2bf82ca0568b5ec48e8bb13d77962", "ja3_variant_count": 1, "ja3_variants": [ "9bf2bf82ca0568b5ec48e8bb13d77962" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_c2c1483eb662", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "c2c1483eb662", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-27-45-17613-13-65281-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789511315, "last_seen": 1789511315, "transport": "t", "ja3_hash": "3021c89ac6c2bd122d2ed0a838a59ec6", "ja3_variant_count": 1, "ja3_variants": [ "3021c89ac6c2bd122d2ed0a838a59ec6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 122 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_cbf2794b29cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "cbf2794b29cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-23-43-45-27-16-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790043452, "last_seen": 1790043452, "transport": "t", "ja3_hash": "68bb05bf642f3caee35d5002f8da3130", "ja3_variant_count": 1, "ja3_variants": [ "68bb05bf642f3caee35d5002f8da3130" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_ccc6654aa737", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "ccc6654aa737", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-18-27-10-16-43-13-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791152008, "last_seen": 1791152008, "transport": "t", "ja3_hash": "b3798e63141d60fdb39afc1010e2784a", "ja3_variant_count": 1, "ja3_variants": [ "b3798e63141d60fdb39afc1010e2784a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_d443f987f1d5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "d443f987f1d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-43-16-65281-65037-45-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790247204, "last_seen": 1790247204, "transport": "t", "ja3_hash": "398c9bb84273ad0642ed25d4a30f04f9", "ja3_variant_count": 1, "ja3_variants": [ "398c9bb84273ad0642ed25d4a30f04f9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_d85a881d27c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "d85a881d27c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-43-65037-65281-23-45-35-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791265236, "last_seen": 1791265236, "transport": "t", "ja3_hash": "7a3fcf59905fd85d3345db05937d7a7e", "ja3_variant_count": 1, "ja3_variants": [ "7a3fcf59905fd85d3345db05937d7a7e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.6.2 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_e8e7e567a66b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "e8e7e567a66b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-13-65037-23-5-10-43-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790348728, "last_seen": 1790348728, "transport": "t", "ja3_hash": "98754df7975f60c680d4352c6790579b", "ja3_variant_count": 1, "ja3_variants": [ "98754df7975f60c680d4352c6790579b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_eb1f0f7bd14d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "eb1f0f7bd14d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-43-10-23-35-16-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790214673, "last_seen": 1790214673, "transport": "t", "ja3_hash": "128abe6f1d136599511f42c48cf39ddf", "ja3_variant_count": 1, "ja3_variants": [ "128abe6f1d136599511f42c48cf39ddf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_f52e57363943", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "f52e57363943", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-65281-43-65037-27-45-16-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789142091, "last_seen": 1789142091, "transport": "t", "ja3_hash": "5a3a1dd6a3202ad2acf895203482a45a", "ja3_variant_count": 1, "ja3_variants": [ "5a3a1dd6a3202ad2acf895203482a45a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 28 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_098c26bee239", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "098c26bee239", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-43-35-23-11-65037-65281-45-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790231854, "last_seen": 1790231854, "transport": "t", "ja3_hash": "53273a7f6e0d2cefd886be85cbf93c4e", "ja3_variant_count": 1, "ja3_variants": [ "53273a7f6e0d2cefd886be85cbf93c4e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_0c4844a68e2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "0c4844a68e2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-65037-18-35-10-45-11-65281-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789634744, "last_seen": 1789634744, "transport": "t", "ja3_hash": "cc3257824ec9ee4a40f011004f429e41", "ja3_variant_count": 1, "ja3_variants": [ "cc3257824ec9ee4a40f011004f429e41" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_0f7e79af234e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "0f7e79af234e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-65281-35-45-65037-17613-5-23-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790023087, "last_seen": 1790023087, "transport": "t", "ja3_hash": "dc51de444745fe7070a382fda1351b4b", "ja3_variant_count": 1, "ja3_variants": [ "dc51de444745fe7070a382fda1351b4b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_123f32514b5a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "123f32514b5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-13-17613-65037-18-23-11-65281-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789811904, "last_seen": 1790803023, "transport": "t", "ja3_hash": "4c4bef22f22c121ff8ade6e79bdfe3d4", "ja3_variant_count": 2, "ja3_variants": [ "4c4bef22f22c121ff8ade6e79bdfe3d4", "8b7d063d7a6779a50d97157ce6c07133" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_1983395afe0a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "1983395afe0a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-45-10-43-18-11-17613-65281-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788804549, "last_seen": 1790727995, "transport": "t", "ja3_hash": "c24d26db8983ccb7f67c72d41c1e641b", "ja3_variant_count": 2, "ja3_variants": [ "c24d26db8983ccb7f67c72d41c1e641b", "d3ca44523d2f7146053cef1e28b9a54c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_327e079140c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "327e079140c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-17513-27-18-35-45-65037-51-5-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791258906, "last_seen": 1791258906, "transport": "t", "ja3_hash": "d95fa6849ecee21bd11961e09c755fe6", "ja3_variant_count": 1, "ja3_variants": [ "d95fa6849ecee21bd11961e09c755fe6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_38daa66b4cac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "38daa66b4cac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-5-65037-35-10-45-11-27-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789482718, "last_seen": 1789482718, "transport": "t", "ja3_hash": "c606cee445d8aedb0035b5d07d58cf91", "ja3_variant_count": 1, "ja3_variants": [ "c606cee445d8aedb0035b5d07d58cf91" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_3d655d714ce8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "3d655d714ce8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-51764-27-23-43-10-11-5-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791208448, "last_seen": 1791208448, "transport": "t", "ja3_hash": "9e17b099575ac7fc1ed8c0ef1849805b", "ja3_variant_count": 1, "ja3_variants": [ "9e17b099575ac7fc1ed8c0ef1849805b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_3d96b45a1398", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "3d96b45a1398", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-65037-11-17613-5-23-45-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790357037, "last_seen": 1790357037, "transport": "t", "ja3_hash": "36e7579d044dc3f048111a7ff7f4338a", "ja3_variant_count": 1, "ja3_variants": [ "36e7579d044dc3f048111a7ff7f4338a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_3f5cc2546b66", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "3f5cc2546b66", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-51-65281-35-45-17513-10-5-27-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791261225, "last_seen": 1791261225, "transport": "t", "ja3_hash": "a99d35b2eaddfadcec93045a79e35585", "ja3_variant_count": 1, "ja3_variants": [ "a99d35b2eaddfadcec93045a79e35585" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_412eb21e47b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "412eb21e47b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-5-17613-13-65037-35-23-43-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790767588, "last_seen": 1790767588, "transport": "t", "ja3_hash": "18564a6df539e31c32b7da71e4ef27c8", "ja3_variant_count": 1, "ja3_variants": [ "18564a6df539e31c32b7da71e4ef27c8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_574c705d39f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "574c705d39f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65037-13-10-35-18-27-43-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790236336, "last_seen": 1790236336, "transport": "t", "ja3_hash": "522271d54fbc55d6e638358a81e48241", "ja3_variant_count": 1, "ja3_variants": [ "522271d54fbc55d6e638358a81e48241" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_5ad77a56a781", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "5ad77a56a781", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-35-10-17613-51764-18-5-13-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788967861, "last_seen": 1788967861, "transport": "t", "ja3_hash": "84c5e06ade7fa8e3a82ab26b675e3ae6", "ja3_variant_count": 1, "ja3_variants": [ "84c5e06ade7fa8e3a82ab26b675e3ae6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_8ef772727c1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "8ef772727c1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-23-13-45-11-43-18-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730631, "last_seen": 1789730631, "transport": "t", "ja3_hash": "cee3a38c7e6b39237838e4ed708ceee0", "ja3_variant_count": 1, "ja3_variants": [ "cee3a38c7e6b39237838e4ed708ceee0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_bca5e4ad5b5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "bca5e4ad5b5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-45-35-23-5-11-27-65037-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788805017, "last_seen": 1788805017, "transport": "t", "ja3_hash": "1a47bfc565913edfca5b519afa447b04", "ja3_variant_count": 1, "ja3_variants": [ "1a47bfc565913edfca5b519afa447b04" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_bd4d7887201a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "bd4d7887201a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-43-17613-23-11-5-35-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788614166, "last_seen": 1788614166, "transport": "t", "ja3_hash": "c2688d9a7deb9e5b15fc72d3af03784f", "ja3_variant_count": 1, "ja3_variants": [ "c2688d9a7deb9e5b15fc72d3af03784f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_d8a345568fd0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "d8a345568fd0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-17613-5-13-35-23-43-45-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790981285, "last_seen": 1790981285, "transport": "t", "ja3_hash": "a0f2ef8c3ff9ba227202b897a7c92e26", "ja3_variant_count": 1, "ja3_variants": [ "a0f2ef8c3ff9ba227202b897a7c92e26" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_db7b34d9ff40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "db7b34d9ff40", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-11-23-43-35-18-65281-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790217364, "last_seen": 1790217364, "transport": "t", "ja3_hash": "63f0c6a80b0b02bdcbc5da9499427021", "ja3_variant_count": 1, "ja3_variants": [ "63f0c6a80b0b02bdcbc5da9499427021" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_dc7be83b3985", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "dc7be83b3985", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-51-18-45-23-27-35-17613-5-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789943454, "last_seen": 1789943454, "transport": "t", "ja3_hash": "d8bde08b556f6dd9ebac864fd0a0f15a", "ja3_variant_count": 1, "ja3_variants": [ "d8bde08b556f6dd9ebac864fd0a0f15a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_de0cd3be6c5b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "de0cd3be6c5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-10-5-27-11-13-23-65281-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788485072, "last_seen": 1788485072, "transport": "t", "ja3_hash": "f045a31c90d9d08cb31a56dfc5743f79", "ja3_variant_count": 1, "ja3_variants": [ "f045a31c90d9d08cb31a56dfc5743f79" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_e0ead2fbe346", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "e0ead2fbe346", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-35-65281-13-51-65037-17513-11-43-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790749649, "last_seen": 1790749649, "transport": "t", "ja3_hash": "47c6a0c61b2442e174c8992738780d69", "ja3_variant_count": 1, "ja3_variants": [ "47c6a0c61b2442e174c8992738780d69" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_f799b3cc17b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "f799b3cc17b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-45-5-65281-65037-23-35-13-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788791376, "last_seen": 1788791376, "transport": "t", "ja3_hash": "a80f610a601d26d8a7f8ee8316617643", "ja3_variant_count": 1, "ja3_variants": [ "a80f610a601d26d8a7f8ee8316617643" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h1_8daaf6152771_73c0b3b55113", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h1", "b": "8daaf6152771", "c": "73c0b3b55113", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-65281-27-16-43-11-5-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790528564, "last_seen": 1790528564, "transport": "t", "ja3_hash": "eab81b13a787b09cf8822314c2d40318", "ja3_variant_count": 1, "ja3_variants": [ "eab81b13a787b09cf8822314c2d40318" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h1_8daaf6152771_7ea64db7bbb6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h1", "b": "8daaf6152771", "c": "7ea64db7bbb6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-27-5-23-35-43-65281-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790527290, "last_seen": 1790527290, "transport": "t", "ja3_hash": "60739d1753525333df129d5a57687923", "ja3_variant_count": 1, "ja3_variants": [ "60739d1753525333df129d5a57687923" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h1_8daaf6152771_bab0893d39c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h1", "b": "8daaf6152771", "c": "bab0893d39c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-35-43-65037-13-11-10-65281-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790567347, "last_seen": 1790567347, "transport": "t", "ja3_hash": "0ea9c384604f587d5932f0ee451ea311", "ja3_variant_count": 1, "ja3_variants": [ "0ea9c384604f587d5932f0ee451ea311" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_138febdd6414", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "138febdd6414", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-43-16-45-35-23-11-17613-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790824976, "last_seen": 1790824976, "transport": "t", "ja3_hash": "ecf227614a4e4305c80e147e46fd48ad", "ja3_variant_count": 1, "ja3_variants": [ "ecf227614a4e4305c80e147e46fd48ad" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_1955258f3f1e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "1955258f3f1e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-45-65037-23-10-16-17513-13-35-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791108665, "last_seen": 1791108665, "transport": "t", "ja3_hash": "ce0063b9bbfac66a959eecd26523a1a6", "ja3_variant_count": 1, "ja3_variants": [ "ce0063b9bbfac66a959eecd26523a1a6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_1a7d932e55c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "1a7d932e55c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-43-35-11-10-23-27-17613-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790932273, "last_seen": 1790932273, "transport": "t", "ja3_hash": "5d2c20f58d45e8a574873177ce177cf6", "ja3_variant_count": 1, "ja3_variants": [ "5d2c20f58d45e8a574873177ce177cf6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_26436ca6cd6c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "26436ca6cd6c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-27-43-65037-13-23-5-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791269967, "last_seen": 1791269967, "transport": "t", "ja3_hash": "9940299a46bd89661decb8c889536679", "ja3_variant_count": 1, "ja3_variants": [ "9940299a46bd89661decb8c889536679" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_2e5fd94039a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "2e5fd94039a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-18-27-11-17513-65281-35-16-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791110254, "last_seen": 1791110254, "transport": "t", "ja3_hash": "ef75e2d14e34554371318a243a7c3bb4", "ja3_variant_count": 1, "ja3_variants": [ "ef75e2d14e34554371318a243a7c3bb4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_33a0d52ea649", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "33a0d52ea649", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-11-5-45-13-35-23-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790942889, "last_seen": 1790942889, "transport": "t", "ja3_hash": "0671c97b2e818e1fa3e523255d1cb075", "ja3_variant_count": 1, "ja3_variants": [ "0671c97b2e818e1fa3e523255d1cb075" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_34b4ff0bc828", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "34b4ff0bc828", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-16-5-65281-23-18-51-45-43-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789676097, "last_seen": 1789676097, "transport": "t", "ja3_hash": "d6e9575148b86e1df8019b3383ff709d", "ja3_variant_count": 1, "ja3_variants": [ "d6e9575148b86e1df8019b3383ff709d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_358bb8095f0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "358bb8095f0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-65037-43-11-13-35-5-45-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811259, "last_seen": 1788811259, "transport": "t", "ja3_hash": "28d56ba4334dcd239a18a002a127def8", "ja3_variant_count": 1, "ja3_variants": [ "28d56ba4334dcd239a18a002a127def8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_37f7755eec74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "37f7755eec74", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-10-23-65037-13-17613-43-18-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789950620, "last_seen": 1789950620, "transport": "t", "ja3_hash": "1d9197536931b7d0ba27f62f401de194", "ja3_variant_count": 1, "ja3_variants": [ "1d9197536931b7d0ba27f62f401de194" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_3888564f72f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "3888564f72f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-11-18-65281-43-17613-27-5-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790163796, "last_seen": 1790163796, "transport": "t", "ja3_hash": "d6c11923aadf079efbcd244b2184e103", "ja3_variant_count": 1, "ja3_variants": [ "d6c11923aadf079efbcd244b2184e103" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_3e869517b034", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "3e869517b034", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-65037-5-23-27-43-18-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790853971, "last_seen": 1790853971, "transport": "t", "ja3_hash": "de1b5a952c495d307938ef5b6262ab9c", "ja3_variant_count": 1, "ja3_variants": [ "de1b5a952c495d307938ef5b6262ab9c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_47fbbeaf7a5b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "47fbbeaf7a5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-23-43-27-35-65281-13-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790213889, "last_seen": 1790213889, "transport": "t", "ja3_hash": "0f92550bef3a59e0b1b27cd7c3e59118", "ja3_variant_count": 1, "ja3_variants": [ "0f92550bef3a59e0b1b27cd7c3e59118" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_48b466c17d01", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "48b466c17d01", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-13-11-43-5-10-35-16-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789046006, "last_seen": 1789046006, "transport": "t", "ja3_hash": "286c1cbb8f0e7a44a46095518eceeb11", "ja3_variant_count": 1, "ja3_variants": [ "286c1cbb8f0e7a44a46095518eceeb11" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_5c22f28fd2da", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "5c22f28fd2da", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-13-35-43-10-17613-51764-65281-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790285182, "last_seen": 1790285182, "transport": "t", "ja3_hash": "13704731519ef19973905abc01865e87", "ja3_variant_count": 1, "ja3_variants": [ "13704731519ef19973905abc01865e87" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_646a4795d1c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "646a4795d1c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-45-16-65037-10-5-65281-43-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789402741, "last_seen": 1789402741, "transport": "t", "ja3_hash": "49fe0451e722c18e896f5f300aa14a03", "ja3_variant_count": 1, "ja3_variants": [ "49fe0451e722c18e896f5f300aa14a03" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_661c48f6a969", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "661c48f6a969", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-17513-35-45-43-18-27-16-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791298642, "last_seen": 1791298642, "transport": "t", "ja3_hash": "12ffbe50723f7aa0bdff13de2f4769c7", "ja3_variant_count": 1, "ja3_variants": [ "12ffbe50723f7aa0bdff13de2f4769c7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_673fbb719607", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "673fbb719607", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-16-65037-23-10-18-43-5-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789118381, "last_seen": 1789118381, "transport": "t", "ja3_hash": "825851caa00eb1f4ad18d4effda19198", "ja3_variant_count": 1, "ja3_variants": [ "825851caa00eb1f4ad18d4effda19198" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_6910136b5ed9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "6910136b5ed9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-45-11-23-43-13-18-17613-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789104929, "last_seen": 1789104929, "transport": "t", "ja3_hash": "6c3ef8140401b4c717f54447d9e12c5d", "ja3_variant_count": 1, "ja3_variants": [ "6c3ef8140401b4c717f54447d9e12c5d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 296 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_69aab5dcc5a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "69aab5dcc5a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-43-5-11-65037-65281-35-13-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790311727, "last_seen": 1790311727, "transport": "t", "ja3_hash": "1135b7320e9d7dacf1fece6aa5179a13", "ja3_variant_count": 1, "ja3_variants": [ "1135b7320e9d7dacf1fece6aa5179a13" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_6c7a99197624", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "6c7a99197624", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-65281-27-65037-11-17613-16-18-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790230189, "last_seen": 1790230189, "transport": "t", "ja3_hash": "53d145ce259a59accadd24df3905a175", "ja3_variant_count": 1, "ja3_variants": [ "53d145ce259a59accadd24df3905a175" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_7260fdec251a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "7260fdec251a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-23-35-65037-18-13-16-43-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789019013, "last_seen": 1789019013, "transport": "t", "ja3_hash": "e1d3c5dd0b78c315e72f65e8e11361b0", "ja3_variant_count": 1, "ja3_variants": [ "e1d3c5dd0b78c315e72f65e8e11361b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_7310da5e19f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "7310da5e19f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-27-11-13-16-17613-10-65037-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790577937, "last_seen": 1790577937, "transport": "t", "ja3_hash": "dca98c4b4785038aa1a695906f0dc19a", "ja3_variant_count": 1, "ja3_variants": [ "dca98c4b4785038aa1a695906f0dc19a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_77e543b268a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "77e543b268a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65281-16-45-65037-35-43-23-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789659791, "last_seen": 1789659791, "transport": "t", "ja3_hash": "63c3bebcaac80eb82384c37ea4f7826a", "ja3_variant_count": 1, "ja3_variants": [ "63c3bebcaac80eb82384c37ea4f7826a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_7a1ab9bf3637", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "7a1ab9bf3637", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-13-23-17513-11-10-27-65281-16-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789124528, "last_seen": 1789124528, "transport": "t", "ja3_hash": "2d37efa571cca35e54afa183dd0191cb", "ja3_variant_count": 1, "ja3_variants": [ "2d37efa571cca35e54afa183dd0191cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 9 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_82cce325fb95", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "82cce325fb95", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-23-45-35-27-5-65037-10-65281-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791263307, "last_seen": 1791263307, "transport": "t", "ja3_hash": "137dc37548f4db154167f8ce7821db6b", "ja3_variant_count": 1, "ja3_variants": [ "137dc37548f4db154167f8ce7821db6b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_86580dfb8573", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "86580dfb8573", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-10-43-5-18-45-65037-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789369477, "last_seen": 1789369477, "transport": "t", "ja3_hash": "3520a45060fc7ed2aa32afc75c13ff1d", "ja3_variant_count": 1, "ja3_variants": [ "3520a45060fc7ed2aa32afc75c13ff1d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_89823b7171ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "89823b7171ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-35-27-10-16-17613-65037-23-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790269782, "last_seen": 1790269782, "transport": "t", "ja3_hash": "db7c0bddba112bd43e951a5a73e7cb0f", "ja3_variant_count": 1, "ja3_variants": [ "db7c0bddba112bd43e951a5a73e7cb0f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 57 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_8abc52a8e45d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "8abc52a8e45d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-18-23-35-43-65037-17613-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791120626, "last_seen": 1791120626, "transport": "t", "ja3_hash": "c17f50ced8fc2dae4bc82194e79daee2", "ja3_variant_count": 1, "ja3_variants": [ "c17f50ced8fc2dae4bc82194e79daee2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_8b44fe488665", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "8b44fe488665", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-18-10-13-23-5-16-43-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790730645, "last_seen": 1790730645, "transport": "t", "ja3_hash": "2af306e6d845d27260c01888359840a7", "ja3_variant_count": 1, "ja3_variants": [ "2af306e6d845d27260c01888359840a7" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_910755028a2f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "910755028a2f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-65037-17513-23-35-16-27-43-5-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791290328, "last_seen": 1791290328, "transport": "t", "ja3_hash": "23a46f45a93bc8a08d61d2e54f2d4e27", "ja3_variant_count": 1, "ja3_variants": [ "23a46f45a93bc8a08d61d2e54f2d4e27" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_930d27d12a77", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "930d27d12a77", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-27-10-5-17613-45-13-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790124036, "last_seen": 1790124036, "transport": "t", "ja3_hash": "0ae8fee21af03648df07792b8b495dc7", "ja3_variant_count": 1, "ja3_variants": [ "0ae8fee21af03648df07792b8b495dc7" ], "user_agents": { "Mozilla/5.0 (iPad; CPU OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_b5d8a2efcbe1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "b5d8a2efcbe1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-35-27-13-5-65037-10-43-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790941890, "last_seen": 1790941890, "transport": "t", "ja3_hash": "4873071cc73599d880d6fac0486afe08", "ja3_variant_count": 1, "ja3_variants": [ "4873071cc73599d880d6fac0486afe08" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_b8368d321088", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "b8368d321088", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-16-43-23-13-5-45-17613-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790136779, "last_seen": 1790136779, "transport": "t", "ja3_hash": "fa04a766aefc6b88655d210669c0f21e", "ja3_variant_count": 1, "ja3_variants": [ "fa04a766aefc6b88655d210669c0f21e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 32 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_ba6cfc88201b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "ba6cfc88201b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-11-45-43-51764-65037-23-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788947862, "last_seen": 1788947862, "transport": "t", "ja3_hash": "352cb2bdd983c3aad24b97bd65a98c42", "ja3_variant_count": 1, "ja3_variants": [ "352cb2bdd983c3aad24b97bd65a98c42" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_bb2b54dd5bf6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "bb2b54dd5bf6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-43-65037-5-35-11-65281-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790205783, "last_seen": 1790205783, "transport": "t", "ja3_hash": "2cafadc3201d9794fde06fa2b0b93063", "ja3_variant_count": 1, "ja3_variants": [ "2cafadc3201d9794fde06fa2b0b93063" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_bb3d30162eef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "bb3d30162eef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-35-43-65037-45-51764-17613-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790862854, "last_seen": 1790862854, "transport": "t", "ja3_hash": "624997ea98e2631bce3df100dc231cfe", "ja3_variant_count": 1, "ja3_variants": [ "624997ea98e2631bce3df100dc231cfe" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_c44049607644", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "c44049607644", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-65281-16-10-23-51764-35-18-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508424, "last_seen": 1788508424, "transport": "t", "ja3_hash": "dfc9326b7d22084d44c7ac5b535d04ae", "ja3_variant_count": 1, "ja3_variants": [ "dfc9326b7d22084d44c7ac5b535d04ae" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_c8931a30a1c2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "c8931a30a1c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-13-45-10-43-65037-65281-16-5-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789124469, "last_seen": 1789124469, "transport": "t", "ja3_hash": "e16062ab907e6360bd18628489c9d41f", "ja3_variant_count": 1, "ja3_variants": [ "e16062ab907e6360bd18628489c9d41f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.60 Safari/537.36 Edge/12.246": 6 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_cb4bf42148f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "cb4bf42148f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-23-18-5-10-16-11-65281-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788745397, "last_seen": 1788745397, "transport": "t", "ja3_hash": "0f3c4cfef5ecd134944e1c2adf0c3921", "ja3_variant_count": 1, "ja3_variants": [ "0f3c4cfef5ecd134944e1c2adf0c3921" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_cf737a04f8b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "cf737a04f8b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-23-13-45-5-27-35-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790238794, "last_seen": 1790238794, "transport": "t", "ja3_hash": "dfda68445f96c5784119bedc1505c63e", "ja3_variant_count": 1, "ja3_variants": [ "dfda68445f96c5784119bedc1505c63e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_d2e569c2fa32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "d2e569c2fa32", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-17613-10-27-65281-35-43-23-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791287552, "last_seen": 1791287552, "transport": "t", "ja3_hash": "10e5e47f891fc517ecadce35827c8abb", "ja3_variant_count": 1, "ja3_variants": [ "10e5e47f891fc517ecadce35827c8abb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_d30b16995409", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "d30b16995409", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-16-43-11-65281-13-5-45-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790123923, "last_seen": 1790123923, "transport": "t", "ja3_hash": "b0e3266a1f2386056d88c5e2cd599f81", "ja3_variant_count": 1, "ja3_variants": [ "b0e3266a1f2386056d88c5e2cd599f81" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_de441c1a6ba5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "de441c1a6ba5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-23-18-17613-11-16-65037-45-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789691742, "last_seen": 1789691742, "transport": "t", "ja3_hash": "d737c3a94d7057580d462a13d9335619", "ja3_variant_count": 1, "ja3_variants": [ "d737c3a94d7057580d462a13d9335619" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_f2a596d33803", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "f2a596d33803", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-45-16-18-17613-23-13-35-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790650475, "last_seen": 1790650475, "transport": "t", "ja3_hash": "29db825977e5f01ad122355d2e6a73f8", "ja3_variant_count": 1, "ja3_variants": [ "29db825977e5f01ad122355d2e6a73f8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_f3d6a55e2045", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "f3d6a55e2045", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-65037-5-43-16-45-27-23-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789617880, "last_seen": 1789617880, "transport": "t", "ja3_hash": "aa81b22a9b324959d2470687f595f5b1", "ja3_variant_count": 1, "ja3_variants": [ "aa81b22a9b324959d2470687f595f5b1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_ff438937620f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "ff438937620f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-13-65281-16-10-23-17613-18-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788655405, "last_seen": 1788655405, "transport": "t", "ja3_hash": "d65e2f35ad65fb58ae0100d2fc5dc1f8", "ja3_variant_count": 1, "ja3_variants": [ "d65e2f35ad65fb58ae0100d2fc5dc1f8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_04c66c06b0db", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "04c66c06b0db", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-5-65037-18-27-45-43-13-35-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789203211, "last_seen": 1789203211, "transport": "t", "ja3_hash": "80a98d061b1d765cafabb6c757b771d1", "ja3_variant_count": 1, "ja3_variants": [ "80a98d061b1d765cafabb6c757b771d1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_0522689629f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "0522689629f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-10-11-18-5-43-27-35-65281-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789058299, "last_seen": 1789058299, "transport": "t", "ja3_hash": "25eda0b30db017ca4631194f48d9a977", "ja3_variant_count": 1, "ja3_variants": [ "25eda0b30db017ca4631194f48d9a977" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_5f99475caf07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "5f99475caf07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-11-35-43-65281-23-65037-17613-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788963763, "last_seen": 1788963763, "transport": "t", "ja3_hash": "8037795f6c54945dc999c1b41142cde6", "ja3_variant_count": 1, "ja3_variants": [ "8037795f6c54945dc999c1b41142cde6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_921bcdcf95ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "921bcdcf95ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-27-17613-35-18-51764-11-43-5-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788743697, "last_seen": 1788743697, "transport": "t", "ja3_hash": "412de6fb0ab1ba3dee5ce8884e9fe9d4", "ja3_variant_count": 1, "ja3_variants": [ "412de6fb0ab1ba3dee5ce8884e9fe9d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_95f5ee969d4f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "95f5ee969d4f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-65281-45-43-17613-10-35-11-13-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788926731, "last_seen": 1788926731, "transport": "t", "ja3_hash": "102436449776dc556a1004a73ea240ae", "ja3_variant_count": 1, "ja3_variants": [ "102436449776dc556a1004a73ea240ae" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_b9eae10a193e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "b9eae10a193e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-43-13-17513-35-5-45-27-23-10-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791103654, "last_seen": 1791103654, "transport": "t", "ja3_hash": "fe08648a1affd480a19d2d2326438547", "ja3_variant_count": 1, "ja3_variants": [ "fe08648a1affd480a19d2d2326438547" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_bdae03bdd9c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "bdae03bdd9c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-18-17613-35-5-13-11-23-51764-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791094028, "last_seen": 1791094028, "transport": "t", "ja3_hash": "2ab18e300158cf4f1d02e58ef4bcff4f", "ja3_variant_count": 1, "ja3_variants": [ "2ab18e300158cf4f1d02e58ef4bcff4f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 29 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_c77802d23cb5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "c77802d23cb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-13-5-45-65037-27-10-43-17613-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790233630, "last_seen": 1790233630, "transport": "t", "ja3_hash": "75144fd89d7e367d0cb837275d799008", "ja3_variant_count": 1, "ja3_variants": [ "75144fd89d7e367d0cb837275d799008" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_e955f738095c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "e955f738095c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-23-35-13-17613-45-5-65037-18-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790348856, "last_seen": 1790348856, "transport": "t", "ja3_hash": "4c2dde86078133fb1e532175789fb385", "ja3_variant_count": 1, "ja3_variants": [ "4c2dde86078133fb1e532175789fb385" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 22 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_f2e17d50a391", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "f2e17d50a391", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-65281-23-13-17613-11-65037-35-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790365477, "last_seen": 1790365477, "transport": "t", "ja3_hash": "18280d212e0f7b820dec36e1d3c01340", "ja3_variant_count": 1, "ja3_variants": [ "18280d212e0f7b820dec36e1d3c01340" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t13i1512h1_8daaf6152771_406d1748e6d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h1", "b": "8daaf6152771", "c": "406d1748e6d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-11-18-23-13-16-65281-27-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790533868, "last_seen": 1790533868, "transport": "t", "ja3_hash": "5608415a6a392a6b64b32670015654ad", "ja3_variant_count": 1, "ja3_variants": [ "5608415a6a392a6b64b32670015654ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h1_8daaf6152771_905fb1c2d849", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h1", "b": "8daaf6152771", "c": "905fb1c2d849", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-23-45-11-43-27-10-65037-13-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790543877, "last_seen": 1790993870, "transport": "t", "ja3_hash": "db428ccc01d10385b7070eb2a8c0982e", "ja3_variant_count": 2, "ja3_variants": [ "db428ccc01d10385b7070eb2a8c0982e", "ba0788489d3bffc3c421c3f072fef771" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h1_8daaf6152771_9844bc18c64b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h1", "b": "8daaf6152771", "c": "9844bc18c64b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-5-10-13-16-43-23-45-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790670794, "last_seen": 1790670794, "transport": "t", "ja3_hash": "7b63062c5be25ead7b3a4ae29b3233ca", "ja3_variant_count": 1, "ja3_variants": [ "7b63062c5be25ead7b3a4ae29b3233ca" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h1_8daaf6152771_d8d5fa773696", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h1", "b": "8daaf6152771", "c": "d8d5fa773696", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-27-43-13-10-11-5-35-65281-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790982139, "last_seen": 1790982139, "transport": "t", "ja3_hash": "53fad81aa266339af6687ad47bae2bac", "ja3_variant_count": 1, "ja3_variants": [ "53fad81aa266339af6687ad47bae2bac" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_069b5e0b9e07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "069b5e0b9e07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-23-10-5-16-65281-65037-43-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790230225, "last_seen": 1790936056, "transport": "t", "ja3_hash": "13388995a1209535e55034a3095b21bb", "ja3_variant_count": 2, "ja3_variants": [ "13388995a1209535e55034a3095b21bb", "57d60760edebdb4478df1b1b47ecda84" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_076585b17c88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "076585b17c88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-27-23-17613-65281-43-5-10-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790472759, "last_seen": 1790472759, "transport": "t", "ja3_hash": "99854e604642fde7de9a9202ca28807d", "ja3_variant_count": 1, "ja3_variants": [ "99854e604642fde7de9a9202ca28807d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_0802f5065f54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "0802f5065f54", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-65281-16-13-27-43-5-65037-18-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790219898, "last_seen": 1790219898, "transport": "t", "ja3_hash": "862f25fe4a41fcf2919e4b78fdb7fca1", "ja3_variant_count": 1, "ja3_variants": [ "862f25fe4a41fcf2919e4b78fdb7fca1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_0b62351ed59b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "0b62351ed59b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-27-11-35-10-23-17613-16-45-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789693032, "last_seen": 1791007009, "transport": "t", "ja3_hash": "9426d9b5115d7393eaee1beca6d7e25b", "ja3_variant_count": 3, "ja3_variants": [ "9426d9b5115d7393eaee1beca6d7e25b", "9972e6e9cb21b525da6fa2b9d6c01687", "826e05e9317820994c19ccc3a6de537b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Android 14; Mobile; rv:135.0) Gecko/135.0 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_14d8095ef68e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "14d8095ef68e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-13-5-35-18-16-43-17613-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790615342, "last_seen": 1790615342, "transport": "t", "ja3_hash": "e9e8e9bd934f26a97006b8e18e8f4f0c", "ja3_variant_count": 1, "ja3_variants": [ "e9e8e9bd934f26a97006b8e18e8f4f0c" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_1f537cf893a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "1f537cf893a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-18-16-65037-10-5-51764-35-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790596621, "last_seen": 1790596621, "transport": "t", "ja3_hash": "1d5a0f8cca83d087be6c62661466fd04", "ja3_variant_count": 1, "ja3_variants": [ "1d5a0f8cca83d087be6c62661466fd04" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_25dc63a7d079", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "25dc63a7d079", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-18-65037-65281-10-27-5-45-35-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789559396, "last_seen": 1789559396, "transport": "t", "ja3_hash": "e3902cb7ababd1b1a5c8b80093789bd9", "ja3_variant_count": 1, "ja3_variants": [ "e3902cb7ababd1b1a5c8b80093789bd9" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_2880e46a471e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "2880e46a471e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-17613-35-23-16-13-11-43-45-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789697932, "last_seen": 1789697932, "transport": "t", "ja3_hash": "fca6724fa60ee0712acb3d474ef22087", "ja3_variant_count": 1, "ja3_variants": [ "fca6724fa60ee0712acb3d474ef22087" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_314dec87a6f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "314dec87a6f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-45-35-16-17613-11-18-13-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789173507, "last_seen": 1789730669, "transport": "t", "ja3_hash": "51b0d4958c80aca03866d74c456ebe62", "ja3_variant_count": 2, "ja3_variants": [ "51b0d4958c80aca03866d74c456ebe62", "01dd0a9b8ae8ef573f7e924afa20572c" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_321feeb7129a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "321feeb7129a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-43-18-27-45-35-65281-17613-65037-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791295658, "last_seen": 1791295658, "transport": "t", "ja3_hash": "6b93895c88dfe831889364b448f46093", "ja3_variant_count": 1, "ja3_variants": [ "6b93895c88dfe831889364b448f46093" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_40744b62e667", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "40744b62e667", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-51764-13-10-45-23-35-17613-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789136977, "last_seen": 1789136977, "transport": "t", "ja3_hash": "aef11ba2fb5fcb061069aba6bc06b658", "ja3_variant_count": 1, "ja3_variants": [ "aef11ba2fb5fcb061069aba6bc06b658" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_42db30e1d14a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "42db30e1d14a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-5-65037-43-16-11-23-18-17613-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788612142, "last_seen": 1788612142, "transport": "t", "ja3_hash": "5ba5c79a76e86ae9d9790e3a5039a331", "ja3_variant_count": 1, "ja3_variants": [ "5ba5c79a76e86ae9d9790e3a5039a331" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_548cebd4523d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "548cebd4523d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-43-13-16-5-65037-45-27-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790750248, "last_seen": 1791015453, "transport": "t", "ja3_hash": "8da3a2e20099b30ff0e6aa297038e272", "ja3_variant_count": 2, "ja3_variants": [ "8da3a2e20099b30ff0e6aa297038e272", "5014a1c4154efe9bb8b1555314d8d29c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_55b1fad10855", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "55b1fad10855", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-35-65281-13-5-43-27-65037-18-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790263069, "last_seen": 1790263069, "transport": "t", "ja3_hash": "59ce84e022d1dd829bc00855f8590231", "ja3_variant_count": 1, "ja3_variants": [ "59ce84e022d1dd829bc00855f8590231" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_5aab2c10a5f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "5aab2c10a5f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-65037-10-18-5-43-13-16-11-23-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791259058, "last_seen": 1791259058, "transport": "t", "ja3_hash": "8b140aa19ac3b6fed9e8d131f68d7bee", "ja3_variant_count": 1, "ja3_variants": [ "8b140aa19ac3b6fed9e8d131f68d7bee" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_5d43a66393ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "5d43a66393ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,27-13-5-65281-10-23-18-16-65037-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790008371, "last_seen": 1790008371, "transport": "t", "ja3_hash": "b835f21b7e50ab5c8d3f6fbb903edd0c", "ja3_variant_count": 1, "ja3_variants": [ "b835f21b7e50ab5c8d3f6fbb903edd0c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 77 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_5dd90af9e70d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "5dd90af9e70d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-35-65281-18-13-43-45-5-16-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789699086, "last_seen": 1789699086, "transport": "t", "ja3_hash": "a7358bc94fbd446f0ee4d01dbba00161", "ja3_variant_count": 1, "ja3_variants": [ "a7358bc94fbd446f0ee4d01dbba00161" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_6ac592c71110", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "6ac592c71110", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-11-65037-5-43-27-65281-16-17513-45-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791259888, "last_seen": 1791259888, "transport": "t", "ja3_hash": "b61ffe2fc08a27295def4d271727fb26", "ja3_variant_count": 1, "ja3_variants": [ "b61ffe2fc08a27295def4d271727fb26" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_6def929c6181", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "6def929c6181", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-18-45-13-10-43-5-65281-35-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790593314, "last_seen": 1790593314, "transport": "t", "ja3_hash": "ebdc2640c74965d29dbba83564cc269b", "ja3_variant_count": 1, "ja3_variants": [ "ebdc2640c74965d29dbba83564cc269b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_72b15e5a8388", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "72b15e5a8388", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-10-16-5-17613-43-65037-23-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789867021, "last_seen": 1789867021, "transport": "t", "ja3_hash": "f1a3cb43c0935735a86a889a52b09863", "ja3_variant_count": 1, "ja3_variants": [ "f1a3cb43c0935735a86a889a52b09863" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 36 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_7b3ea9d21dbf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "7b3ea9d21dbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-23-10-16-35-13-5-43-51764-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791170986, "last_seen": 1791170986, "transport": "t", "ja3_hash": "820a2e50146d173ee741ebcc6d35e623", "ja3_variant_count": 1, "ja3_variants": [ "820a2e50146d173ee741ebcc6d35e623" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_7fa89130f8a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "7fa89130f8a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-13-65037-35-10-16-27-18-17513-45-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791102831, "last_seen": 1791102831, "transport": "t", "ja3_hash": "cfef8901ba793941cfd9828b05b99390", "ja3_variant_count": 1, "ja3_variants": [ "cfef8901ba793941cfd9828b05b99390" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_8a6a3c5a1dee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "8a6a3c5a1dee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-65037-10-27-16-11-65281-45-43-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790201502, "last_seen": 1790201502, "transport": "t", "ja3_hash": "85e380b92a2ac2ba65ffa30692d73c17", "ja3_variant_count": 1, "ja3_variants": [ "85e380b92a2ac2ba65ffa30692d73c17" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_8ae1788f8f1a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "8ae1788f8f1a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-27-10-11-43-17613-13-65281-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789683442, "last_seen": 1789683442, "transport": "t", "ja3_hash": "7c31fd789cebcdc9b3c0446772e8cd8e", "ja3_variant_count": 1, "ja3_variants": [ "7c31fd789cebcdc9b3c0446772e8cd8e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_8c561e63a674", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "8c561e63a674", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-10-18-23-65037-16-13-27-43-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789641609, "last_seen": 1789641609, "transport": "t", "ja3_hash": "b27a2e0b995c234a996974a4a0bdc075", "ja3_variant_count": 1, "ja3_variants": [ "b27a2e0b995c234a996974a4a0bdc075" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_905fb1c2d849", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "905fb1c2d849", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-65037-45-11-43-16-18-13-27-51-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791290772, "last_seen": 1791290772, "transport": "t", "ja3_hash": "ae426f2c0fbf98c48b895415b532a8c8", "ja3_variant_count": 1, "ja3_variants": [ "ae426f2c0fbf98c48b895415b532a8c8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_94bf07b9f22d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "94bf07b9f22d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-17613-23-13-18-65037-65281-16-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241853, "last_seen": 1790241853, "transport": "t", "ja3_hash": "a00b815b245081b25c433aa408762832", "ja3_variant_count": 1, "ja3_variants": [ "a00b815b245081b25c433aa408762832" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_94fd12da2059", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "94fd12da2059", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-65281-45-18-35-16-65037-10-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790532783, "last_seen": 1790532783, "transport": "t", "ja3_hash": "3174196f5da9f1817927d9573c82f5a3", "ja3_variant_count": 1, "ja3_variants": [ "3174196f5da9f1817927d9573c82f5a3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_9a0b73da1260", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "9a0b73da1260", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-35-10-23-11-16-17613-18-43-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790282583, "last_seen": 1790282583, "transport": "t", "ja3_hash": "efe47bf175d98d91381cedeaa5711a3f", "ja3_variant_count": 1, "ja3_variants": [ "efe47bf175d98d91381cedeaa5711a3f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_9a418f01edf6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "9a418f01edf6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-17613-11-5-27-10-16-43-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791145562, "last_seen": 1791145562, "transport": "t", "ja3_hash": "d65b0caa421178bc94ec0b64b2e7ede3", "ja3_variant_count": 1, "ja3_variants": [ "d65b0caa421178bc94ec0b64b2e7ede3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_a0ce574dfe76", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "a0ce574dfe76", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-35-16-17613-18-10-43-65281-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790237240, "last_seen": 1790237240, "transport": "t", "ja3_hash": "a3326e13f335c8abec7be09a96e4aa90", "ja3_variant_count": 1, "ja3_variants": [ "a3326e13f335c8abec7be09a96e4aa90" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_a27a472bf3f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "a27a472bf3f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-17613-27-5-35-23-43-16-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788784125, "last_seen": 1788784125, "transport": "t", "ja3_hash": "0a317674085cecdc1455e4ee0c83e0a4", "ja3_variant_count": 1, "ja3_variants": [ "0a317674085cecdc1455e4ee0c83e0a4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_a3cbdcd74018", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "a3cbdcd74018", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-17613-5-23-27-13-43-18-65281-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788713157, "last_seen": 1788713157, "transport": "t", "ja3_hash": "3402bcaa401c6c293e693594d1dce6cd", "ja3_variant_count": 1, "ja3_variants": [ "3402bcaa401c6c293e693594d1dce6cd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_afe15e8fe743", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "afe15e8fe743", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-16-5-27-10-35-43-17613-18-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788947631, "last_seen": 1788947631, "transport": "t", "ja3_hash": "a657c2eaffd8a52d641581474ae78524", "ja3_variant_count": 1, "ja3_variants": [ "a657c2eaffd8a52d641581474ae78524" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_b44896b5765c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "b44896b5765c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-16-13-45-23-17613-5-11-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789010709, "last_seen": 1789010709, "transport": "t", "ja3_hash": "52dfcb80c6d9bf316fe164a6670ebfe8", "ja3_variant_count": 1, "ja3_variants": [ "52dfcb80c6d9bf316fe164a6670ebfe8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_b4c47126a360", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "b4c47126a360", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-16-5-13-23-45-18-51764-43-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790127160, "last_seen": 1790127160, "transport": "t", "ja3_hash": "732ad7d6a283091770c7d9e9e850b04d", "ja3_variant_count": 1, "ja3_variants": [ "732ad7d6a283091770c7d9e9e850b04d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_b540fccd025c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "b540fccd025c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-13-65281-11-27-45-5-17613-16-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790324453, "last_seen": 1790324453, "transport": "t", "ja3_hash": "dca635a324803a1dc79a66ca0a4e538a", "ja3_variant_count": 1, "ja3_variants": [ "dca635a324803a1dc79a66ca0a4e538a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_bdaf653a0990", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "bdaf653a0990", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-43-17613-65037-65281-45-16-11-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788857369, "last_seen": 1788857369, "transport": "t", "ja3_hash": "1a32ee80b2e2bd2d859adb3138e4879d", "ja3_variant_count": 1, "ja3_variants": [ "1a32ee80b2e2bd2d859adb3138e4879d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_c1357a6d7902", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "c1357a6d7902", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-16-65281-13-10-5-17613-35-43-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788768514, "last_seen": 1788768514, "transport": "t", "ja3_hash": "7a7ea94efb2b4be148e8f6a798cde15c", "ja3_variant_count": 1, "ja3_variants": [ "7a7ea94efb2b4be148e8f6a798cde15c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_d3a4f2133fc5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "d3a4f2133fc5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-5-18-10-11-16-65037-35-17613-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790776273, "last_seen": 1790776273, "transport": "t", "ja3_hash": "6e9d35037a667387fa1ec91293373f17", "ja3_variant_count": 1, "ja3_variants": [ "6e9d35037a667387fa1ec91293373f17" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_d3d06c1a2b11", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "d3d06c1a2b11", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-13-35-27-45-10-17613-43-18-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789656813, "last_seen": 1789656813, "transport": "t", "ja3_hash": "c78545db910e482d7a5f0e45c4091186", "ja3_variant_count": 1, "ja3_variants": [ "c78545db910e482d7a5f0e45c4091186" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_d610619e8ccc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "d610619e8ccc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-27-43-23-13-16-65281-11-17613-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790789246, "last_seen": 1790789246, "transport": "t", "ja3_hash": "8fe35e46babb94ffeb68d609d1b39113", "ja3_variant_count": 1, "ja3_variants": [ "8fe35e46babb94ffeb68d609d1b39113" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_d7d705b48f5f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "d7d705b48f5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-23-11-27-43-45-16-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790264900, "last_seen": 1790264900, "transport": "t", "ja3_hash": "1308bff433461d347651e945a3687621", "ja3_variant_count": 1, "ja3_variants": [ "1308bff433461d347651e945a3687621" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_e6cecc169d63", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "e6cecc169d63", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-23-65037-5-11-13-10-43-27-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790713322, "last_seen": 1790713322, "transport": "t", "ja3_hash": "4dfa5ce62d58355861f0378e8c0e4aaf", "ja3_variant_count": 1, "ja3_variants": [ "4dfa5ce62d58355861f0378e8c0e4aaf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_edbfb4bfc70b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "edbfb4bfc70b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-17513-13-27-65281-16-18-65037-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791107288, "last_seen": 1791107288, "transport": "t", "ja3_hash": "2979d311ce2278086c08aafb257e090d", "ja3_variant_count": 1, "ja3_variants": [ "2979d311ce2278086c08aafb257e090d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_f30706a24caf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "f30706a24caf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-17613-11-27-45-13-5-23-18-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789913531, "last_seen": 1789913531, "transport": "t", "ja3_hash": "9b28ae5c1cd18910f24f82fea081b396", "ja3_variant_count": 1, "ja3_variants": [ "9b28ae5c1cd18910f24f82fea081b396" ], "user_agents": { "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)": 4 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_f3f3d965e2d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "f3f3d965e2d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-23-18-16-35-45-27-65281-43-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790730578, "last_seen": 1790730578, "transport": "t", "ja3_hash": "9b0bc6c90ba5f854a2503c271ef07aee", "ja3_variant_count": 1, "ja3_variants": [ "9b0bc6c90ba5f854a2503c271ef07aee" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_ffa98a2b04df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "ffa98a2b04df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-11-17613-16-65037-13-65281-51764-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790929163, "last_seen": 1790929163, "transport": "t", "ja3_hash": "dc929b1a5e5bf8a12b77b96efdaa7d04", "ja3_variant_count": 1, "ja3_variants": [ "dc929b1a5e5bf8a12b77b96efdaa7d04" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_fff8dac1a6d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "fff8dac1a6d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-18-17513-43-10-11-65037-27-65281-51-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791116878, "last_seen": 1791116878, "transport": "t", "ja3_hash": "61ae8a239a56d239c694ad6677caa2da", "ja3_variant_count": 1, "ja3_variants": [ "61ae8a239a56d239c694ad6677caa2da" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_0a20fe35d3a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "0a20fe35d3a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-13-35-27-10-23-18-5-11-65037-65281-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789630970, "last_seen": 1791298592, "transport": "t", "ja3_hash": "e42b801bcfc70f22f9d929f2cbc1052a", "ja3_variant_count": 5, "ja3_variants": [ "e42b801bcfc70f22f9d929f2cbc1052a", "dffa3b254115b93e3c6f84b18f2dca6b", "bae9c5775d5d8517d7b42ee09c6cfc04", "156c90cfe74364fb69a13a3e6db2f223", "d1b2298520e40bcef72842a986ec276e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_18c85063da7f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "18c85063da7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-35-18-51764-65037-11-45-17613-13-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791306516, "last_seen": 1791306516, "transport": "t", "ja3_hash": "e711f93167dd7601b25f826e574c3981", "ja3_variant_count": 1, "ja3_variants": [ "e711f93167dd7601b25f826e574c3981" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_1cf7308acefb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "1cf7308acefb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-10-35-65037-65281-51764-45-43-27-23-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790739839, "last_seen": 1790739839, "transport": "t", "ja3_hash": "e9ba1ee0f0fedd30ddb7a50f9d02c8f6", "ja3_variant_count": 1, "ja3_variants": [ "e9ba1ee0f0fedd30ddb7a50f9d02c8f6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_22334254f9f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "22334254f9f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-18-23-65281-27-43-45-17613-13-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790163658, "last_seen": 1790459481, "transport": "t", "ja3_hash": "b6a1bf6dea6644da8ff192f422eb5aeb", "ja3_variant_count": 2, "ja3_variants": [ "b6a1bf6dea6644da8ff192f422eb5aeb", "cae4d00696cac0d5d9f44bbca9ff8271" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_31ec0a762479", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "31ec0a762479", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-10-45-17613-65281-11-43-13-23-18-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788778653, "last_seen": 1788778653, "transport": "t", "ja3_hash": "40217d2213567f6fcfa6b3910dff8a82", "ja3_variant_count": 1, "ja3_variants": [ "40217d2213567f6fcfa6b3910dff8a82" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_5c900899d641", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "5c900899d641", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-17613-43-5-23-10-11-65037-27-35-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788767896, "last_seen": 1791077843, "transport": "t", "ja3_hash": "9f4cc5c361e53f94a32542082066b8ed", "ja3_variant_count": 2, "ja3_variants": [ "9f4cc5c361e53f94a32542082066b8ed", "8b8d19e5b0c4a19f6d1ea6624b5eb0a3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_85aec867103e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "85aec867103e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-45-43-35-18-5-17613-11-13-65281-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790334193, "last_seen": 1790334193, "transport": "t", "ja3_hash": "8cf8173741048f7f27a86159c497aa83", "ja3_variant_count": 1, "ja3_variants": [ "8cf8173741048f7f27a86159c497aa83" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_894b42dbeeb7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "894b42dbeeb7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-35-45-51764-43-65037-17613-11-18-23-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791045307, "last_seen": 1791045307, "transport": "t", "ja3_hash": "04fd19a5c57c208e6352e27781e248c5", "ja3_variant_count": 1, "ja3_variants": [ "04fd19a5c57c208e6352e27781e248c5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_95c470eab542", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "95c470eab542", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-45-65281-51-43-11-65037-5-18-10-17513-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791136722, "last_seen": 1791136722, "transport": "t", "ja3_hash": "c3682534df619820b5662bf307e6ed5d", "ja3_variant_count": 1, "ja3_variants": [ "c3682534df619820b5662bf307e6ed5d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_9cfaf37f6d60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "9cfaf37f6d60", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-13-43-23-18-65037-27-5-35-45-10-65281-16,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791259021, "last_seen": 1791259021, "transport": "t", "ja3_hash": "79eec06b388c7c04884ed63a3da40dc4", "ja3_variant_count": 1, "ja3_variants": [ "79eec06b388c7c04884ed63a3da40dc4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_bb32da23ee32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "bb32da23ee32", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-27-43-35-65037-18-11-45-17613-13-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789638662, "last_seen": 1789638662, "transport": "t", "ja3_hash": "d1f0df7111ee1867a59031f706eefb4e", "ja3_variant_count": 1, "ja3_variants": [ "d1f0df7111ee1867a59031f706eefb4e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_cef13e960ec0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "cef13e960ec0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-10-43-18-65037-51764-35-17613-23-65281-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790710605, "last_seen": 1790710605, "transport": "t", "ja3_hash": "97fbf634eb7e40f38e753dc13fa1aa0a", "ja3_variant_count": 1, "ja3_variants": [ "97fbf634eb7e40f38e753dc13fa1aa0a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_e62bcbb35888", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "e62bcbb35888", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65037-23-43-45-17613-18-5-65281-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789638546, "last_seen": 1789638546, "transport": "t", "ja3_hash": "56cb0bf8f1e57753c6679413b0f9f1b8", "ja3_variant_count": 1, "ja3_variants": [ "56cb0bf8f1e57753c6679413b0f9f1b8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_f8ed8b5d7f00", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "f8ed8b5d7f00", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-43-17613-65281-65037-11-35-23-45-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788793833, "last_seen": 1788793833, "transport": "t", "ja3_hash": "1095e9813dce465e1727727a9bf2e44a", "ja3_variant_count": 1, "ja3_variants": [ "1095e9813dce465e1727727a9bf2e44a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_fa32c9c500f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "fa32c9c500f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-65037-17513-13-35-27-43-10-23-18-11-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791262204, "last_seen": 1791262204, "transport": "t", "ja3_hash": "610852731be5c5a7dbd98c036790de0d", "ja3_variant_count": 1, "ja3_variants": [ "610852731be5c5a7dbd98c036790de0d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h1_8daaf6152771_b19c6e2d55b2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h1", "b": "8daaf6152771", "c": "b19c6e2d55b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-18-65037-13-5-23-35-43-27-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790984336, "last_seen": 1790984336, "transport": "t", "ja3_hash": "5f6deea2f3a126695ff4e904a0824494", "ja3_variant_count": 1, "ja3_variants": [ "5f6deea2f3a126695ff4e904a0824494" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h1_8daaf6152771_e512ae5eb6ea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h1", "b": "8daaf6152771", "c": "e512ae5eb6ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-16-23-5-45-13-18-65037-43-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790653140, "last_seen": 1790653140, "transport": "t", "ja3_hash": "733c3a8c041fda6698e8cdce59cb9246", "ja3_variant_count": 1, "ja3_variants": [ "733c3a8c041fda6698e8cdce59cb9246" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h1_8daaf6152771_ea87b60c35d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h1", "b": "8daaf6152771", "c": "ea87b60c35d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-65281-43-13-16-10-45-23-11-65037-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790984835, "last_seen": 1790984835, "transport": "t", "ja3_hash": "ab95455415bf9d2f382d2432e195154a", "ja3_variant_count": 1, "ja3_variants": [ "ab95455415bf9d2f382d2432e195154a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_03929b53ca88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "03929b53ca88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-10-18-17513-35-16-13-5-65281-51-43-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791276885, "last_seen": 1791276885, "transport": "t", "ja3_hash": "5ad28a00e3b436ca75fe2534b5fe2aae", "ja3_variant_count": 1, "ja3_variants": [ "5ad28a00e3b436ca75fe2534b5fe2aae" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_0ed862f43755", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "0ed862f43755", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-23-65037-43-11-16-45-17613-13-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788915436, "last_seen": 1788915436, "transport": "t", "ja3_hash": "825037495ce13d46bbbba06bdcd5c528", "ja3_variant_count": 1, "ja3_variants": [ "825037495ce13d46bbbba06bdcd5c528" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_105b8dac4da1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "105b8dac4da1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-18-65037-17613-5-11-13-43-23-45-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790927419, "last_seen": 1790927419, "transport": "t", "ja3_hash": "41dce63dd76f14333694a22e3deb2f56", "ja3_variant_count": 1, "ja3_variants": [ "41dce63dd76f14333694a22e3deb2f56" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_1cee6357d829", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "1cee6357d829", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-65037-5-18-45-23-13-43-11-27-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790029247, "last_seen": 1790029247, "transport": "t", "ja3_hash": "37b3ed26433ae34be63cf63f27703968", "ja3_variant_count": 1, "ja3_variants": [ "37b3ed26433ae34be63cf63f27703968" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_25466fb6d026", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "25466fb6d026", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-45-43-65281-65037-5-23-17513-18-27-10-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790749293, "last_seen": 1790749293, "transport": "t", "ja3_hash": "28b5fb1772e5e96ff9d30d7b7a163449", "ja3_variant_count": 1, "ja3_variants": [ "28b5fb1772e5e96ff9d30d7b7a163449" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_278844d04171", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "278844d04171", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-11-23-13-35-10-18-16-43-27-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790870245, "last_seen": 1790870245, "transport": "t", "ja3_hash": "46079432f430338fd2f4b16cd36597e7", "ja3_variant_count": 1, "ja3_variants": [ "46079432f430338fd2f4b16cd36597e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_2d6c3a04e7f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "2d6c3a04e7f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-17613-5-23-11-16-43-13-18-65037-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508421, "last_seen": 1788508421, "transport": "t", "ja3_hash": "d35b763d94d8a77bedc31c0044f1d304", "ja3_variant_count": 1, "ja3_variants": [ "d35b763d94d8a77bedc31c0044f1d304" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_2e4a1eb1cf75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "2e4a1eb1cf75", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-51764-10-13-17613-11-27-45-43-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723970, "last_seen": 1788723970, "transport": "t", "ja3_hash": "4fdfd871f1e96e9ec0c75186d879a025", "ja3_variant_count": 1, "ja3_variants": [ "4fdfd871f1e96e9ec0c75186d879a025" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_3372136e8f74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "3372136e8f74", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-65281-23-35-16-11-13-17613-27-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788771923, "last_seen": 1788771923, "transport": "t", "ja3_hash": "ca159706ebf529dac6dd86295c89de5a", "ja3_variant_count": 1, "ja3_variants": [ "ca159706ebf529dac6dd86295c89de5a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_34d57375c2af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "34d57375c2af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-35-17613-65037-43-27-13-5-23-45-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789023426, "last_seen": 1789023426, "transport": "t", "ja3_hash": "f3b4fb2ce421cc71374fe2741f4632a1", "ja3_variant_count": 1, "ja3_variants": [ "f3b4fb2ce421cc71374fe2741f4632a1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_34e813881577", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "34e813881577", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-10-5-17613-16-65037-11-45-27-65281-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790007196, "last_seen": 1790007196, "transport": "t", "ja3_hash": "b0dc088f301a6ebac9c8d9776c7c62c6", "ja3_variant_count": 1, "ja3_variants": [ "b0dc088f301a6ebac9c8d9776c7c62c6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_385cd708f618", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "385cd708f618", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-10-17613-43-13-65037-16-45-35-27-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790411884, "last_seen": 1790411884, "transport": "t", "ja3_hash": "cb147e570b9187501b7284f834c44300", "ja3_variant_count": 1, "ja3_variants": [ "cb147e570b9187501b7284f834c44300" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_3ee1b7216851", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "3ee1b7216851", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-13-65281-10-16-11-18-17613-27-43-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789740590, "last_seen": 1791135763, "transport": "t", "ja3_hash": "6df36ed3e7113c2e1ba2e83f055fc024", "ja3_variant_count": 3, "ja3_variants": [ "6df36ed3e7113c2e1ba2e83f055fc024", "bcb7f229057fee42117fa36e3059d75e", "1688abd439c7f824d43a5bfe4a0ae1a8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_55f8212217b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "55f8212217b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-11-35-45-65037-65281-23-18-16-5-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789889307, "last_seen": 1789889307, "transport": "t", "ja3_hash": "47fd86c8fd0d17856381dc4934dc13b6", "ja3_variant_count": 1, "ja3_variants": [ "47fd86c8fd0d17856381dc4934dc13b6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_5aed99a4ef7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "5aed99a4ef7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-11-65281-16-27-5-17613-10-18-13-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790262990, "last_seen": 1791036658, "transport": "t", "ja3_hash": "9a94b04ccc4dc42c9cc11c7730210b96", "ja3_variant_count": 2, "ja3_variants": [ "9a94b04ccc4dc42c9cc11c7730210b96", "fe154d80280cd16367818ff49aed2c51" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_5ba53e51277a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "5ba53e51277a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-65281-11-35-45-16-65037-43-18-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788794433, "last_seen": 1790743066, "transport": "t", "ja3_hash": "fee11f53b61baf8a96371502cbab7e4f", "ja3_variant_count": 2, "ja3_variants": [ "fee11f53b61baf8a96371502cbab7e4f", "ed8f136e0b4d7d8ab5c5f19789246f1e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 20, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_5ee0680c44f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "5ee0680c44f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-18-10-5-35-43-65037-45-13-27-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790220200, "last_seen": 1790220200, "transport": "t", "ja3_hash": "1517c57098d666131ff1f7f9f16f1503", "ja3_variant_count": 1, "ja3_variants": [ "1517c57098d666131ff1f7f9f16f1503" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_60ab0ccb5268", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "60ab0ccb5268", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-35-18-65037-23-5-16-10-43-27-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077538, "last_seen": 1791077538, "transport": "t", "ja3_hash": "bd821d91b7598604c97ddf0b820f29ce", "ja3_variant_count": 1, "ja3_variants": [ "bd821d91b7598604c97ddf0b820f29ce" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 11 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_669ff8a3d9ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "669ff8a3d9ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-45-23-43-16-11-10-65037-18-27-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788643325, "last_seen": 1788643325, "transport": "t", "ja3_hash": "5f7c3b8e8b58fece3c021921d267f31c", "ja3_variant_count": 1, "ja3_variants": [ "5f7c3b8e8b58fece3c021921d267f31c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_6b70568a5e7a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "6b70568a5e7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-17613-43-27-16-13-10-5-11-65281-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791146915, "last_seen": 1791146915, "transport": "t", "ja3_hash": "c82777559e98c8f333087bf44ea4fcca", "ja3_variant_count": 1, "ja3_variants": [ "c82777559e98c8f333087bf44ea4fcca" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 14 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_712e6e1dcad8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "712e6e1dcad8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-16-13-17613-23-10-45-5-11-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790274374, "last_seen": 1790728341, "transport": "t", "ja3_hash": "b6990a009bf086a5fe521af046a2182d", "ja3_variant_count": 2, "ja3_variants": [ "b6990a009bf086a5fe521af046a2182d", "ae5a27668939c2afa5d315ffa146f0f3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_7dc829385eb9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "7dc829385eb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-23-45-35-18-13-43-27-10-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789909235, "last_seen": 1789909235, "transport": "t", "ja3_hash": "14141bbf9ab14f1d6bfde2f6a8f9141e", "ja3_variant_count": 1, "ja3_variants": [ "14141bbf9ab14f1d6bfde2f6a8f9141e" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_88efbe479c48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "88efbe479c48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-5-10-27-18-45-65281-16-13-17613-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789688736, "last_seen": 1789688736, "transport": "t", "ja3_hash": "9c5f5c020c88a1208a8d18fd4530af53", "ja3_variant_count": 1, "ja3_variants": [ "9c5f5c020c88a1208a8d18fd4530af53" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_8d6ddd5b6d9d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "8d6ddd5b6d9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-16-27-10-11-35-65281-43-13-51764-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790582950, "last_seen": 1790582950, "transport": "t", "ja3_hash": "018208371678bdeeff51c63e2054b803", "ja3_variant_count": 1, "ja3_variants": [ "018208371678bdeeff51c63e2054b803" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_94d536d63997", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "94d536d63997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-43-16-18-17613-65037-13-10-45-65281-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790313421, "last_seen": 1790313421, "transport": "t", "ja3_hash": "66936a46b4eea4c51b882386a363280a", "ja3_variant_count": 1, "ja3_variants": [ "66936a46b4eea4c51b882386a363280a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 37 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_9e2d1ce52865", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "9e2d1ce52865", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-18-45-35-16-23-17613-11-65037-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730748, "last_seen": 1789730748, "transport": "t", "ja3_hash": "344239cac435829da596bba3a2df96a4", "ja3_variant_count": 1, "ja3_variants": [ "344239cac435829da596bba3a2df96a4" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/133.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_ab3bc60c7b5b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "ab3bc60c7b5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-13-17613-65281-27-10-18-35-5-65037-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790467349, "last_seen": 1791135132, "transport": "t", "ja3_hash": "0b72ff67d32ab287bfb8e0e5525358f7", "ja3_variant_count": 2, "ja3_variants": [ "0b72ff67d32ab287bfb8e0e5525358f7", "b42a321243f209dd2f26243858856db2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.0.0 Mobile/15E148 Safari/604.1": 2 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_afb0d6126337", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "afb0d6126337", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-35-5-11-13-18-43-65037-27-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789415759, "last_seen": 1789415759, "transport": "t", "ja3_hash": "7808acbb987e937858a80a2209720774", "ja3_variant_count": 1, "ja3_variants": [ "7808acbb987e937858a80a2209720774" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_b94ac9c5b0ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "b94ac9c5b0ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-43-17613-13-27-5-23-18-45-35-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789685766, "last_seen": 1789685766, "transport": "t", "ja3_hash": "062f641f254cf4fd90e32d71e3ee7c75", "ja3_variant_count": 1, "ja3_variants": [ "062f641f254cf4fd90e32d71e3ee7c75" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_c9c71d79e7e3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "c9c71d79e7e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-65037-43-65281-23-16-5-45-27-11-13-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106707, "last_seen": 1791106707, "transport": "t", "ja3_hash": "28e55ef4ccace03ec1c006057c4b71cb", "ja3_variant_count": 1, "ja3_variants": [ "28e55ef4ccace03ec1c006057c4b71cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_cee511fb5f8f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "cee511fb5f8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-18-35-17613-13-16-65037-23-11-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790264941, "last_seen": 1790264941, "transport": "t", "ja3_hash": "568ecc9393266e6a6e3828db677ac82b", "ja3_variant_count": 1, "ja3_variants": [ "568ecc9393266e6a6e3828db677ac82b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_cf1e56258f61", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "cf1e56258f61", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-65037-10-16-35-23-27-5-13-18-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790007213, "last_seen": 1790007213, "transport": "t", "ja3_hash": "3759280aa22fe3b4f0d049ef28fc9ee9", "ja3_variant_count": 1, "ja3_variants": [ "3759280aa22fe3b4f0d049ef28fc9ee9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_d3357955bef7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "d3357955bef7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-10-45-43-35-65281-11-23-5-51764-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791260268, "last_seen": 1791260268, "transport": "t", "ja3_hash": "e462eeeeaafccd6f319169c1b1bc8472", "ja3_variant_count": 1, "ja3_variants": [ "e462eeeeaafccd6f319169c1b1bc8472" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_d38ba523880f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "d38ba523880f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-35-10-65037-65281-18-27-23-16-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789656764, "last_seen": 1789656764, "transport": "t", "ja3_hash": "793f6059e400085bf6bca3fce6adcb81", "ja3_variant_count": 1, "ja3_variants": [ "793f6059e400085bf6bca3fce6adcb81" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_e8aea5e497cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "e8aea5e497cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-11-35-17613-65281-13-27-65037-5-45-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789690404, "last_seen": 1789690404, "transport": "t", "ja3_hash": "f8e16c5fe20089e943a8f7ee5939af43", "ja3_variant_count": 1, "ja3_variants": [ "f8e16c5fe20089e943a8f7ee5939af43" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_ea87b60c35d6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "ea87b60c35d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-13-11-35-45-65037-23-27-16-43-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790750174, "last_seen": 1790750174, "transport": "t", "ja3_hash": "1b7ccaa4dc5b13851a053b66bcd76f8e", "ja3_variant_count": 1, "ja3_variants": [ "1b7ccaa4dc5b13851a053b66bcd76f8e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_ed206f18ca9c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "ed206f18ca9c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-65037-27-13-16-17613-11-18-35-45-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789656695, "last_seen": 1789656695, "transport": "t", "ja3_hash": "e484e787735aace8d6ea599783dc4eeb", "ja3_variant_count": 1, "ja3_variants": [ "e484e787735aace8d6ea599783dc4eeb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_f43814a5f4ac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "f43814a5f4ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-18-16-45-5-43-35-13-17613-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789741395, "last_seen": 1789741395, "transport": "t", "ja3_hash": "52ee3b437e33c13c2455ec0993e2331f", "ja3_variant_count": 1, "ja3_variants": [ "52ee3b437e33c13c2455ec0993e2331f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_f893012ceb1b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "f893012ceb1b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-65281-10-16-5-18-35-43-27-45-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790084972, "last_seen": 1790084972, "transport": "t", "ja3_hash": "44a6419d335a62d3816624e0632e3e8d", "ja3_variant_count": 1, "ja3_variants": [ "44a6419d335a62d3816624e0632e3e8d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1 }, "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_fa32c9c500f3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "fa32c9c500f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-65281-18-11-23-35-13-43-17513-10-65037-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791263491, "last_seen": 1791263491, "transport": "t", "ja3_hash": "e690aac9181e652fbf49671e20be0c78", "ja3_variant_count": 1, "ja3_variants": [ "e690aac9181e652fbf49671e20be0c78" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_0d6de8fc4c94", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "0d6de8fc4c94", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-23-11-43-18-51-45-65037-27-13-35-65281-5-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791151644, "last_seen": 1791151644, "transport": "t", "ja3_hash": "a44fab09b920f8add79ad9f4ae135584", "ja3_variant_count": 1, "ja3_variants": [ "a44fab09b920f8add79ad9f4ae135584" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_2c46fa88178b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "2c46fa88178b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-35-65037-27-11-65281-5-13-23-10-43-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790775699, "last_seen": 1790775699, "transport": "t", "ja3_hash": "0e5bf60d903919d3547eb2c384b35ca2", "ja3_variant_count": 1, "ja3_variants": [ "0e5bf60d903919d3547eb2c384b35ca2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_536ae4be68ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "536ae4be68ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-11-65281-18-13-51764-27-43-35-10-65037-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788776774, "last_seen": 1788776774, "transport": "t", "ja3_hash": "f7025790310a275446071146436ae85f", "ja3_variant_count": 1, "ja3_variants": [ "f7025790310a275446071146436ae85f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_68a132d176ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "68a132d176ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51764-27-65037-18-43-23-65281-17613-10-45-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811232, "last_seen": 1788811232, "transport": "t", "ja3_hash": "c18c892fcbd8bba406281dccbdd189c3", "ja3_variant_count": 1, "ja3_variants": [ "c18c892fcbd8bba406281dccbdd189c3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_a020cb67ec98", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "a020cb67ec98", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-27-11-35-51764-65281-13-10-45-5-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789749887, "last_seen": 1789749887, "transport": "t", "ja3_hash": "942551ec557d79cda22ff7e631edca43", "ja3_variant_count": 1, "ja3_variants": [ "942551ec557d79cda22ff7e631edca43" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_d8a2da3f94cd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "d8a2da3f94cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-17613-27-10-65281-43-11-65037-23-18-35-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789023254, "last_seen": 1790655467, "transport": "t", "ja3_hash": "cc4f5f44f9ed5b795cd99f70f7189f84", "ja3_variant_count": 3, "ja3_variants": [ "cc4f5f44f9ed5b795cd99f70f7189f84", "e4aef6f5939dd35c693c5314b53d74ff", "8d3ad82e856538daf09de1a8b5466b67" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 9 }, "ua_disagreement": true } }, { "hash": "t13i1514h1_8daaf6152771_46b71f6274ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h1", "b": "8daaf6152771", "c": "46b71f6274ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-16-65037-5-10-18-11-65281-27-13-43-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790545845, "last_seen": 1790993152, "transport": "t", "ja3_hash": "dc4ca04bc455f404b9aaa92bf0c35bfc", "ja3_variant_count": 2, "ja3_variants": [ "dc4ca04bc455f404b9aaa92bf0c35bfc", "81de0e2f119d52b629583724e95f5b41" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_096c65dec9c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "096c65dec9c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-65037-10-16-13-43-45-23-27-5-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789769181, "last_seen": 1790348548, "transport": "t", "ja3_hash": "2f130b69876f7177ae4af07758323677", "ja3_variant_count": 3, "ja3_variants": [ "2f130b69876f7177ae4af07758323677", "61a21c1ad13bbb7ed7ad1ee6a5644213", "772700d84d7de96c40d7ff0c65f7606d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_0ed4dee2b837", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "0ed4dee2b837", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-43-27-11-65037-45-18-13-17613-35-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789693002, "last_seen": 1789693002, "transport": "t", "ja3_hash": "152a1f5bfbe45ec24a7a4fc42160f9db", "ja3_variant_count": 1, "ja3_variants": [ "152a1f5bfbe45ec24a7a4fc42160f9db" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_153e41bb36c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "153e41bb36c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-27-13-35-11-10-5-43-18-17613-23-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789262281, "last_seen": 1791229630, "transport": "t", "ja3_hash": "a55be42e37c7a6a031ff7c36b4859f9a", "ja3_variant_count": 5, "ja3_variants": [ "a55be42e37c7a6a031ff7c36b4859f9a", "e671071cd7e1328aea32eba887e22991", "c583c26f2e31875bcd0f2c869fac1eaa", "cc94cc49d424809b321854e02b165534", "94289dbd22558e9161bac6b34aba45ee" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_180dd6db4882", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "180dd6db4882", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-11-13-17613-18-43-16-65281-65037-35-5-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791134318, "last_seen": 1791134318, "transport": "t", "ja3_hash": "a5fde0a5da9e6024abd3b75eb59018f6", "ja3_variant_count": 1, "ja3_variants": [ "a5fde0a5da9e6024abd3b75eb59018f6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_1f79d9de9ba2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "1f79d9de9ba2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-27-35-11-13-10-5-18-43-23-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790212856, "last_seen": 1791305710, "transport": "t", "ja3_hash": "d4df06e7596f22e22675f74bdcc39195", "ja3_variant_count": 3, "ja3_variants": [ "d4df06e7596f22e22675f74bdcc39195", "50b212f470522288761cb2047a5eeb1d", "8441a184f8632db8f6cab85225c5db55" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_26fa00c0f94a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "26fa00c0f94a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-23-43-13-11-10-27-5-17613-51764-35-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790673916, "last_seen": 1790673916, "transport": "t", "ja3_hash": "f6195d49a0b79b08d76a6ddf97476156", "ja3_variant_count": 1, "ja3_variants": [ "f6195d49a0b79b08d76a6ddf97476156" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_2e05dfedd250", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "2e05dfedd250", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-11-65037-16-10-5-27-35-23-17513-45-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791077703, "last_seen": 1791077703, "transport": "t", "ja3_hash": "703443d940847535cb430f805bf613d6", "ja3_variant_count": 1, "ja3_variants": [ "703443d940847535cb430f805bf613d6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_30188a0c13d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "30188a0c13d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-27-10-18-23-51-16-43-35-65281-11-45-5-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791153916, "last_seen": 1791153916, "transport": "t", "ja3_hash": "8965e1e10d8c7efe8adb4f019454b4b2", "ja3_variant_count": 1, "ja3_variants": [ "8965e1e10d8c7efe8adb4f019454b4b2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_3ffa1e88bf3d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "3ffa1e88bf3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-43-11-35-65037-5-17613-45-18-23-65281-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789849788, "last_seen": 1791192397, "transport": "t", "ja3_hash": "58d6dc6a3506bf7f9a31877a42c3d5e8", "ja3_variant_count": 7, "ja3_variants": [ "58d6dc6a3506bf7f9a31877a42c3d5e8", "e9e761f5fd79dc192d7d4a2c09ce5cd6", "cc302d3515ea7e63a82f751e81400020", "cb9c4b5a1bfeb83a5530f4b6e3431eef", "934a80290f221edb60f538e3d0cb8ddb", "547bc707dc3da6c0da443112bda70c51", "543e497523be15efbcf5a1aa9db9d177" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_46b71f6274ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "46b71f6274ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-16-11-65281-13-65037-35-23-5-27-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788643117, "last_seen": 1791183546, "transport": "t", "ja3_hash": "4c70a8bb75f728e089fc4e6c0b00182d", "ja3_variant_count": 3, "ja3_variants": [ "4c70a8bb75f728e089fc4e6c0b00182d", "68e5b9f401c5f26010aa9b4ac975adf4", "d23741a21a0ceaf826c5280e7bf1e69a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8, "Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_46df87c938ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "46df87c938ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-11-18-35-27-43-13-45-51764-23-16-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790049240, "last_seen": 1790049240, "transport": "t", "ja3_hash": "1aaf0002a4b1feb3014cb0fd5f3a11c1", "ja3_variant_count": 1, "ja3_variants": [ "1aaf0002a4b1feb3014cb0fd5f3a11c1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_5cd5205d8de2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "5cd5205d8de2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-65037-45-10-43-27-17613-5-11-16-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789482695, "last_seen": 1790870168, "transport": "t", "ja3_hash": "df91559e44c0d3de100f0a481af4d36b", "ja3_variant_count": 4, "ja3_variants": [ "df91559e44c0d3de100f0a481af4d36b", "038247f871d5049eb0fef0bbe3ca5237", "c4d6ac0284ad86a91adf32d49f75f8c1", "1787c3e389625abcece7eb44cd26840c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_62f05041f2ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "62f05041f2ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-10-11-35-16-5-13-18-51-45-43-27-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 469, "first_seen": 1789217704, "last_seen": 1791183599, "transport": "t", "ja3_hash": "b592adaa596bb72a5c1ccdbecae52e3f", "ja3_variant_count": 1, "ja3_variants": [ "b592adaa596bb72a5c1ccdbecae52e3f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_6bcda4b8d96d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "6bcda4b8d96d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-23-17613-11-5-18-65281-65037-16-27-13-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791229702, "last_seen": 1791229702, "transport": "t", "ja3_hash": "2e15e090b1c8e6e1520a8ca5b1dec1dc", "ja3_variant_count": 1, "ja3_variants": [ "2e15e090b1c8e6e1520a8ca5b1dec1dc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_856caef005a9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "856caef005a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-18-65037-45-51764-13-10-17613-16-11-27-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789375381, "last_seen": 1789375381, "transport": "t", "ja3_hash": "62a7bb0da3d0d04437279d644af156e5", "ja3_variant_count": 1, "ja3_variants": [ "62a7bb0da3d0d04437279d644af156e5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_988075c57bf4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "988075c57bf4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-45-5-11-27-43-35-65037-18-17613-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788692685, "last_seen": 1791135415, "transport": "t", "ja3_hash": "1b7d5e7061c80e494dcd5f7842381f85", "ja3_variant_count": 6, "ja3_variants": [ "1b7d5e7061c80e494dcd5f7842381f85", "8343f7a5487ab3a7e60395ad6a6a5287", "ff86adb285dcb7afb36fd32f8f062098", "34a4ad6f9b34de28f1f763c6ae70e55b", "49573f2ed5c23f046e063a32bbf4bc7b", "e96f490e4d854581ee7633a3d0ba0fba" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 8, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/133.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13i1514h2_8daaf6152771_a0e623ada22a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "a0e623ada22a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-51764-13-4832-16-11-35-27-10-5-65281-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788445298, "last_seen": 1788445298, "transport": "t", "ja3_hash": "0030145063d581c229f0a0ea11903d22", "ja3_variant_count": 1, "ja3_variants": [ "0030145063d581c229f0a0ea11903d22" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_b6d2a69269a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "b6d2a69269a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-23-5-27-35-11-43-16-18-10-4832-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790929435, "last_seen": 1790929435, "transport": "t", "ja3_hash": "6b9689e43ed5ef8df72c668a4561cbc9", "ja3_variant_count": 1, "ja3_variants": [ "6b9689e43ed5ef8df72c668a4561cbc9" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_cbaf8605387a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "cbaf8605387a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-35-65037-65281-17613-11-43-45-13-18-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790910279, "last_seen": 1790910279, "transport": "t", "ja3_hash": "9f6455e74de13d1ff7a91276337cc6db", "ja3_variant_count": 1, "ja3_variants": [ "9f6455e74de13d1ff7a91276337cc6db" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_e2c23eb4a1f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "e2c23eb4a1f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-45-13-16-5-51764-10-35-65037-18-43-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791105031, "last_seen": 1791105031, "transport": "t", "ja3_hash": "89371a607415a7a4b1cd0abebb0e583d", "ja3_variant_count": 1, "ja3_variants": [ "89371a607415a7a4b1cd0abebb0e583d" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t13i151500_8daaf6152771_937be626dbce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151500", "b": "8daaf6152771", "c": "937be626dbce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-35-17613-18-10-13-43-45-11-27-65037-51764-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790707980, "last_seen": 1790707980, "transport": "t", "ja3_hash": "45cd8890a5d2b066370cea431ad85851", "ja3_variant_count": 1, "ja3_variants": [ "45cd8890a5d2b066370cea431ad85851" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_038797f4dd52", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "038797f4dd52", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-17513-45-5-10-16-65037-11-35-27-43-13-51-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791281200, "last_seen": 1791281200, "transport": "t", "ja3_hash": "5598d691958336f67337e0f61366a36c", "ja3_variant_count": 1, "ja3_variants": [ "5598d691958336f67337e0f61366a36c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_04685d2a9ae2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "04685d2a9ae2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-13-5-45-43-35-16-51764-23-17613-11-18-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790257105, "last_seen": 1790257105, "transport": "t", "ja3_hash": "de8e6f9256d5933acabff1daf416cf64", "ja3_variant_count": 1, "ja3_variants": [ "de8e6f9256d5933acabff1daf416cf64" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_08bc4eb3fb8f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "08bc4eb3fb8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-45-65037-27-13-17613-16-51764-18-5-43-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790787654, "last_seen": 1791122022, "transport": "t", "ja3_hash": "ed09aa51036a74c8ff1d34e9341b5ea2", "ja3_variant_count": 2, "ja3_variants": [ "ed09aa51036a74c8ff1d34e9341b5ea2", "30238f8dd68e0f42d6870b3db3f90332" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_0aed32fb2910", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "0aed32fb2910", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-35-45-11-10-65037-13-27-51-43-23-18-17513-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 48, "first_seen": 1788446834, "last_seen": 1791317081, "transport": "t", "ja3_hash": "132f7293f9a1abd8c4ff0b5b87775616", "ja3_variant_count": 48, "ja3_variants": [ "132f7293f9a1abd8c4ff0b5b87775616", "d88cf0a6514d308de944ff34a99505df", "721c15b8f0e5274778297751a3ecee9b", "0826fce86cfab7834fb9d1f422779611", "75baf5ddd502384a14758ef52e959792", "1d712d5aab13d9e1e7df273b9637fed0", "a20fa7ae3594ad39dd733e10795e06bb", "6fd23c7e71743b68886aa8bd79d51c68", "c96e9a7ce932a7a1c5b854e48a839808", "d8f83ee1b7e52c4a856792756dd176e8", "6abc06bfa270149bdbfbecd686c5c009", "3f68d1c69ada1a82a414a6de394038a7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_171db593f1f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "171db593f1f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-10-13-23-65037-35-18-65281-17513-51-16-43-5-0,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790945295, "last_seen": 1790945295, "transport": "t", "ja3_hash": "827f6f8521c3164e717384de1075efd0", "ja3_variant_count": 1, "ja3_variants": [ "827f6f8521c3164e717384de1075efd0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_1c2f3143de88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "1c2f3143de88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-17613-43-13-45-35-65281-11-27-10-65037-51764-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724233, "last_seen": 1788724233, "transport": "t", "ja3_hash": "f579fa4f35268650ff74b696ba2b1221", "ja3_variant_count": 1, "ja3_variants": [ "f579fa4f35268650ff74b696ba2b1221" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_26ef7d1cfc0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "26ef7d1cfc0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-65037-43-11-17513-27-5-23-13-16-45-51-10-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791106048, "last_seen": 1791119060, "transport": "t", "ja3_hash": "0a4908068cbe1547ecdec32fbae5487c", "ja3_variant_count": 2, "ja3_variants": [ "0a4908068cbe1547ecdec32fbae5487c", "ed9845aa63b174f3f91db6245669bc68" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_8146d5b95523", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "8146d5b95523", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-11-23-51764-45-65037-16-13-10-35-5-43-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790361981, "last_seen": 1790361981, "transport": "t", "ja3_hash": "31c09100bc7b544f8bec9104b4df5a47", "ja3_variant_count": 1, "ja3_variants": [ "31c09100bc7b544f8bec9104b4df5a47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 26 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_94970d5e44e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "94970d5e44e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-18-65281-35-5-43-11-65037-51764-27-45-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790253568, "last_seen": 1790253568, "transport": "t", "ja3_hash": "e6a3c6322453ae2b43aea19d4c3ccb9e", "ja3_variant_count": 1, "ja3_variants": [ "e6a3c6322453ae2b43aea19d4c3ccb9e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_9dfc7e35eb88", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "9dfc7e35eb88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-43-18-11-35-13-65037-16-10-45-23-27-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790167828, "last_seen": 1790167828, "transport": "t", "ja3_hash": "bee47cbd10264f12c09b7b75d45beee4", "ja3_variant_count": 1, "ja3_variants": [ "bee47cbd10264f12c09b7b75d45beee4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_c4c7b5080d5e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "c4c7b5080d5e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-51764-45-23-5-65281-11-65037-43-17613-35-13-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790312590, "last_seen": 1790312590, "transport": "t", "ja3_hash": "13a66676d8ed881e0016f99ba5c674a7", "ja3_variant_count": 1, "ja3_variants": [ "13a66676d8ed881e0016f99ba5c674a7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_d7f4947ee382", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "d7f4947ee382", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-45-65281-51-17613-16-43-11-5-18-27-35-10-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1788648468, "last_seen": 1791282042, "transport": "t", "ja3_hash": "956dd537f2901cb653293cdd97e11c11", "ja3_variant_count": 13, "ja3_variants": [ "956dd537f2901cb653293cdd97e11c11", "a0712aaf9936969b1c756385223e5a1a", "f1ec14204ce53936f287cf36a97039e9", "2f6ef93fd50d85d8e122a134d1f85b34", "660c59d117bf2c99846c981c0af5f06f", "52e8b9c93795bb0f21a3c605c96098a1", "7c0edfffbd953fb7a89f9089bb4521ef", "532f44d2e9641673d1d33282c39dea58", "07fd87e6e767b61dcf16c4946e4d57eb", "1a8999d24d13cfb4ccfa77e5553325b0", "2f66b9653f64528381e3a508221adb93", "fdcf9cc44ca61c5c97bfda846aa3ef2d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 13, "RootEvidence/1.0": 5, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_e7af7bef3b92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "e7af7bef3b92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-11-10-51764-65281-43-16-18-5-13-27-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790977963, "last_seen": 1790977963, "transport": "t", "ja3_hash": "f078c7345cfc0bc1200ce18f869da5c9", "ja3_variant_count": 1, "ja3_variants": [ "f078c7345cfc0bc1200ce18f869da5c9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_e8cf875cb774", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "e8cf875cb774", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-27-65281-45-35-10-16-5-13-17613-43-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790730215, "last_seen": 1790730215, "transport": "t", "ja3_hash": "591a7b1f86761592fb4f5061842ea186", "ja3_variant_count": 1, "ja3_variants": [ "591a7b1f86761592fb4f5061842ea186" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_fccf9dc7fe97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "fccf9dc7fe97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-13-10-11-17613-45-65281-51-43-5-65037-23-16-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 309, "first_seen": 1788681442, "last_seen": 1791306252, "transport": "t", "ja3_hash": "66899d259a53b3739e9dbd86e86caf6f", "ja3_variant_count": 309, "ja3_variants": [ "66899d259a53b3739e9dbd86e86caf6f", "7c188b3002003eb91b88dbc0fd30c72c", "420c40738665b81485a3acf062b684f1", "5637280369088de5cd4f195cd2df629f", "0527c2ad361a8eb0c4ed98e21ee6a987", "1b1ed5c58939bf2a3c55f5ce0cd8159b", "b695c043c09bff17aef1695cf7eb6bf0", "c233e0ea626241d596be865d31649908", "fec282085a2f5fc338a9f2769886a7fd", "942b40035da955428852d390a20382c7", "28f195d987f73d3b5f40e121be8e5038", "047dfee34a42c4b8ede58e501b57ee67" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15": 10, "Mozilla/5.0 (iPad; CPU OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 YaBrowser/25.2.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0": 11, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0": 3, "Mozilla/5.0 (X11; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0": 6, "Mozilla/5.0 (Linux; Android 14; SM-G991B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/25.0 Chrome/121.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 5, "Go-http-client/2.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 36, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 YaBrowser/25.1.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0": 7, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 4, "Mozilla/5.0 (compatible; ForestEngine/1.0; +https://forestengine.net/)": 20, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Vivaldi/7.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Android 14; Mobile; rv:136.0) Gecko/136.0 Firefox/136.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0": 2, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Vivaldi/7.1": 4, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 OPR/118.0.0.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 3, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/134.0.0.0 Mobile/15E148 Safari/604.1": 2, "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15": 4, "Mozilla/5.0 (Android 14; Mobile; rv:135.0) Gecko/135.0 Firefox/135.0": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 13; SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Mobile Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:135.0) Gecko/20100101 Firefox/135.0": 1, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/133.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15": 3, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 1, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0": 2, "Mozilla/5.0 (Linux; Android 14; SM-S928B) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Mobile Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 OPR/119.0.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13i1516h2_8daaf6152771_499011852565", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1516h2", "b": "8daaf6152771", "c": "499011852565", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-23-5-43-35-18-17613-13-16-65037-27-11-51764-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790313417, "last_seen": 1790313417, "transport": "t", "ja3_hash": "dc008acde43a7d7ccdc3322ac15fdfa1", "ja3_variant_count": 1, "ja3_variants": [ "dc008acde43a7d7ccdc3322ac15fdfa1" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 164 }, "ua_disagreement": false } }, { "hash": "t13i1516h2_8daaf6152771_514c4cb7e480", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1516h2", "b": "8daaf6152771", "c": "514c4cb7e480", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-27-65037-45-5-11-18-13-43-10-65281-51764-23-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790525647, "last_seen": 1790525647, "transport": "t", "ja3_hash": "beb5523cae28ef9703dfd6b712d1489e", "ja3_variant_count": 1, "ja3_variants": [ "beb5523cae28ef9703dfd6b712d1489e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t13i1516h2_8daaf6152771_9fd9352597e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1516h2", "b": "8daaf6152771", "c": "9fd9352597e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-45-10-18-11-23-5-13-27-16-65281-17513-35-51-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1791102843, "last_seen": 1791259547, "transport": "t", "ja3_hash": "b3520f6d48af880a85e20b43e088d29a", "ja3_variant_count": 5, "ja3_variants": [ "b3520f6d48af880a85e20b43e088d29a", "9c4c9a9fcf14ecc67124e56e719fa7d7", "17b005ba75535acc21e7e90639a80b66", "fd8ff7eadcd08aa8db2df27070aa72e7", "1ab165bec3d073e661d4339e349732f7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1516h2_8daaf6152771_c7478e11fc06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1516h2", "b": "8daaf6152771", "c": "c7478e11fc06", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-10-16-43-5-17613-23-65037-18-11-13-51764-35-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791093095, "last_seen": 1791093095, "transport": "t", "ja3_hash": "a9ae8472aeb7e4567fe7c63c376401a2", "ja3_variant_count": 1, "ja3_variants": [ "a9ae8472aeb7e4567fe7c63c376401a2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i171000_ab0a1bf427ad_8e6e362c5eac", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i171000", "b": "ab0a1bf427ad", "c": "8e6e362c5eac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 120, "first_seen": 1790505116, "last_seen": 1790785272, "transport": "t", "ja3_hash": "dbb158bbf02cb040164d288c9b1d8492", "ja3_variant_count": 1, "ja3_variants": [ "dbb158bbf02cb040164d288c9b1d8492" ], "user_agents": { "curl/8.7.1": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 27 }, "ua_disagreement": true } }, { "hash": "t13i1711ht_ab0a1bf427ad_703f33515997", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1711ht", "b": "ab0a1bf427ad", "c": "703f33515997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 20, "first_seen": 1788124841, "last_seen": 1791135731, "transport": "t", "ja3_hash": "fb0c9cea0478d6132076f4cdcb0d5224", "ja3_variant_count": 1, "ja3_variants": [ "fb0c9cea0478d6132076f4cdcb0d5224" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1713h2_5b57614c22b0_9f4fbefdc738", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1713h2", "b": "5b57614c22b0", "c": "9f4fbefdc738", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,28-10-13-43-18-23-27-5-11-65281-65037-16-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 28, "name": "record_size_limit", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750273, "last_seen": 1789750273, "transport": "t", "ja3_hash": "20ab773c17dff4086ad357f238a728bb", "ja3_variant_count": 1, "ja3_variants": [ "20ab773c17dff4086ad357f238a728bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3619.132 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i1714h2_5b57614c22b0_d27576f0e476", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1714h2", "b": "5b57614c22b0", "c": "d27576f0e476", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,23-65281-10-11-35-16-5-34-51-43-13-45-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 549, "first_seen": 1787466549, "last_seen": 1791345279, "transport": "t", "ja3_hash": "a4a7efb11da858ab9c34dc7fbb241bcb", "ja3_variant_count": 1, "ja3_variants": [ "a4a7efb11da858ab9c34dc7fbb241bcb" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Mobile/15E148 Safari/604.1": 21, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i180900_e8a523a41297_78e6aca7449b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i180900", "b": "e8a523a41297", "c": "78e6aca7449b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4867-4865-4866-49199-49195-49200-49196-52393-52392-49161-49171-49162-49172-156-157-47-53-10,23-65281-10-11-35-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 37, "first_seen": 1787573175, "last_seen": 1791176862, "transport": "t", "ja3_hash": "43cf532976cbdec73c21b564756fd088", "ja3_variant_count": 1, "ja3_variants": [ "43cf532976cbdec73c21b564756fd088" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203": 33 }, "ua_disagreement": false } }, { "hash": "t13i181000_85036bcba153_d41ae481755e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i181000", "b": "85036bcba153", "c": "d41ae481755e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 103, "first_seen": 1787490592, "last_seen": 1791329857, "transport": "t", "ja3_hash": "8a9d5d0f12f7d43ee3af1c51d2998d99", "ja3_variant_count": 1, "ja3_variants": [ "8a9d5d0f12f7d43ee3af1c51d2998d99" ], "user_agents": { "Mozilla/5.0": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36": 34 }, "ua_disagreement": false } }, { "hash": "t13i181100_e8a523a41297_02c8e53ee398", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i181100", "b": "e8a523a41297", "c": "02c8e53ee398", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4867-4865-4866-49199-49195-49200-49196-52393-52392-49161-49171-49162-49172-156-157-47-53-10,23-65281-10-11-35-13-51-45-43-21-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787980407, "last_seen": 1791176863, "transport": "t", "ja3_hash": "7c5a42bc3e6679b3cdf9ae958f3a6f4f", "ja3_variant_count": 1, "ja3_variants": [ "7c5a42bc3e6679b3cdf9ae958f3a6f4f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203": 14 }, "ua_disagreement": false } }, { "hash": "t13i1811ht_85036bcba153_a3954c448de3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1811ht", "b": "85036bcba153", "c": "a3954c448de3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 53, "first_seen": 1787444925, "last_seen": 1791303050, "transport": "t", "ja3_hash": "b0020a04d796a92096d3928b119a51f6", "ja3_variant_count": 1, "ja3_variants": [ "b0020a04d796a92096d3928b119a51f6" ], "user_agents": { "Python/3.13 aiohttp/3.13.3": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 6, "python-httpx/0.28.1": 6 }, "ua_disagreement": true } }, { "hash": "t13i1909h2_9dc949149365_c6544fb8b0b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1909h2", "b": "9dc949149365", "c": "c6544fb8b0b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 817, "first_seen": 1787450006, "last_seen": 1791359308, "transport": "t", "ja3_hash": "7c1e207beb00684bbbe144f1b0abe1d5", "ja3_variant_count": 3, "ja3_variants": [ "7c1e207beb00684bbbe144f1b0abe1d5", "5af43e5eee17271a9eb37dce2ab407a8", "3590d1b8f63dd1d590f0adea4227443d" ], "user_agents": { "grpcurl/dev-build (no version set) grpc-go/1.48.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)": 76, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.3": 83, "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36": 85 }, "ua_disagreement": true } }, { "hash": "t13i191000_9dc949149365_be53661681a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i191000", "b": "9dc949149365", "c": "be53661681a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 10, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-35-13-65281-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787537711, "last_seen": 1791335815, "transport": "t", "ja3_hash": "f7e86b32bc0db5b6a594afac7cfc570c", "ja3_variant_count": 1, "ja3_variants": [ "f7e86b32bc0db5b6a594afac7cfc570c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t13i1910h2_9dc949149365_da06f2e414f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1910h2", "b": "9dc949149365", "c": "da06f2e414f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 26, "first_seen": 1787691401, "last_seen": 1791259794, "transport": "t", "ja3_hash": "c817aa2c11bd73320f909678c095d63f", "ja3_variant_count": 1, "ja3_variants": [ "c817aa2c11bd73320f909678c095d63f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36": 10, "rawgrab": 12 }, "ua_disagreement": false } }, { "hash": "t13i1911ht_9dc949149365_536e8a1380cb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1911ht", "b": "9dc949149365", "c": "536e8a1380cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 28, "first_seen": 1789154744, "last_seen": 1790550512, "transport": "t", "ja3_hash": "cadc9fa1fb68c3ba6ecca8c1cc913cd5", "ja3_variant_count": 1, "ja3_variants": [ "cadc9fa1fb68c3ba6ecca8c1cc913cd5" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36": 4, "rawgrab": 13 }, "ua_disagreement": false } }, { "hash": "t13i200900_2b729b4bf6f3_29829a46703f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i200900", "b": "2b729b4bf6f3", "c": "29829a46703f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,43-13-35-10-51-49-23-65281-45,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789141345, "last_seen": 1791343447, "transport": "t", "ja3_hash": "4d5efa96609dc906f796e63cff009c2a", "ja3_variant_count": 1, "ja3_variants": [ "4d5efa96609dc906f796e63cff009c2a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i201000_2b729b4bf6f3_36bf25f296df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i201000", "b": "2b729b4bf6f3", "c": "36bf25f296df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,43-13-35-10-11-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789132948, "last_seen": 1791207647, "transport": "t", "ja3_hash": "97fdf2ec3a65cf52e01241699b677063", "ja3_variant_count": 1, "ja3_variants": [ "97fdf2ec3a65cf52e01241699b677063" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i201100_2b729b4bf6f3_e24568c0d440", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i201100", "b": "2b729b4bf6f3", "c": "e24568c0d440", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,5-43-13-35-10-11-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789895176, "last_seen": 1789895176, "transport": "t", "ja3_hash": "584900de6273bb0e673db58cc107a882", "ja3_variant_count": 1, "ja3_variants": [ "584900de6273bb0e673db58cc107a882" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i201200_a09f3c656075_4174f7a35093", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i201200", "b": "a09f3c656075", "c": "4174f7a35093", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,65281-11-10-35-5-22-18-23-13-43-45-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789506229, "last_seen": 1789525776, "transport": "t", "ja3_hash": "09c22e00e519d501d237368a0ede51e6", "ja3_variant_count": 1, "ja3_variants": [ "09c22e00e519d501d237368a0ede51e6" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.4 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko)": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/27.0 Safari/605.1.15": 7 }, "ua_disagreement": false } }, { "hash": "t13i2012h2_a09f3c656075_992a514d60d9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i2012h2", "b": "a09f3c656075", "c": "992a514d60d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,23-65281-10-11-16-5-13-18-51-45-43-27,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790771549, "last_seen": 1790771554, "transport": "t", "ja3_hash": "0ca3c3ef30e6e88f75aeb1fb33433d14", "ja3_variant_count": 1, "ja3_variants": [ "0ca3c3ef30e6e88f75aeb1fb33433d14" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6.1 Mobile/15E148 Safari/604.1": 2 }, "ua_disagreement": false } }, { "hash": "t13i2013h2_a09f3c656075_d86fb8de1683", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i2013h2", "b": "a09f3c656075", "c": "d86fb8de1683", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 449, "first_seen": 1789056437, "last_seen": 1791183576, "transport": "t", "ja3_hash": "5a527c775ff4ae29b4f0c77b113f9625", "ja3_variant_count": 1, "ja3_variants": [ "5a527c775ff4ae29b4f0c77b113f9625" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1": 23 }, "ua_disagreement": false } }, { "hash": "t13i221000_231e334592e8_36bf25f296df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i221000", "b": "231e334592e8", "c": "36bf25f296df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 22, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,43-13-35-10-11-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790589911, "last_seen": 1791225825, "transport": "t", "ja3_hash": "8b017ed58d265d4bb85a29a74d48a6d4", "ja3_variant_count": 1, "ja3_variants": [ "8b017ed58d265d4bb85a29a74d48a6d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t13i2412ht_df98b6d6dfe4_6073e0ac6c48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i2412ht", "b": "df98b6d6dfe4", "c": "6073e0ac6c48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 24, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49195-49199-49188-49192-49187-49191-49162-49172-49161-49171-157-156-61-60-53-47-255,11-10-13172-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 11, "first_seen": 1788826663, "last_seen": 1790792173, "transport": "t", "ja3_hash": "410d9b65ff73443a9a062d12534d1ea7", "ja3_variant_count": 1, "ja3_variants": [ "410d9b65ff73443a9a062d12534d1ea7" ], "user_agents": { "Opera/9.80 (Windows NT 6.1; U; en) Presto/2.8.131 Version/11.11": 2, "Openwave/ UCWEB7.0.2.37/28/999": 2, "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16": 3 }, "ua_disagreement": false } }, { "hash": "t13i250800_b78ed14e2fd0_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i250800", "b": "b78ed14e2fd0", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49161-49187-49195-49162-49196-52393-49159-49170-49171-49191-49199-49172-49200-52392-49169-10-47-60-156-53-157-5-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 165, "first_seen": 1787469619, "last_seen": 1791360747, "transport": "t", "ja3_hash": "3ec6556e7c9ab2a2381d8f9e742b0779", "ja3_variant_count": 2, "ja3_variants": [ "3ec6556e7c9ab2a2381d8f9e742b0779", "b5f98d2b3acc6f53bb534d6746c1da1b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i250900_b78ed14e2fd0_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i250900", "b": "b78ed14e2fd0", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-65281-23-18-5-10-13-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 92, "first_seen": 1787507998, "last_seen": 1791351540, "transport": "t", "ja3_hash": "9b72665518dedb3531426284fdec8237", "ja3_variant_count": 2, "ja3_variants": [ "9b72665518dedb3531426284fdec8237", "abca373cc3696cd1d9e3f855310e2cb7" ], "user_agents": { "Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i251000_b78ed14e2fd0_ab7e3b40a677", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i251000", "b": "b78ed14e2fd0", "c": "ab7e3b40a677", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 446, "first_seen": 1787444557, "last_seen": 1791302704, "transport": "t", "ja3_hash": "11a384388ad36777e1a2e121495037fe", "ja3_variant_count": 3, "ja3_variants": [ "11a384388ad36777e1a2e121495037fe", "0698e491fd3a749dfdb6160baf27df93", "416eca07dcaad72dec6f76d1277b3eff" ], "user_agents": { "Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.7": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0": 2, "RootEvidence/1.0": 261, "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.6 Safari/605.1.15": 1 }, "ua_disagreement": false } }, { "hash": "t13i251000_b78ed14e2fd0_e5728521abd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i251000", "b": "b78ed14e2fd0", "c": "e5728521abd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 40, "first_seen": 1791178781, "last_seen": 1791296733, "transport": "t", "ja3_hash": "63d60128ac77725bfba6164731948ea4", "ja3_variant_count": 1, "ja3_variants": [ "63d60128ac77725bfba6164731948ea4" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/118.0": 1, "Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i251000_b78ed14e2fd0_f50d94e863eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i251000", "b": "b78ed14e2fd0", "c": "f50d94e863eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 10, "alpn": null } }, "ja3_string": "771,52393-52392-49195-49199-49196-49200-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4867-4865-4866,11-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1790784315, "last_seen": 1791160280, "transport": "t", "ja3_hash": "9404b4852d44353f69b8b33aaff15be4", "ja3_variant_count": 1, "ja3_variants": [ "9404b4852d44353f69b8b33aaff15be4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.164 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t13i2510h2_b78ed14e2fd0_da06f2e414f4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (da06f2e414f4) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13i2510h2", "b": "b78ed14e2fd0", "c": "da06f2e414f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-65281-23-18-5-10-13-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788030311, "last_seen": 1790798560, "transport": "t", "ja3_hash": "7bbe85ef3812bcf372fa8fa77ceb4393", "ja3_variant_count": 1, "ja3_variants": [ "7bbe85ef3812bcf372fa8fa77ceb4393" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 10 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13i2511h2_b78ed14e2fd0_d86ca3cca451", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i2511h2", "b": "b78ed14e2fd0", "c": "d86ca3cca451", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 113, "first_seen": 1787647312, "last_seen": 1791072996, "transport": "t", "ja3_hash": "f20f35624b79af10f537cb4e1e40197e", "ja3_variant_count": 1, "ja3_variants": [ "f20f35624b79af10f537cb4e1e40197e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36": 113 }, "ua_disagreement": false } }, { "hash": "t13i2512h2_b78ed14e2fd0_ea59f70d4047", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i2512h2", "b": "b78ed14e2fd0", "c": "ea59f70d4047", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-35-65281-23-18-5-10-13-16-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788030310, "last_seen": 1790798558, "transport": "t", "ja3_hash": "0d1427d71ce75d196bcc08bde920c292", "ja3_variant_count": 1, "ja3_variants": [ "0d1427d71ce75d196bcc08bde920c292" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t13i300900_1d37bd780c83_3550537cd59b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i300900", "b": "1d37bd780c83", "c": "3550537cd59b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-22-23-13-43-45-51,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788215502, "last_seen": 1791096606, "transport": "t", "ja3_hash": "4069ade96b9940f32cc037958922862e", "ja3_variant_count": 1, "ja3_variants": [ "4069ade96b9940f32cc037958922862e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 4, "Scrapy/2.17.0 (+https://scrapy.org)": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i301000_1d37bd780c83_0d46a1bf4a7c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i301000", "b": "1d37bd780c83", "c": "0d46a1bf4a7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-35-22-23-13-43-45-51,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787807782, "last_seen": 1790820525, "transport": "t", "ja3_hash": "4673db83e469a509574553048f28e263", "ja3_variant_count": 1, "ja3_variants": [ "4673db83e469a509574553048f28e263" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13i3012h2_1d37bd780c83_cde28b4b7b1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3012h2", "b": "1d37bd780c83", "c": "cde28b4b7b1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13366, "first_seen": 1787443300, "last_seen": 1791361909, "transport": "t", "ja3_hash": "7587a1ac9a4f17b4e4e5fe226716f4df", "ja3_variant_count": 1, "ja3_variants": [ "7587a1ac9a4f17b4e4e5fe226716f4df" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t13i311000_e8f1e7e78f70_5635d0cdb6df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i311000", "b": "e8f1e7e78f70", "c": "5635d0cdb6df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-157-156-61-60-53-47-255,5-10-11-13-50-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789703328, "last_seen": 1789703328, "transport": "t", "ja3_hash": "99ba718ac6cddc05d4f82b34c18b06b6", "ja3_variant_count": 1, "ja3_variants": [ "99ba718ac6cddc05d4f82b34c18b06b6" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:77.0) Gecko/20100101 Firefox/77.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i311000_e8f1e7e78f70_d41ae481755e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i311000", "b": "e8f1e7e78f70", "c": "d41ae481755e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 306, "first_seen": 1787472026, "last_seen": 1791334571, "transport": "t", "ja3_hash": "c12b4ccd5320bbb380ca1a9df90f771d", "ja3_variant_count": 2, "ja3_variants": [ "c12b4ccd5320bbb380ca1a9df90f771d", "004556e859f3c26c5d19746b3a957c74" ], "user_agents": { "ExposureScanner/1.0 (internal-security-audit)": 15, "Mozilla/5.0 (compatible; FlowIQLabsBot/1.0; +https://flowiq-labs.com/scanning-info)": 7, "Mozilla/5.0": 142, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i311100_e8f1e7e78f70_ccd0985badbe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i311100", "b": "e8f1e7e78f70", "c": "ccd0985badbe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 40, "first_seen": 1787457268, "last_seen": 1791353901, "transport": "t", "ja3_hash": "cd350275e54f0c0d6df9f3c93af0211d", "ja3_variant_count": 1, "ja3_variants": [ "cd350275e54f0c0d6df9f3c93af0211d" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0": 38 }, "ua_disagreement": false } }, { "hash": "t13i3111h2_e8f1e7e78f70_14507d565a4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (14507d565a4b) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13i3111h2", "b": "e8f1e7e78f70", "c": "14507d565a4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787776129, "last_seen": 1790965578, "transport": "t", "ja3_hash": "3ac15a6759db1d16101922a658d41dcc", "ja3_variant_count": 1, "ja3_variants": [ "3ac15a6759db1d16101922a658d41dcc" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13i3111ht_e8f1e7e78f70_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3111ht", "b": "e8f1e7e78f70", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 10, "first_seen": 1787722743, "last_seen": 1790962758, "transport": "t", "ja3_hash": "9b55a9609c756df436b6aa0a2adee99e", "ja3_variant_count": 1, "ja3_variants": [ "9b55a9609c756df436b6aa0a2adee99e" ], "user_agents": { "CVE-2023-20198": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t13i3112ht_e8f1e7e78f70_6073e0ac6c48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3112ht", "b": "e8f1e7e78f70", "c": "6073e0ac6c48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-13172-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788826658, "last_seen": 1790792153, "transport": "t", "ja3_hash": "0d85f6adde9dc6aa98804d6cfa2f90c1", "ja3_variant_count": 1, "ja3_variants": [ "0d85f6adde9dc6aa98804d6cfa2f90c1" ], "user_agents": { "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0;": 1, "Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36": 1, "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16": 1 }, "ua_disagreement": false } }, { "hash": "t13i3112ht_e8f1e7e78f70_e318ab2321b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3112ht", "b": "e8f1e7e78f70", "c": "e318ab2321b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 304, "first_seen": 1787647532, "last_seen": 1791073964, "transport": "t", "ja3_hash": "48eb9b1182293f55c0710654b7b12fc6", "ja3_variant_count": 1, "ja3_variants": [ "48eb9b1182293f55c0710654b7b12fc6" ], "user_agents": { "python-urllib3/2.7.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36": 308 }, "ua_disagreement": false } }, { "hash": "t13i351200_bfa337485184_990ad2f8d693", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i351200", "b": "bfa337485184", "c": "990ad2f8d693", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1787468076, "last_seen": 1790704172, "transport": "t", "ja3_hash": "afebc28e206410651a1ae4c4c0d39046", "ja3_variant_count": 1, "ja3_variants": [ "afebc28e206410651a1ae4c4c0d39046" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36": 1, "Mozilla/5.0 (compatible; V1.2040.0)": 10, "Mozilla/5.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i430900_c7886603b240_1f22a2ca17c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i430900", "b": "c7886603b240", "c": "1f22a2ca17c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 43, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791275774, "last_seen": 1791275774, "transport": "t", "ja3_hash": "a191bc14b8265666586f22ced37b9df6", "ja3_variant_count": 1, "ja3_variants": [ "a191bc14b8265666586f22ced37b9df6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/126 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t13i431100_c7886603b240_d339722ba4af", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i431100", "b": "c7886603b240", "c": "d339722ba4af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 43, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,11-10-35-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787527716, "last_seen": 1788493926, "transport": "t", "ja3_hash": "42ea9ce86effc99ac3305b3c203cccad", "ja3_variant_count": 1, "ja3_variants": [ "42ea9ce86effc99ac3305b3c203cccad" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 4, "Mozilla/5.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i4311ht_c7886603b240_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i4311ht", "b": "c7886603b240", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 43, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 101, "first_seen": 1789747047, "last_seen": 1791292362, "transport": "t", "ja3_hash": "f80d3d09f61892c5846c854dd84ac403", "ja3_variant_count": 1, "ja3_variants": [ "f80d3d09f61892c5846c854dd84ac403" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 101 }, "ua_disagreement": false } }, { "hash": "t13i4311ht_c7886603b240_be8d12c1d91c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i4311ht", "b": "c7886603b240", "c": "be8d12c1d91c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 43, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788458102, "last_seen": 1791176944, "transport": "t", "ja3_hash": "db687c576d7ee0017b289fc05e0f8574", "ja3_variant_count": 1, "ja3_variants": [ "db687c576d7ee0017b289fc05e0f8574" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t13i461000_0cb0c5806038_d41ae481755e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i461000", "b": "0cb0c5806038", "c": "d41ae481755e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 46, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49327-49325-49245-49249-49195-49199-49326-49324-49244-49248-49188-49192-49267-49271-49187-49191-49266-49270-49162-49172-49161-49171-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 25, "first_seen": 1787984720, "last_seen": 1791345298, "transport": "t", "ja3_hash": "511534a5dbb144576d046b0d2aeb5fb7", "ja3_variant_count": 1, "ja3_variants": [ "511534a5dbb144576d046b0d2aeb5fb7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 25 }, "ua_disagreement": false } }, { "hash": "t13i871000_72303a6ce03a_24695f2957a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i871000", "b": "72303a6ce03a", "c": "24695f2957a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 87, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-5-22-51-57-53-10-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-49159-49169-49160-49170-19-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-150-65-7-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 187, "first_seen": 1787807801, "last_seen": 1791194917, "transport": "t", "ja3_hash": "b9f9f70d41f64b985a82dfad78bde5f2", "ja3_variant_count": 1, "ja3_variants": [ "b9f9f70d41f64b985a82dfad78bde5f2" ], "user_agents": { "\"Mozilla/5.0": 4, "\\\"Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML": 4, "Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/86.0.4240.111Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t13i8711ht_c66346c74e42_14507d565a4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i8711ht", "b": "c66346c74e42", "c": "14507d565a4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 87, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-167-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-166-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787591545, "last_seen": 1790951391, "transport": "t", "ja3_hash": "1985e5fe14ed4a8da49339c80ff937a1", "ja3_variant_count": 1, "ja3_variants": [ "1985e5fe14ed4a8da49339c80ff937a1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i950900_22c26c6111ac_3cecfd2c111c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i950900", "b": "22c26c6111ac", "c": "3cecfd2c111c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 95, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-49158-49168-49173-59-2-1-255,11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788929223, "last_seen": 1790049416, "transport": "t", "ja3_hash": "e13351d956e8bb19f99de4eab43c0bb2", "ja3_variant_count": 1, "ja3_variants": [ "e13351d956e8bb19f99de4eab43c0bb2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_512ac2397e4d", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "PQCrypta HTTP/3 scanner \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "512ac2397e4d", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,11-23-0-57-10-45-51-43-16-13-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3446, "first_seen": 1789409523, "last_seen": 1791363210, "transport": "q", "ja3_hash": "c5aed400a2c9fce2bebfbca726d66ba1", "ja3_variant_count": 3358, "ja3_variants": [ "c5aed400a2c9fce2bebfbca726d66ba1", "8a2752f3df13c8c76bd6a1cf69739d0d", "b8b7e8f0405f974caa049b3575ae8dad", "6f0bd18e4d31a19d1d566167859624cb", "06e27547c3cf5538339a268a8b3e9869", "efb61444283f79b031fde2c4a1355064", "a42a4b71cc0fac141d02a48e82e4b2c0", "5ca8c96fd278e27e4565b4780a76338f", "61c9d1f8f38e8fb99e44a43084d80a3e", "e0cd06fccd00b6a44346e3b991d3239d", "123d81dac767dfed81fd99ce4cd67f06", "496d7605b583c8601be99c70032a8e79" ], "user_agents": { "PQCrypta-HTTP3-Scanner/1.0": 2756 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_2f94236428df", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "PQCrypta HTTP/3 scanner \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "2f94236428df", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,43-11-10-51-5-35-23-16-57-0-45-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9822, "first_seen": 1787447440, "last_seen": 1790511518, "transport": "q", "ja3_hash": "114f028919868e871efa215f1dcceef9", "ja3_variant_count": 8806, "ja3_variants": [ "114f028919868e871efa215f1dcceef9", "9822d35ef3997228ce8242d8aba65c9a", "58dd8b28ee61375bee69271a5594fd49", "9b85765a20af487d2f42d3a16c4a05f3", "a302666ae8e81068fa94c72aef4bc54a", "b2bcde219a8a5f46cd4c7a9e1b5a6f06", "d485a15e04f0edfc98e8fdf584e7e23e", "5f53cb826a625503dc401aee9802959a", "debe2eef08c4875ac618436c60fb030c", "3d6e912c16272af9bd7c10a5bdc8d521", "f6b09643e90c766fca12eb2609509605", "147eff6463ce14f5db5b538b24c57a7f" ], "user_agents": { "PQCrypta-HTTP3-Scanner/1.0": 4433 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_4bf6f83e6eb6", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "PQCrypta HTTP/3 scanner \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "4bf6f83e6eb6", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,5-45-57-0-11-23-10-51-13-43-16-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3596, "first_seen": 1787474392, "last_seen": 1791336298, "transport": "q", "ja3_hash": "aa341ea0f9bf84b19d84eda0553b9938", "ja3_variant_count": 3402, "ja3_variants": [ "aa341ea0f9bf84b19d84eda0553b9938", "39141acec579f7c848bdcb9906b012b6", "deb91a96775c0937e81994e750d4e1d0", "6cf38924d6472f79a69346db1b176446", "f3e9c2b354a967fc0c35e289ddf85912", "f0196223256d3e6c235e5f369ce1ebdc", "71101ab307a8339ccf7b85a33ddd531f", "8017d1efc39f8c60bcd45933acfbf45a", "773f7e8053d5442e2c90a7f8b7f0e870", "8b9c58d8a4183619dc89c1089034f495", "c582cee6ec989cb32a49a1ae31297078", "ccfe9b9d86d33c7c32df1975e6c35fb3" ], "user_agents": { "PQCrypta-HTTP3-Scanner/1.0": 81 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_7b6cd628e364", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "PQCrypta HTTP/3 scanner \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "7b6cd628e364", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,0-5-10-43-13-23-45-57-16-11-51-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 563, "first_seen": 1790515639, "last_seen": 1791359730, "transport": "q", "ja3_hash": "70f0a2ffcaeca3a183bc193d08694231", "ja3_variant_count": 558, "ja3_variants": [ "70f0a2ffcaeca3a183bc193d08694231", "befc7f2e71ba694a771005c7ed2d7923", "e60ed52990554ad0166414cd2ce132d3", "aeb070ba7fcb88a1b747a703ab7d6aac", "1d7c539e9a934557ebdacb67cf942d87", "dbb15aa60758ab07b9cc54a55e141906", "a9a7f4f326c3ca48308dfdfeee49b88c", "8c9b077bb3d5a4d95b114fc420f6d205", "52d2aff2c1b80a068cb5882ee6882c9c", "3bf43f1fb4013aa17277fcafdf56d0ca", "fa782eff2447be34e07d24f2d9e4076e", "4abe47ee62f5ea05dc82c5d9a78eec1b" ], "user_agents": { "PQCrypta-HTTP3-Scanner/1.0": 132 }, "ua_disagreement": false } }, { "hash": "t13d301200_1d37bd780c83_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "PQCrypta IndexNow \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301200", "b": "1d37bd780c83", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12427, "first_seen": 1787443188, "last_seen": 1791363115, "transport": "t", "ja3_hash": "284deaeae14ea5ddc96c5d7e59855422", "ja3_variant_count": 11, "ja3_variants": [ "284deaeae14ea5ddc96c5d7e59855422", "1beb2488efaaac0faa57e5ccfef0edb4", "fb179fc2dbd327ae80d22546d3f6e18b", "511696a57bfa284791aaf23f88275e34", "cdd910a2024dcdbb8bf0340e2ee4a083", "2274c53b79057a44af011a1c7b23b7eb", "a8f879d885f42c094875336eda098817", "266b55f66b549ca04b967b77236e14e3", "e423472435aef3b83a831006b999a013", "aa7e3f0fcd9d283cf940d0676545f556", "07a43b2846f493020a4ee19105e93b9d" ], "user_agents": { "IndexNow-PQCrypta/1.0": 5355, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/122.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 12 }, "ua_disagreement": true } }, { "hash": "t13d3112h2_e8f1e7e78f70_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "PQCrypta watchdog \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112h2", "b": "e8f1e7e78f70", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 178530, "first_seen": 1787442638, "last_seen": 1791363389, "transport": "t", "ja3_hash": "0149f47eabf9a20d0893e2a44e5a6323", "ja3_variant_count": 1, "ja3_variants": [ "0149f47eabf9a20d0893e2a44e5a6323" ], "user_agents": { "proxy-watchdog": 123693, "curl/8.18.0-DEV": 12584, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 11697 }, "ua_disagreement": true } }, { "hash": "t13d561200_bc01e4e2260a_3bb33b5210f9", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "Site24x7 \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d561200", "b": "bc01e4e2260a", "c": "3bb33b5210f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 56, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-49160-49170-22-19-49155-49165-10-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6429, "first_seen": 1787443121, "last_seen": 1791363078, "transport": "t", "ja3_hash": "1875aec3e9d2d51ffde08cc376aedcff", "ja3_variant_count": 1, "ja3_variants": [ "1875aec3e9d2d51ffde08cc376aedcff" ], "user_agents": { "Site24x7": 6417 }, "ua_disagreement": false } }, { "hash": "t13i3514ht_8f004308c246_d27576f0e476", "kind": "ja4", "tier": "observed", "classification": "monitor", "description": "Infrawatch \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3514ht", "b": "8f004308c246", "c": "d27576f0e476", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-49191-49187-52394-158-159-103-107-51-57-60-49170-22-10-5-49169-49159-52243-52244,23-65281-10-11-35-16-5-34-51-43-13-45-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 516, "first_seen": 1787461199, "last_seen": 1791345281, "transport": "t", "ja3_hash": "90189170f2171f397898ade1c4de4367", "ja3_variant_count": 1, "ja3_variants": [ "90189170f2171f397898ade1c4de4367" ], "user_agents": { "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)": 264, "Mozilla/5.0": 252 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_82b1eba68007", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "82b1eba68007", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,51-17613-10-27-16-57-65037-43-45-13-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3799, "first_seen": 1788441809, "last_seen": 1791362832, "transport": "q", "ja3_hash": "e10a7d2aad0be8af970e545ef8251e9a", "ja3_variant_count": 3799, "ja3_variants": [ "e10a7d2aad0be8af970e545ef8251e9a", "9ae3a533fcc4c2260ceb384d7cb05003", "684633de99d7947521af013124a019c6", "6ebfc4b18d0b3c990d4273eb4e12308a", "7b6add7969a04ee84c46671af9a1926e", "72fd2485e918698f69dda9003b893acd", "127ce7d5193de3ef900dcbe707854f08", "d67b64ea3665cd1dd14b52b869360e6c", "01427ed378c3ecab20ab3f354d36b189", "b751dc8ecb2695844502ea2a5faed848", "b8978573f94fc041f69525c5fca9ffff", "878893350699eafb39ad8cb83f8639db" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36": 7929, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 281, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 2853, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 4719, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 45, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 7506, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36 EdgA/155.0.0.0": 30, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 4070, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0 Safari/537.36": 140, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.175 Safari/537.36": 995, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 45, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.162 Safari/537.36": 435, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 141, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 86, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 127, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 76, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 459, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.36 Mobile Safari/537.36": 42, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 268, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 50, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.163 Safari/537.36": 379, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 689, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 541, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0": 20, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0 Safari/537.36": 84, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1": 247, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Mobile/15E148 Safari/604.1": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 268, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 133, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 181, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 139, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.7390.0 Safari/537.36": 541, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 95, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.34 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 124, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 459, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7339.0 Safari/537.36": 72, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 41, "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 25, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 369, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 582, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 121, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/116.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 179, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 142, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 118, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 97, "RootEvidence/1.0": 140, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 164, "Mozilla/5.0 (Linux; Android 16; SM-S921U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 75, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 122, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0 Safari/537.36": 21, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 42, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 YaBrowser/26.6.0.0 Safari/537.36": 8, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 77, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 29, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 41, "HanaleiBot runid=beta-stage-integration-test": 2, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 73, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 112, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.96 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 5, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0 Safari/537.36": 48, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 OPR/135.0.0.0": 77, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 AVG/151.0.0.0": 26, "Mozilla/5.0 (X11; CrOS x86_64 14150.87.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.124 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 60, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 57, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 75, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 36, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 35, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 EdgA/146.0.0.0": 8, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.3856.97": 61, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36 OPR/101.0.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Claude/1.49585.0 Chrome/152.0.7977.76 Safari/537.36": 19, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 40, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.250 Electron/43.5.1 Safari/537.36 KimiDesktop/3.2.6(Kimi-Work)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 16 }, "ua_disagreement": true } }, { "hash": "t00d110500_3790f16dbcf6_5551bc6d1e9a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (5551bc6d1e9a) with 2 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t00d110500", "b": "3790f16dbcf6", "c": "5551bc6d1e9a", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "server name sent", "cipher_count": 11, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49169-49159-49171-49161-49172-49162-5-47-53-49170-10,0-5-10-11-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 149, "first_seen": 1787495086, "last_seen": 1791353492, "transport": "t", "ja3_hash": "819a1ec4452f57faa06fea25528373c1", "ja3_variant_count": 1, "ja3_variants": [ "819a1ec4452f57faa06fea25528373c1" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t00i080600_dafb69683c10_b41aa53946ce", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t00i080600", "b": "dafb69683c10", "c": "b41aa53946ce", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 6, "alpn": null } }, "ja3_string": "769,10-47-53-49161-49162-49170-49171-49172,5-10-11-65281-15-18,23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 48, "first_seen": 1787469636, "last_seen": 1791339365, "transport": "t", "ja3_hash": "9ac060ae00112c1514e88f2858c37d14", "ja3_variant_count": 1, "ja3_variants": [ "9ac060ae00112c1514e88f2858c37d14" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t00i110400_3790f16dbcf6_3cfcf17d8064", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t00i110400", "b": "3790f16dbcf6", "c": "3cfcf17d8064", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "no server name (IP literal)", "cipher_count": 11, "extension_count": 4, "alpn": null } }, "ja3_string": "769,49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 143, "first_seen": 1787506162, "last_seen": 1791359334, "transport": "t", "ja3_hash": "4efa2927cd9c5711813345d734439c0c", "ja3_variant_count": 1, "ja3_variants": [ "4efa2927cd9c5711813345d734439c0c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_0c65036c8509_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "0c65036c8509", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,58-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703166, "transport": "t", "ja3_hash": "0b7b7f0670f94778cb6e9fbcb190d590", "ja3_variant_count": 1, "ja3_variants": [ "0b7b7f0670f94778cb6e9fbcb190d590" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_1275cc1ca538_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "1275cc1ca538", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,3-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703166, "transport": "t", "ja3_hash": "45c77ffa3640617a36f48bc655fe6aae", "ja3_variant_count": 1, "ja3_variants": [ "45c77ffa3640617a36f48bc655fe6aae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_14422b46a244_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "14422b46a244", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,9-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703166, "transport": "t", "ja3_hash": "7c56b75c3f1d7b18aded06f525be1da1", "ja3_variant_count": 1, "ja3_variants": [ "7c56b75c3f1d7b18aded06f525be1da1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_185cab9fea21_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "185cab9fea21", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,1-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703167, "transport": "t", "ja3_hash": "ffc812dd63fe6a5401c3e3871d1b9981", "ja3_variant_count": 1, "ja3_variants": [ "ffc812dd63fe6a5401c3e3871d1b9981" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_1c0a52334b2c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "1c0a52334b2c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,48-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703165, "transport": "t", "ja3_hash": "8a59e61cd6938f9441fbfd5c0618ebcb", "ja3_variant_count": 1, "ja3_variants": [ "8a59e61cd6938f9441fbfd5c0618ebcb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_1c131e13d449_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "1c131e13d449", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,15-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703168, "transport": "t", "ja3_hash": "fc18d564bdeac4b64832ec176210c0c3", "ja3_variant_count": 1, "ja3_variants": [ "fc18d564bdeac4b64832ec176210c0c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_23061ef215d6_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "23061ef215d6", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,137-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703164, "transport": "t", "ja3_hash": "4993faf879f029360aa8a0c9af8bed3c", "ja3_variant_count": 1, "ja3_variants": [ "4993faf879f029360aa8a0c9af8bed3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_2858a708d91c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "2858a708d91c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,4-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703168, "transport": "t", "ja3_hash": "34c5c1c012bbcc6d5e453cdbf8252117", "ja3_variant_count": 1, "ja3_variants": [ "34c5c1c012bbcc6d5e453cdbf8252117" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_2c202acb5b0d_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "2c202acb5b0d", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,154-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825502, "last_seen": 1790703166, "transport": "t", "ja3_hash": "a14d0e7dae973fb77ca9fdb1ede9e6d1", "ja3_variant_count": 1, "ja3_variants": [ "a14d0e7dae973fb77ca9fdb1ede9e6d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_2de5af831e68_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "2de5af831e68", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,65-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825502, "last_seen": 1790703167, "transport": "t", "ja3_hash": "2c8046b282a7e0774ebba08834650406", "ja3_variant_count": 1, "ja3_variants": [ "2c8046b282a7e0774ebba08834650406" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_30605b3abcde_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "30605b3abcde", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,17-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703167, "transport": "t", "ja3_hash": "a8e1b92a956b70db2409bc302d9f14c4", "ja3_variant_count": 1, "ja3_variants": [ "a8e1b92a956b70db2409bc302d9f14c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_35db378cb09f_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "35db378cb09f", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,51-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703165, "transport": "t", "ja3_hash": "c3c691ed4a9b02563c4b3f9748810ee3", "ja3_variant_count": 1, "ja3_variants": [ "c3c691ed4a9b02563c4b3f9748810ee3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_3c8714487106_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "3c8714487106", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,16-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703164, "transport": "t", "ja3_hash": "918daef135387a67ddf55fe5f3f2f269", "ja3_variant_count": 1, "ja3_variants": [ "918daef135387a67ddf55fe5f3f2f269" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_3f56bb683bdc_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "3f56bb683bdc", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,20-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703168, "transport": "t", "ja3_hash": "3e41a068ccc4dd82fc64eee06639f9fa", "ja3_variant_count": 1, "ja3_variants": [ "3e41a068ccc4dd82fc64eee06639f9fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_437c38fb20d7_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "437c38fb20d7", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,55-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703166, "transport": "t", "ja3_hash": "a44b0224387105d5c3562f685dad359d", "ja3_variant_count": 1, "ja3_variants": [ "a44b0224387105d5c3562f685dad359d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_462ecd6708d4_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "462ecd6708d4", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,27-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703166, "transport": "t", "ja3_hash": "00f545d6fdc7e9fbbbb1c4cc3d7a5964", "ja3_variant_count": 1, "ja3_variants": [ "00f545d6fdc7e9fbbbb1c4cc3d7a5964" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_484ebc7627f0_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "484ebc7627f0", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,56-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703168, "transport": "t", "ja3_hash": "8f081547b577718378d89926db8aa9d2", "ja3_variant_count": 1, "ja3_variants": [ "8f081547b577718378d89926db8aa9d2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_4a513bce9f12_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "4a513bce9f12", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,68-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703166, "transport": "t", "ja3_hash": "0521f512de771d542a04d17bb29de0f3", "ja3_variant_count": 1, "ja3_variants": [ "0521f512de771d542a04d17bb29de0f3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_515ebe86e7c3_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "515ebe86e7c3", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,49-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703164, "transport": "t", "ja3_hash": "391dffd9e8ec39129178abc23739265c", "ja3_variant_count": 1, "ja3_variants": [ "391dffd9e8ec39129178abc23739265c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_593aba79ccba_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "593aba79ccba", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,18-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825502, "last_seen": 1790703166, "transport": "t", "ja3_hash": "191d5bf0c0d1237c1795a8fcb485bf60", "ja3_variant_count": 1, "ja3_variants": [ "191d5bf0c0d1237c1795a8fcb485bf60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_6376cb8fadaa_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "6376cb8fadaa", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,57-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703167, "transport": "t", "ja3_hash": "e58ca349f51b598488a382c74eea4d22", "ja3_variant_count": 1, "ja3_variants": [ "e58ca349f51b598488a382c74eea4d22" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_671e0306a5cb_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "671e0306a5cb", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,19-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703165, "transport": "t", "ja3_hash": "4c6716cc99c468f1b11c440c5bee360f", "ja3_variant_count": 1, "ja3_variants": [ "4c6716cc99c468f1b11c440c5bee360f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_69d181a99895_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "69d181a99895", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,152-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825501, "last_seen": 1790703168, "transport": "t", "ja3_hash": "0af9260de52bdb863cc7aedf229cd61f", "ja3_variant_count": 1, "ja3_variants": [ "0af9260de52bdb863cc7aedf229cd61f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_6d6b3751bd69_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "6d6b3751bd69", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,153-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703167, "transport": "t", "ja3_hash": "426e1b972b56951df4747a2a1c1ba43a", "ja3_variant_count": 1, "ja3_variants": [ "426e1b972b56951df4747a2a1c1ba43a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_72fe80e83b5d_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "72fe80e83b5d", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,13-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703165, "transport": "t", "ja3_hash": "80e3de44341ad6a247c665ae8bc4c878", "ja3_variant_count": 1, "ja3_variants": [ "80e3de44341ad6a247c665ae8bc4c878" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_7ba938555a01_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "7ba938555a01", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,25-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703166, "transport": "t", "ja3_hash": "4b7205901eea041156c89665181ac95b", "ja3_variant_count": 1, "ja3_variants": [ "4b7205901eea041156c89665181ac95b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_85064055552b_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "85064055552b", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,151-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703165, "transport": "t", "ja3_hash": "9e20bbd1504dfc177596e1f14620be6e", "ja3_variant_count": 1, "ja3_variants": [ "9e20bbd1504dfc177596e1f14620be6e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_86ae22adfd52_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "86ae22adfd52", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,52-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825502, "last_seen": 1790703164, "transport": "t", "ja3_hash": "f58779091229ceeb548697af87e22e6a", "ja3_variant_count": 1, "ja3_variants": [ "f58779091229ceeb548697af87e22e6a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_8764e5090277_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "8764e5090277", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,135-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825502, "last_seen": 1790703166, "transport": "t", "ja3_hash": "db3fb008211c8bdff8943a3d2e1d2af2", "ja3_variant_count": 1, "ja3_variants": [ "db3fb008211c8bdff8943a3d2e1d2af2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_8cde4933ab6b_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "8cde4933ab6b", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,26-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703165, "transport": "t", "ja3_hash": "d0534e346cf00959825a6c2162d3bc6b", "ja3_variant_count": 1, "ja3_variants": [ "d0534e346cf00959825a6c2162d3bc6b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_8d2fb8454607_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "8d2fb8454607", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,70-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703168, "transport": "t", "ja3_hash": "2b7ad8c3805d5c20182f92bba8def66d", "ja3_variant_count": 1, "ja3_variants": [ "2b7ad8c3805d5c20182f92bba8def66d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_9cb11800989c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "9cb11800989c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,155-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703167, "transport": "t", "ja3_hash": "54eed52f3381566e0bf0816bb0d22d49", "ja3_variant_count": 1, "ja3_variants": [ "54eed52f3381566e0bf0816bb0d22d49" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_a0f473027383_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "a0f473027383", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,2-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703165, "transport": "t", "ja3_hash": "f44083d14857e87338a8b396c3bca7ac", "ja3_variant_count": 1, "ja3_variants": [ "f44083d14857e87338a8b396c3bca7ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_a5878986a7c9_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "a5878986a7c9", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,47-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703166, "transport": "t", "ja3_hash": "d49dd2dac22aba9882aa9d2b62ae619c", "ja3_variant_count": 1, "ja3_variants": [ "d49dd2dac22aba9882aa9d2b62ae619c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_a8d286a27066_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "a8d286a27066", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,23-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703165, "transport": "t", "ja3_hash": "e891627a1f2c8172718f670aa3031515", "ja3_variant_count": 1, "ja3_variants": [ "e891627a1f2c8172718f670aa3031515" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_b0ed54973b0f_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "b0ed54973b0f", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,50-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703164, "transport": "t", "ja3_hash": "9bf3632ef517c4fbbe67216c43e16620", "ja3_variant_count": 1, "ja3_variants": [ "9bf3632ef517c4fbbe67216c43e16620" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_bae431c474f8_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "bae431c474f8", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,66-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703166, "transport": "t", "ja3_hash": "ea8c34877a6c934fcea39bb63e9c4e0d", "ja3_variant_count": 1, "ja3_variants": [ "ea8c34877a6c934fcea39bb63e9c4e0d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_c259c416e32c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "c259c416e32c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,12-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703166, "transport": "t", "ja3_hash": "0e9a732e8288b157063a5f95e3994eb8", "ja3_variant_count": 1, "ja3_variants": [ "0e9a732e8288b157063a5f95e3994eb8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_c38774e7e0a0_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "c38774e7e0a0", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,22-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825502, "last_seen": 1790703168, "transport": "t", "ja3_hash": "8de16512b7a878030ed784e4405722ac", "ja3_variant_count": 1, "ja3_variants": [ "8de16512b7a878030ed784e4405722ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_c3df0a865ad8_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "c3df0a865ad8", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,150-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703166, "transport": "t", "ja3_hash": "d71748d4a275fdb70d6caeae1de9e2ac", "ja3_variant_count": 1, "ja3_variants": [ "d71748d4a275fdb70d6caeae1de9e2ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_c9fe23a5d87c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "c9fe23a5d87c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,67-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703165, "transport": "t", "ja3_hash": "9dd6db55b1028e55f04504a2e63eca23", "ja3_variant_count": 1, "ja3_variants": [ "9dd6db55b1028e55f04504a2e63eca23" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_d25758f9cc88_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "d25758f9cc88", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,24-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703165, "transport": "t", "ja3_hash": "0609e29c3f270a035f022b4983ef8ae4", "ja3_variant_count": 1, "ja3_variants": [ "0609e29c3f270a035f022b4983ef8ae4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_d83d06a7b5eb_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "d83d06a7b5eb", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,134-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703167, "transport": "t", "ja3_hash": "319373dd6d69af7291a745d250172c50", "ja3_variant_count": 1, "ja3_variants": [ "319373dd6d69af7291a745d250172c50" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_d99cf322fdea_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "d99cf322fdea", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,133-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703164, "transport": "t", "ja3_hash": "147e342b57ffa298b544031c9ea4a9a0", "ja3_variant_count": 1, "ja3_variants": [ "147e342b57ffa298b544031c9ea4a9a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_da5e85b893fc_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "da5e85b893fc", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,10-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703167, "transport": "t", "ja3_hash": "627eb71a8d63b593f4982de6cfab6058", "ja3_variant_count": 1, "ja3_variants": [ "627eb71a8d63b593f4982de6cfab6058" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_e03107c9d76e_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "e03107c9d76e", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,5-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825502, "last_seen": 1790703168, "transport": "t", "ja3_hash": "0b916017b4c99b13bbc1d61f49282e22", "ja3_variant_count": 1, "ja3_variants": [ "0b916017b4c99b13bbc1d61f49282e22" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_e530588400b6_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "e530588400b6", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,132-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703168, "transport": "t", "ja3_hash": "f3feb64f82841303ae55afdb888c02a6", "ja3_variant_count": 1, "ja3_variants": [ "f3feb64f82841303ae55afdb888c02a6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_ea1f27bcdcc2_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "ea1f27bcdcc2", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,136-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703166, "transport": "t", "ja3_hash": "5a58fd1878ad1606933a1757dbcb1202", "ja3_variant_count": 1, "ja3_variants": [ "5a58fd1878ad1606933a1757dbcb1202" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_ed19d00bad77_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "ed19d00bad77", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,21-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703166, "transport": "t", "ja3_hash": "008f240c56638283220461d58c217a3e", "ja3_variant_count": 1, "ja3_variants": [ "008f240c56638283220461d58c217a3e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_eea8af79bad9_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "eea8af79bad9", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,69-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703166, "transport": "t", "ja3_hash": "3c755f49ae8569ed337505c1bb053e97", "ja3_variant_count": 1, "ja3_variants": [ "3c755f49ae8569ed337505c1bb053e97" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_f2d8273d9564_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "f2d8273d9564", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,53-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703166, "transport": "t", "ja3_hash": "a3a83140e61f127cdfb03d8d7abe7085", "ja3_variant_count": 1, "ja3_variants": [ "a3a83140e61f127cdfb03d8d7abe7085" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_f4b95c39a23e_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "f4b95c39a23e", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,6-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703165, "transport": "t", "ja3_hash": "8e707082d66c38a68ad54ad5b860fc50", "ja3_variant_count": 1, "ja3_variants": [ "8e707082d66c38a68ad54ad5b860fc50" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_fa20206d2144_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "fa20206d2144", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,7-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703166, "transport": "t", "ja3_hash": "23d0575922ff8c016c6b87dfa0961849", "ja3_variant_count": 1, "ja3_variants": [ "23d0575922ff8c016c6b87dfa0961849" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_fbc32bd69299_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "fbc32bd69299", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,8-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825501, "last_seen": 1790703166, "transport": "t", "ja3_hash": "f1fb6ca22126d08f70fbebf764760962", "ja3_variant_count": 1, "ja3_variants": [ "f1fb6ca22126d08f70fbebf764760962" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020300_fd2d85721aa5_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020300", "b": "fd2d85721aa5", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "769,54-255,0-35-15,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825502, "last_seen": 1790703165, "transport": "t", "ja3_hash": "56463cfba840bdc7340a6c015b8f4066", "ja3_variant_count": 1, "ja3_variants": [ "56463cfba840bdc7340a6c015b8f4066" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_049d0968ef63_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "049d0968ef63", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49174-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703166, "transport": "t", "ja3_hash": "fd741510c1629880e66387ed56ffd6b7", "ja3_variant_count": 1, "ja3_variants": [ "fd741510c1629880e66387ed56ffd6b7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_0d62a58dd912_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "0d62a58dd912", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49169-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703169, "transport": "t", "ja3_hash": "f6633a778fa94cf468c262a61c446122", "ja3_variant_count": 1, "ja3_variants": [ "f6633a778fa94cf468c262a61c446122" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_2ac205266896_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "2ac205266896", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49173-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703165, "transport": "t", "ja3_hash": "f5bd74bb3aa2b083fe5baf397837404b", "ja3_variant_count": 1, "ja3_variants": [ "f5bd74bb3aa2b083fe5baf397837404b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_48762405b09c_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "48762405b09c", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49157-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703167, "transport": "t", "ja3_hash": "bb2a8dc59a8668efd9f4eac086f79e6f", "ja3_variant_count": 1, "ja3_variants": [ "bb2a8dc59a8668efd9f4eac086f79e6f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_4eff32302ec7_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "4eff32302ec7", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49160-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703168, "transport": "t", "ja3_hash": "a065d391f6d1113bf6131e0f65207999", "ja3_variant_count": 1, "ja3_variants": [ "a065d391f6d1113bf6131e0f65207999" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_4f4bd29a6b59_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "4f4bd29a6b59", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49175-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703166, "transport": "t", "ja3_hash": "b5bf8387a4d59ca2aedc7a7f9f8afd25", "ja3_variant_count": 1, "ja3_variants": [ "b5bf8387a4d59ca2aedc7a7f9f8afd25" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_55a2bbf9cbd7_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "55a2bbf9cbd7", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49164-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703166, "transport": "t", "ja3_hash": "b21e8f6cc931a4f610cca5e0d89154c4", "ja3_variant_count": 1, "ja3_variants": [ "b21e8f6cc931a4f610cca5e0d89154c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_57ba72230e7a_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "57ba72230e7a", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49167-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825501, "last_seen": 1790703165, "transport": "t", "ja3_hash": "c7955263fb5755b191c7b8af8b011163", "ja3_variant_count": 1, "ja3_variants": [ "c7955263fb5755b191c7b8af8b011163" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_59980b593f60_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "59980b593f60", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49176-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703165, "transport": "t", "ja3_hash": "20b543eb191018e555ec27ae874ab521", "ja3_variant_count": 1, "ja3_variants": [ "20b543eb191018e555ec27ae874ab521" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_5b44afd80a2d_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "5b44afd80a2d", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49156-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703167, "transport": "t", "ja3_hash": "f076b4a5e2fd4408a329d4f9dfda478f", "ja3_variant_count": 1, "ja3_variants": [ "f076b4a5e2fd4408a329d4f9dfda478f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_68cd44b4e773_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "68cd44b4e773", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49162-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703165, "transport": "t", "ja3_hash": "ef4bf16a753ddfcf0e8831cb9f52e475", "ja3_variant_count": 1, "ja3_variants": [ "ef4bf16a753ddfcf0e8831cb9f52e475" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_89e01831f9a8_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "89e01831f9a8", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49153-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703165, "transport": "t", "ja3_hash": "69dc0d3a7f413f1d3494b2f5ff96b21e", "ja3_variant_count": 1, "ja3_variants": [ "69dc0d3a7f413f1d3494b2f5ff96b21e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_8fc24edd70fe_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "8fc24edd70fe", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49163-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703166, "transport": "t", "ja3_hash": "105c3296d1d9b5d35cc7f018a4dad282", "ja3_variant_count": 1, "ja3_variants": [ "105c3296d1d9b5d35cc7f018a4dad282" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_9b38dd297dfe_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "9b38dd297dfe", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49168-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703164, "transport": "t", "ja3_hash": "f0fd3766ab6ea6822c59a578e1d5349c", "ja3_variant_count": 1, "ja3_variants": [ "f0fd3766ab6ea6822c59a578e1d5349c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_a0546e0689fc_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "a0546e0689fc", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49171-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703168, "transport": "t", "ja3_hash": "3d45a6fbf32ad6468c66beaee3a193eb", "ja3_variant_count": 1, "ja3_variants": [ "3d45a6fbf32ad6468c66beaee3a193eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_a89416eb2da9_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "a89416eb2da9", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49177-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703166, "transport": "t", "ja3_hash": "7012d5113d653e86575e3c009ef57ce4", "ja3_variant_count": 1, "ja3_variants": [ "7012d5113d653e86575e3c009ef57ce4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_bad2b1bd13d4_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "bad2b1bd13d4", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49155-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703166, "transport": "t", "ja3_hash": "56a2d8d43e1c7c58cf1d3c0a6a266431", "ja3_variant_count": 1, "ja3_variants": [ "56a2d8d43e1c7c58cf1d3c0a6a266431" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_c4610a930072_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "c4610a930072", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49159-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703168, "transport": "t", "ja3_hash": "3e8278c7cafc262fa5568be5e1b4d38c", "ja3_variant_count": 1, "ja3_variants": [ "3e8278c7cafc262fa5568be5e1b4d38c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_c66b7cee1896_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "c66b7cee1896", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49161-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703166, "transport": "t", "ja3_hash": "fb6c5d992b10031b6ae404aaa9451a46", "ja3_variant_count": 1, "ja3_variants": [ "fb6c5d992b10031b6ae404aaa9451a46" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_cc27769a2ea2_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "cc27769a2ea2", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49165-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825501, "last_seen": 1790703167, "transport": "t", "ja3_hash": "8297baccfc07ffa8d13e3644678e522a", "ja3_variant_count": 1, "ja3_variants": [ "8297baccfc07ffa8d13e3644678e522a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_d0ac5cb1209a_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "d0ac5cb1209a", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49172-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825502, "last_seen": 1790703167, "transport": "t", "ja3_hash": "d2f789a95d9fc517a14f0fd38b038e8c", "ja3_variant_count": 1, "ja3_variants": [ "d2f789a95d9fc517a14f0fd38b038e8c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_d576ba9a1b51_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "d576ba9a1b51", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49154-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703166, "transport": "t", "ja3_hash": "24c962e6900b80aff311e22bc7051b5f", "ja3_variant_count": 1, "ja3_variants": [ "24c962e6900b80aff311e22bc7051b5f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_efa2d734833b_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "efa2d734833b", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49158-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825498, "last_seen": 1790703165, "transport": "t", "ja3_hash": "8720b2322a28a280b38256f84596581c", "ja3_variant_count": 1, "ja3_variants": [ "8720b2322a28a280b38256f84596581c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_f17337cd55b5_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "f17337cd55b5", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49166-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703167, "transport": "t", "ja3_hash": "6229126190e013f5e256b7863adacefc", "ja3_variant_count": 1, "ja3_variants": [ "6229126190e013f5e256b7863adacefc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d020500_f3042cbcf579_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d020500", "b": "f3042cbcf579", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49170-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703166, "transport": "t", "ja3_hash": "14960d88ecbd35d1a0fd74a33f53151f", "ja3_variant_count": 1, "ja3_variants": [ "14960d88ecbd35d1a0fd74a33f53151f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d040300_058957366436_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d040300", "b": "058957366436", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 4, "extension_count": 3, "alpn": null } }, "ja3_string": "769,49185-49178-49181-49184,10-0-11,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "e930031d6dce23ba43c86db6b6c153a8", "ja3_variant_count": 1, "ja3_variants": [ "e930031d6dce23ba43c86db6b6c153a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d070100_c50f5591e341_4c2e34f23e4d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d070100", "b": "c50f5591e341", "c": "4c2e34f23e4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 7, "extension_count": 1, "alpn": null } }, "ja3_string": "769,10-47-53-49161-49162-49171-49172,0,,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791319585, "last_seen": 1791319585, "transport": "t", "ja3_hash": "03ca53a2c5a7b90b6b2fde6fc0d75039", "ja3_variant_count": 1, "ja3_variants": [ "03ca53a2c5a7b90b6b2fde6fc0d75039" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d070700_c50f5591e341_661ff8826348", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d070700", "b": "c50f5591e341", "c": "661ff8826348", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "769,49162-49161-49172-49171-53-47-10,0-5-10-11-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789450886, "last_seen": 1791333798, "transport": "t", "ja3_hash": "1138de370e523e824bbca92d049a3777", "ja3_variant_count": 1, "ja3_variants": [ "1138de370e523e824bbca92d049a3777" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d070800_c50f5591e341_e399d4fd45b6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d070800", "b": "c50f5591e341", "c": "e399d4fd45b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 7, "extension_count": 8, "alpn": null } }, "ja3_string": "769,49162-49161-49172-49171-53-47-10,0-5-10-11-35-23-24-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791351547, "last_seen": 1791351547, "transport": "t", "ja3_hash": "b89be837a4a296476fcd758189908728", "ja3_variant_count": 1, "ja3_variants": [ "b89be837a4a296476fcd758189908728" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d080700_dafb69683c10_18ee6cfe2d80", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d080700", "b": "dafb69683c10", "c": "18ee6cfe2d80", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 8, "extension_count": 7, "alpn": null } }, "ja3_string": "769,49171-49161-49172-49162-47-53-49170-10,0-5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 149, "first_seen": 1787495090, "last_seen": 1791353489, "transport": "t", "ja3_hash": "2bc74c78d8230f1675231a007f1155d0", "ja3_variant_count": 1, "ja3_variants": [ "2bc74c78d8230f1675231a007f1155d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d090600_c491f621fb4c_80d8baa1f8cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d090600", "b": "c491f621fb4c", "c": "80d8baa1f8cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 9, "extension_count": 6, "alpn": null } }, "ja3_string": "769,49162-49172-57-49161-49171-51-53-47-255,0-11-10-35-22-23,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 15, "first_seen": 1787697745, "last_seen": 1790717117, "transport": "t", "ja3_hash": "c6dbf3152a545382a95425e390e2d2e8", "ja3_variant_count": 1, "ja3_variants": [ "c6dbf3152a545382a95425e390e2d2e8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d110700_3790f16dbcf6_18ee6cfe2d80", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d110700", "b": "3790f16dbcf6", "c": "18ee6cfe2d80", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 11, "extension_count": 7, "alpn": null } }, "ja3_string": "769,10-47-53-49161-49162-49170-49171-49172-5-49159-49169,0-5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787969608, "last_seen": 1791001308, "transport": "t", "ja3_hash": "e989acc7bf5b039f3e2ae950c6a38aeb", "ja3_variant_count": 1, "ja3_variants": [ "e989acc7bf5b039f3e2ae950c6a38aeb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d130300_48b83dc3bfb9_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d130300", "b": "48b83dc3bfb9", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 13, "extension_count": 3, "alpn": null } }, "ja3_string": "769,255-49162-49172-57-56-49157-49167-49161-49171-51-50-49156-49166,0-10-11,14-13-25-28-11-12-27-24-9-10-26-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787710526, "last_seen": 1791081113, "transport": "t", "ja3_hash": "514be2763eae0143869b0b4de27dbf40", "ja3_variant_count": 1, "ja3_variants": [ "514be2763eae0143869b0b4de27dbf40" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d140600_74fc3de17c53_39291a6d1b56", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d140600", "b": "74fc3de17c53", "c": "39291a6d1b56", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 14, "extension_count": 6, "alpn": null } }, "ja3_string": "769,49162-49161-49172-49171-57-51-53-47-10-56-50-19-5-4,0-10-11-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788497951, "last_seen": 1789653803, "transport": "t", "ja3_hash": "235a856727c14dba889ddee0a38dd2f2", "ja3_variant_count": 1, "ja3_variants": [ "235a856727c14dba889ddee0a38dd2f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d170600_89907b424de5_80d8baa1f8cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d170600", "b": "89907b424de5", "c": "80d8baa1f8cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 17, "extension_count": 6, "alpn": null } }, "ja3_string": "769,49171-49161-49172-49162-51-56-57-50-47-53-136-135-69-68-132-65-255,0-11-10-35-22-23,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788750551, "last_seen": 1788750551, "transport": "t", "ja3_hash": "5359ec34eb388044f03ba3d8d2ffed9b", "ja3_variant_count": 1, "ja3_variants": [ "5359ec34eb388044f03ba3d8d2ffed9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d210500_1e0f66cc3f83_5551bc6d1e9a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d210500", "b": "1e0f66cc3f83", "c": "5551bc6d1e9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 21, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49160-57-51-22-4-20-21-8-6-3,0-5-10-11-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 44, "first_seen": 1787464624, "last_seen": 1791289941, "transport": "t", "ja3_hash": "aaed20a72e1ed040b4a19deae4694250", "ja3_variant_count": 1, "ja3_variants": [ "aaed20a72e1ed040b4a19deae4694250" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d230600_44099cda8a52_80d8baa1f8cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d230600", "b": "44099cda8a52", "c": "80d8baa1f8cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 23, "extension_count": 6, "alpn": null } }, "ja3_string": "769,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-53-132-47-65-255,0-11-10-35-22-23,29-23-30-24-25,0-1-2", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 101, "first_seen": 1791324680, "last_seen": 1791363210, "transport": "t", "ja3_hash": "c4e01a89eb759eade7ad12f9295fdf08", "ja3_variant_count": 1, "ja3_variants": [ "c4e01a89eb759eade7ad12f9295fdf08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d420300_4a5d165148b5_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d420300", "b": "4a5d165148b5", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 42, "extension_count": 3, "alpn": null } }, "ja3_string": "769,4-5-10-13-16-19-22-47-48-49-50-51-53-54-55-56-57-65-68-69-102-132-135-136-150-255-49154-49155-49156-49157-49159-49160-49161-49162-49164-49165-49166-49167-49169-49170-49171-49172,0-11-10,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17-29,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509856, "last_seen": 1791290838, "transport": "t", "ja3_hash": "4bb0894d67675912496f921f6d6a70e6", "ja3_variant_count": 1, "ja3_variants": [ "4bb0894d67675912496f921f6d6a70e6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d640300_1715b94e3896_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d640300", "b": "1715b94e3896", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182,10-0-11,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020295, "last_seen": 1791020295, "transport": "t", "ja3_hash": "4ba61efc7e5e7b6b7e750824d14b63c0", "ja3_variant_count": 1, "ja3_variants": [ "4ba61efc7e5e7b6b7e750824d14b63c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10d640300_1e98fdfb27e9_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10d640300", "b": "1e98fdfb27e9", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49411-49413-49409-49412-49414-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138,10-0-11,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020294, "last_seen": 1791020294, "transport": "t", "ja3_hash": "0ef6c7a84f33be5d0d90e09ee91465d0", "ja3_variant_count": 1, "ja3_variants": [ "0ef6c7a84f33be5d0d90e09ee91465d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i040200_058957366436_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i040200", "b": "058957366436", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 2, "alpn": null } }, "ja3_string": "769,49185-49178-49181-49184,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748805, "last_seen": 1791319601, "transport": "t", "ja3_hash": "ef48cb39a551b26f56be4a1eab4147ad", "ja3_variant_count": 2, "ja3_variants": [ "ef48cb39a551b26f56be4a1eab4147ad", "e292f606453a21e41243a65f73847f4e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i040700_cefcabfea53d_28adf769107b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i040700", "b": "cefcabfea53d", "c": "28adf769107b", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 7, "alpn": null } }, "ja3_string": "769,49161-49171-49162-49172,11-65281-23-18-5-10-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 233, "first_seen": 1787448768, "last_seen": 1791346376, "transport": "t", "ja3_hash": "af232ab01c5a432d1148b4f805c5df16", "ja3_variant_count": 1, "ja3_variants": [ "af232ab01c5a432d1148b4f805c5df16" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i070500_c50f5591e341_1a3805c3aa63", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i070500", "b": "c50f5591e341", "c": "1a3805c3aa63", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 7, "extension_count": 5, "alpn": null } }, "ja3_string": "769,49162-49161-49172-49171-53-47-10,10-11-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788917181, "last_seen": 1788917182, "transport": "t", "ja3_hash": "fc54e0d16d9764783542f0146a98b300", "ja3_variant_count": 1, "ja3_variants": [ "fc54e0d16d9764783542f0146a98b300" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i080600_dafb69683c10_166ed56ebb15", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i080600", "b": "dafb69683c10", "c": "166ed56ebb15", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 6, "alpn": null } }, "ja3_string": "769,49171-49161-49172-49162-47-53-49170-10,5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 165, "first_seen": 1787506161, "last_seen": 1791359329, "transport": "t", "ja3_hash": "8dace756ca50d2b376c065ba937de663", "ja3_variant_count": 1, "ja3_variants": [ "8dace756ca50d2b376c065ba937de663" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i150700_0dfbaf47f5cc_e144c465795a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i150700", "b": "0dfbaf47f5cc", "c": "e144c465795a", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "769,49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-53-47-255,5-10-11-17-23-35-43,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788737394, "last_seen": 1788737394, "transport": "t", "ja3_hash": "58f3ce9fd48c9e7e39947514ef7f51fa", "ja3_variant_count": 1, "ja3_variants": [ "58f3ce9fd48c9e7e39947514ef7f51fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_13a2a23d501b_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "13a2a23d501b", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820545, "last_seen": 1789485425, "transport": "t", "ja3_hash": "3dd271080769b41ca30134e5a6d6c6bd", "ja3_variant_count": 1, "ja3_variants": [ "3dd271080769b41ca30134e5a6d6c6bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_1715b94e3896_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "1715b94e3896", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748798, "last_seen": 1791319601, "transport": "t", "ja3_hash": "8b64988acee4968c6c9ccf393390bf70", "ja3_variant_count": 2, "ja3_variants": [ "8b64988acee4968c6c9ccf393390bf70", "00b2b44f33241679aca9cde4b3705be3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_1e98fdfb27e9_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "1e98fdfb27e9", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49411-49413-49409-49412-49414-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748800, "last_seen": 1791319600, "transport": "t", "ja3_hash": "df9477fa616f1460293a35f8ed101e9c", "ja3_variant_count": 2, "ja3_variants": [ "df9477fa616f1460293a35f8ed101e9c", "d2719614a69c17e3ca522792888176ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_67f0ca237a44_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "67f0ca237a44", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820545, "last_seen": 1789485425, "transport": "t", "ja3_hash": "71252f9d7847c2f1fe7d4f27fcdffe0f", "ja3_variant_count": 1, "ja3_variants": [ "71252f9d7847c2f1fe7d4f27fcdffe0f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_a3acda31d846_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "a3acda31d846", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1787820539, "last_seen": 1791319599, "transport": "t", "ja3_hash": "6de77e9ec18814ad2fa29b71daba7e40", "ja3_variant_count": 3, "ja3_variants": [ "6de77e9ec18814ad2fa29b71daba7e40", "d3b255a7a10be1525299b19c5b91a217", "b4047c3e9def2004ac7318a2bef28c8d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_e31a90cd0803_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "e31a90cd0803", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1787820540, "last_seen": 1791319599, "transport": "t", "ja3_hash": "0145ded955e8e369b284596c831c152d", "ja3_variant_count": 3, "ja3_variants": [ "0145ded955e8e369b284596c831c152d", "57af18b1ec1e94f633ec483f6d4712a7", "537cedf0d20b09cfbbc9973de4ed8ddc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_e7b476f9520b_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "e7b476f9520b", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1787820543, "last_seen": 1791319598, "transport": "t", "ja3_hash": "f0fcf0f58913a461bfe56c02056bf6aa", "ja3_variant_count": 3, "ja3_variants": [ "f0fcf0f58913a461bfe56c02056bf6aa", "b6e02a6390c3ee8685503e1e18094c85", "ca1029690fb31a7704cfd2189a9c5225" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i640200_f559eb9565fd_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i640200", "b": "f559eb9565fd", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "769,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1787820543, "last_seen": 1791319600, "transport": "t", "ja3_hash": "74c653cc1772002464b804a19e77e170", "ja3_variant_count": 3, "ja3_variants": [ "74c653cc1772002464b804a19e77e170", "f73a537ea3cb074d98e4e7f6f049b5bc", "126eeb50bf83227ebb4d1aa0936fcafe" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t10i990200_0df3f6915705_357e3bc58f3d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i990200", "b": "0df3f6915705", "c": "357e3bc58f3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 2, "alpn": null } }, "ja3_string": "769,49273-49176-151-149-120-150-49227-49165-165-49413-189-49323-91-194-49193-49247-29-187-195-179-68-17-178-49299-92-175-166-49248-49319-49235-13-65279-20-1-81-174-177-142-49261-49289-49190-45-4-64-124-10-27-97-159-23-147-98-49166-49270-49153-50-49224-137-49257-42-49237-8-49249-49230-80-160-115-49191-49207-49246-49282-145-198-49168-49228-49252-104-180-49159-49163-182-33-192-114-49211-43-49177-75-116-47-66-49221-49308-79-36-87-60-4866-49196-89-167-49173-49321-126-49305-14-188-153-51-25-52398-49201-49250-168-49266-172-121-105-49225-176-49295-49192-49242-49331-49304-7-73-55-49285-49271-49326-49206-49197-5-19-135-133-49276-199-99-44-49288-49169-4869-49236-49290-162-49179-49170-9-31-4867-4865-49174-49297-30-49263-48-2-49267-49408-53253-53251-61-49180-67-53249-49189-49199-52396-49217-82-52394-49307-128-52393-49157-49291-49277-53-52245-52244-72-57-52243-49414-49412-49200-49167-190-49410-49409-49258-40-49333-49332-49330-100-49328-86-49327-49184-49324-49322-6-49301-197-49186-49219-49209-129-170-16-49320-156-49318-49317-49316-49315-49187-49313-157-152-49311-143-49158-49309-49265-49306-131-49294-49181-49302-49188-148-49300-185-49298-134-49205-49216-65278-84-49278-49283-49203-49293-49254-108-52392-4868-34-90-4870-63-15-37-49286-109-49296-28-49281-49280-49279-49238-49275-49274-69-49272-49234-161-49268-107-49264-49262-49245-49260-49259-125-21-52-26-62-49256-70-49292-49253-32-49269-144-49244-56-49243-49241-49303-49239-49251-49233-49232-49208-49171-3-38-35-49194-49240-49226-49223-136-22-49222-49220-49172-11-83-49218-24-52395-49175-49-140-186-46-52397-49202-49210-49204-49213-41-49212-49198-96-184-49156-49185-164-49214-39-49314-49325-49183-49182-49178-49231-49164-18-102-130-49161-49160-49310-58-155-53250-132-193-191-49411-49215-183-181-4871-85-139-171-101-49195-103-106-49287-77-78-158-54-49312-154-146-141-138-196-12-49229-119-88-49284-169-49329-173-76-74-71-0-49255-49154-65-59-49155-163-49162,10-15,23-24-25-29-256-4588,", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 4870, "name": "4870 (0x1306)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 4871, "name": "4871 (0x1307)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788737419, "last_seen": 1790001783, "transport": "t", "ja3_hash": "78168602482c727689d4c0105f470b96", "ja3_variant_count": 6, "ja3_variants": [ "78168602482c727689d4c0105f470b96", "80c0867d239e43460b9d25bf7f3b0eda", "d90e019b52211e0913fc2a15e6a7d461", "a9291424595b1cf0aba6f78f8d16eb5e", "081cfdeb15c3d26d2c5298cc3b2c489e", "43f491788326492ae75d8b30340e83fb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_0c65036c8509_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "0c65036c8509", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,58-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703171, "transport": "t", "ja3_hash": "edabd89505a0db3053780c9f2e11a51c", "ja3_variant_count": 1, "ja3_variants": [ "edabd89505a0db3053780c9f2e11a51c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_1275cc1ca538_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "1275cc1ca538", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,3-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703170, "transport": "t", "ja3_hash": "a9ac965462277f4f7bd009b91724b6e9", "ja3_variant_count": 1, "ja3_variants": [ "a9ac965462277f4f7bd009b91724b6e9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_14422b46a244_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "14422b46a244", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,9-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703169, "transport": "t", "ja3_hash": "3f09774b4d8319c6773b51318c0045be", "ja3_variant_count": 1, "ja3_variants": [ "3f09774b4d8319c6773b51318c0045be" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_185cab9fea21_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "185cab9fea21", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,1-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703170, "transport": "t", "ja3_hash": "9c4361562f8dbca42c849c680c7402a3", "ja3_variant_count": 1, "ja3_variants": [ "9c4361562f8dbca42c849c680c7402a3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_1c0a52334b2c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "1c0a52334b2c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,48-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703170, "transport": "t", "ja3_hash": "173a7880e2d1fa3dbfcd95ebb7b650a4", "ja3_variant_count": 1, "ja3_variants": [ "173a7880e2d1fa3dbfcd95ebb7b650a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_1c131e13d449_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "1c131e13d449", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,15-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703170, "transport": "t", "ja3_hash": "aa0f342e223668779dc8eb1fb7d920d8", "ja3_variant_count": 1, "ja3_variants": [ "aa0f342e223668779dc8eb1fb7d920d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_23061ef215d6_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "23061ef215d6", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,137-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825517, "last_seen": 1790703168, "transport": "t", "ja3_hash": "65cc4be7b7eac21328d21548cafc6068", "ja3_variant_count": 1, "ja3_variants": [ "65cc4be7b7eac21328d21548cafc6068" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_2858a708d91c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "2858a708d91c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,4-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825517, "last_seen": 1790703171, "transport": "t", "ja3_hash": "21d51028d0483349cc34e258eea575bf", "ja3_variant_count": 1, "ja3_variants": [ "21d51028d0483349cc34e258eea575bf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_2c202acb5b0d_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "2c202acb5b0d", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,154-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825517, "last_seen": 1790703170, "transport": "t", "ja3_hash": "01d9475c62a43afb65931bda06f549ee", "ja3_variant_count": 1, "ja3_variants": [ "01d9475c62a43afb65931bda06f549ee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_2de5af831e68_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "2de5af831e68", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,65-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703170, "transport": "t", "ja3_hash": "b56b10234bbf794956d34ecfec984dd4", "ja3_variant_count": 1, "ja3_variants": [ "b56b10234bbf794956d34ecfec984dd4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_30605b3abcde_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "30605b3abcde", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,17-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703169, "transport": "t", "ja3_hash": "f99de2d28272883454e535c6a7e8319a", "ja3_variant_count": 1, "ja3_variants": [ "f99de2d28272883454e535c6a7e8319a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_35db378cb09f_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "35db378cb09f", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,51-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703169, "transport": "t", "ja3_hash": "9a47e517beacdc548a73dccca5377b22", "ja3_variant_count": 1, "ja3_variants": [ "9a47e517beacdc548a73dccca5377b22" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_3c8714487106_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "3c8714487106", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,16-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825517, "last_seen": 1790703169, "transport": "t", "ja3_hash": "72caabd73136ca8c599ecccc358abd2a", "ja3_variant_count": 1, "ja3_variants": [ "72caabd73136ca8c599ecccc358abd2a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_3f56bb683bdc_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "3f56bb683bdc", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,20-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703173, "transport": "t", "ja3_hash": "9ed9b9455a55502245e101214170d71b", "ja3_variant_count": 1, "ja3_variants": [ "9ed9b9455a55502245e101214170d71b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_437c38fb20d7_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "437c38fb20d7", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,55-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703172, "transport": "t", "ja3_hash": "c9102e0ced8828c7ab733ad648c431b5", "ja3_variant_count": 1, "ja3_variants": [ "c9102e0ced8828c7ab733ad648c431b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_462ecd6708d4_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "462ecd6708d4", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,27-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703169, "transport": "t", "ja3_hash": "68c64d039d2b709dc4e6c99f239d68d3", "ja3_variant_count": 1, "ja3_variants": [ "68c64d039d2b709dc4e6c99f239d68d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_484ebc7627f0_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "484ebc7627f0", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,56-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703171, "transport": "t", "ja3_hash": "0b775248e6713e3cb99352dc37ec61d5", "ja3_variant_count": 1, "ja3_variants": [ "0b775248e6713e3cb99352dc37ec61d5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_4a513bce9f12_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "4a513bce9f12", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,68-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703171, "transport": "t", "ja3_hash": "1f02cadc916ddb5372bd5cfa045de46e", "ja3_variant_count": 1, "ja3_variants": [ "1f02cadc916ddb5372bd5cfa045de46e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_515ebe86e7c3_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "515ebe86e7c3", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,49-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703169, "transport": "t", "ja3_hash": "970ef19e2ffbd0e6fa62adac27876aa7", "ja3_variant_count": 1, "ja3_variants": [ "970ef19e2ffbd0e6fa62adac27876aa7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_593aba79ccba_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "593aba79ccba", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,18-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703171, "transport": "t", "ja3_hash": "4276ab99d071a9bb565ec7d45d86396b", "ja3_variant_count": 1, "ja3_variants": [ "4276ab99d071a9bb565ec7d45d86396b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_6376cb8fadaa_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "6376cb8fadaa", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,57-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703171, "transport": "t", "ja3_hash": "96bf90f6bee914afb153b4e0352f9192", "ja3_variant_count": 1, "ja3_variants": [ "96bf90f6bee914afb153b4e0352f9192" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_671e0306a5cb_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "671e0306a5cb", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,19-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703168, "transport": "t", "ja3_hash": "f578dcb22423ac294d1ee0298a00c8df", "ja3_variant_count": 1, "ja3_variants": [ "f578dcb22423ac294d1ee0298a00c8df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_69d181a99895_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "69d181a99895", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,152-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703171, "transport": "t", "ja3_hash": "6cd0a2ffd5bd5f5b4cc48fb43bf26e26", "ja3_variant_count": 1, "ja3_variants": [ "6cd0a2ffd5bd5f5b4cc48fb43bf26e26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_6d6b3751bd69_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "6d6b3751bd69", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,153-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703172, "transport": "t", "ja3_hash": "137dd98cadc0cccca1b172c2d4da5aae", "ja3_variant_count": 1, "ja3_variants": [ "137dd98cadc0cccca1b172c2d4da5aae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_72fe80e83b5d_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "72fe80e83b5d", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,13-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703169, "transport": "t", "ja3_hash": "88b839e163b900f7f102c336cb3d1ee2", "ja3_variant_count": 1, "ja3_variants": [ "88b839e163b900f7f102c336cb3d1ee2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_7ba938555a01_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "7ba938555a01", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,25-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703169, "transport": "t", "ja3_hash": "d6d66ce5bd02829baa1456751bc9c2ff", "ja3_variant_count": 1, "ja3_variants": [ "d6d66ce5bd02829baa1456751bc9c2ff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_85064055552b_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "85064055552b", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,151-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703168, "transport": "t", "ja3_hash": "f6420f0c7e9198ffdd103c3dee5419d0", "ja3_variant_count": 1, "ja3_variants": [ "f6420f0c7e9198ffdd103c3dee5419d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_86ae22adfd52_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "86ae22adfd52", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,52-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703169, "transport": "t", "ja3_hash": "4589064635c084c6d927f588d2dba5d4", "ja3_variant_count": 1, "ja3_variants": [ "4589064635c084c6d927f588d2dba5d4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_8764e5090277_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "8764e5090277", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,135-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703169, "transport": "t", "ja3_hash": "32d03b6a4afeade96c03f01fddbfe457", "ja3_variant_count": 1, "ja3_variants": [ "32d03b6a4afeade96c03f01fddbfe457" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_8cde4933ab6b_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "8cde4933ab6b", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,26-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703167, "transport": "t", "ja3_hash": "9a96daf83235ac19b9754b47fa362e45", "ja3_variant_count": 1, "ja3_variants": [ "9a96daf83235ac19b9754b47fa362e45" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_8d2fb8454607_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "8d2fb8454607", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,70-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703170, "transport": "t", "ja3_hash": "8576125549d965101e9b34bb5b074566", "ja3_variant_count": 1, "ja3_variants": [ "8576125549d965101e9b34bb5b074566" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_9cb11800989c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "9cb11800989c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,155-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825517, "last_seen": 1790703170, "transport": "t", "ja3_hash": "69343daacb932f37db72ea8752939427", "ja3_variant_count": 1, "ja3_variants": [ "69343daacb932f37db72ea8752939427" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_a0f473027383_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "a0f473027383", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,2-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825518, "last_seen": 1790703168, "transport": "t", "ja3_hash": "324dadb77c22c69ea21fc43c4a2d5742", "ja3_variant_count": 1, "ja3_variants": [ "324dadb77c22c69ea21fc43c4a2d5742" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_a5878986a7c9_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "a5878986a7c9", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,47-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703169, "transport": "t", "ja3_hash": "d7ec7d75b7ce78cd8eb846de502a9731", "ja3_variant_count": 1, "ja3_variants": [ "d7ec7d75b7ce78cd8eb846de502a9731" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_a8d286a27066_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "a8d286a27066", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,23-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703170, "transport": "t", "ja3_hash": "c9d9c170168d839d584ee7f695ab1f18", "ja3_variant_count": 1, "ja3_variants": [ "c9d9c170168d839d584ee7f695ab1f18" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_b0ed54973b0f_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "b0ed54973b0f", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,50-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703168, "transport": "t", "ja3_hash": "390b8382cd46a0934ef320bbbed81084", "ja3_variant_count": 1, "ja3_variants": [ "390b8382cd46a0934ef320bbbed81084" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_bae431c474f8_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "bae431c474f8", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,66-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703168, "transport": "t", "ja3_hash": "83da98b99e621c883a2005bbf8aee4c4", "ja3_variant_count": 1, "ja3_variants": [ "83da98b99e621c883a2005bbf8aee4c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_c259c416e32c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "c259c416e32c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,12-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703169, "transport": "t", "ja3_hash": "555b43f780e5455cc174aa5806b8cc8c", "ja3_variant_count": 1, "ja3_variants": [ "555b43f780e5455cc174aa5806b8cc8c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_c38774e7e0a0_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "c38774e7e0a0", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,22-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703171, "transport": "t", "ja3_hash": "62c9d925f44040c29a85ec91b1f3fc6f", "ja3_variant_count": 1, "ja3_variants": [ "62c9d925f44040c29a85ec91b1f3fc6f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_c3df0a865ad8_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "c3df0a865ad8", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,150-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703172, "transport": "t", "ja3_hash": "ed13ef59895b6c10ac255e0dd147f56f", "ja3_variant_count": 1, "ja3_variants": [ "ed13ef59895b6c10ac255e0dd147f56f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_c9fe23a5d87c_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "c9fe23a5d87c", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,67-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703170, "transport": "t", "ja3_hash": "3eb4e3ab0388351289c62c7faa045a5e", "ja3_variant_count": 1, "ja3_variants": [ "3eb4e3ab0388351289c62c7faa045a5e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_d25758f9cc88_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "d25758f9cc88", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,24-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703168, "transport": "t", "ja3_hash": "7a6711ec0c6f47001f72c0ad413c44e5", "ja3_variant_count": 1, "ja3_variants": [ "7a6711ec0c6f47001f72c0ad413c44e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_d83d06a7b5eb_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "d83d06a7b5eb", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,134-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703168, "transport": "t", "ja3_hash": "476b5a4716ca2c3fa86fee30d1d0c0fc", "ja3_variant_count": 1, "ja3_variants": [ "476b5a4716ca2c3fa86fee30d1d0c0fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_d99cf322fdea_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "d99cf322fdea", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,133-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703169, "transport": "t", "ja3_hash": "a94ec3bf0aefbb3d4517277925bb146b", "ja3_variant_count": 1, "ja3_variants": [ "a94ec3bf0aefbb3d4517277925bb146b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_da5e85b893fc_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "da5e85b893fc", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,10-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703170, "transport": "t", "ja3_hash": "6441a2dc314cac5ca3e10c8b04875343", "ja3_variant_count": 1, "ja3_variants": [ "6441a2dc314cac5ca3e10c8b04875343" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_e03107c9d76e_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "e03107c9d76e", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,5-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703170, "transport": "t", "ja3_hash": "02e453705d92b5e55c02fd04616cf914", "ja3_variant_count": 1, "ja3_variants": [ "02e453705d92b5e55c02fd04616cf914" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_e530588400b6_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "e530588400b6", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,132-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703171, "transport": "t", "ja3_hash": "fb25330b1c97c1dec87ee6aaf628da95", "ja3_variant_count": 1, "ja3_variants": [ "fb25330b1c97c1dec87ee6aaf628da95" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_ea1f27bcdcc2_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "ea1f27bcdcc2", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,136-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703170, "transport": "t", "ja3_hash": "e339224df74b79430cef573941a1ae08", "ja3_variant_count": 1, "ja3_variants": [ "e339224df74b79430cef573941a1ae08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_ed19d00bad77_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "ed19d00bad77", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,21-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703170, "transport": "t", "ja3_hash": "0405e4ba3dc633db829118db06858d17", "ja3_variant_count": 1, "ja3_variants": [ "0405e4ba3dc633db829118db06858d17" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_eea8af79bad9_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "eea8af79bad9", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,69-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825519, "last_seen": 1790703171, "transport": "t", "ja3_hash": "97361fd2be7693286243645d871c6eea", "ja3_variant_count": 1, "ja3_variants": [ "97361fd2be7693286243645d871c6eea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_f2d8273d9564_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "f2d8273d9564", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,53-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703169, "transport": "t", "ja3_hash": "15527e5f7116366575c89314b75bcc97", "ja3_variant_count": 1, "ja3_variants": [ "15527e5f7116366575c89314b75bcc97" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_f4b95c39a23e_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "f4b95c39a23e", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,6-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703170, "transport": "t", "ja3_hash": "2999c52f0834aa567a650c95d32fa29e", "ja3_variant_count": 1, "ja3_variants": [ "2999c52f0834aa567a650c95d32fa29e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_fa20206d2144_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "fa20206d2144", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,7-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825518, "last_seen": 1790703170, "transport": "t", "ja3_hash": "f9d8bc9e0bf72cf4ca925b99bb41f73e", "ja3_variant_count": 1, "ja3_variants": [ "f9d8bc9e0bf72cf4ca925b99bb41f73e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_fbc32bd69299_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "fbc32bd69299", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,8-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703169, "transport": "t", "ja3_hash": "103ee02ec625cfec314c45eb62483094", "ja3_variant_count": 1, "ja3_variants": [ "103ee02ec625cfec314c45eb62483094" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020300_fd2d85721aa5_ea3b9dc90bff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020300", "b": "fd2d85721aa5", "c": "ea3b9dc90bff", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 3, "alpn": null } }, "ja3_string": "770,54-255,0-35-15,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703169, "transport": "t", "ja3_hash": "e03adae83874dc088f764876e3c1d362", "ja3_variant_count": 1, "ja3_variants": [ "e03adae83874dc088f764876e3c1d362" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_049d0968ef63_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "049d0968ef63", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49174-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703170, "transport": "t", "ja3_hash": "c043373d5acac4d4b4ecf85a53362531", "ja3_variant_count": 1, "ja3_variants": [ "c043373d5acac4d4b4ecf85a53362531" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_0d62a58dd912_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "0d62a58dd912", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49169-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703170, "transport": "t", "ja3_hash": "034295d979b89048bfdc682f626eb2f5", "ja3_variant_count": 1, "ja3_variants": [ "034295d979b89048bfdc682f626eb2f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_2ac205266896_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "2ac205266896", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49173-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825517, "last_seen": 1790703168, "transport": "t", "ja3_hash": "f18cac79fe747500491c6a0735a654f2", "ja3_variant_count": 1, "ja3_variants": [ "f18cac79fe747500491c6a0735a654f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_48762405b09c_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "48762405b09c", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49157-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703171, "transport": "t", "ja3_hash": "ccf5ed67067dabb97f6b3679ca5cd1c0", "ja3_variant_count": 1, "ja3_variants": [ "ccf5ed67067dabb97f6b3679ca5cd1c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_4eff32302ec7_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "4eff32302ec7", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49160-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825522, "last_seen": 1790703172, "transport": "t", "ja3_hash": "db7cb9f6bb1d358a8d6f1b28294202fb", "ja3_variant_count": 1, "ja3_variants": [ "db7cb9f6bb1d358a8d6f1b28294202fb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_4f4bd29a6b59_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "4f4bd29a6b59", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49175-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703168, "transport": "t", "ja3_hash": "b6bbf002289d4409e97c61e716148806", "ja3_variant_count": 1, "ja3_variants": [ "b6bbf002289d4409e97c61e716148806" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_55a2bbf9cbd7_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "55a2bbf9cbd7", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49164-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703170, "transport": "t", "ja3_hash": "1ad29174c456c1011a95aea1473ecc20", "ja3_variant_count": 1, "ja3_variants": [ "1ad29174c456c1011a95aea1473ecc20" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_57ba72230e7a_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "57ba72230e7a", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49167-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703169, "transport": "t", "ja3_hash": "d7655d993e9625b52b4e7c3136771e65", "ja3_variant_count": 1, "ja3_variants": [ "d7655d993e9625b52b4e7c3136771e65" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_59980b593f60_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "59980b593f60", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49176-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703168, "transport": "t", "ja3_hash": "09adb7efba899ba62b05660a2d2941d5", "ja3_variant_count": 1, "ja3_variants": [ "09adb7efba899ba62b05660a2d2941d5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_5b44afd80a2d_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "5b44afd80a2d", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49156-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703170, "transport": "t", "ja3_hash": "6099c835887b9fc208bd3e597df78f79", "ja3_variant_count": 1, "ja3_variants": [ "6099c835887b9fc208bd3e597df78f79" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_68cd44b4e773_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "68cd44b4e773", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49162-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703169, "transport": "t", "ja3_hash": "3902a3e31d0cf1497c02b333dd1b4b8c", "ja3_variant_count": 1, "ja3_variants": [ "3902a3e31d0cf1497c02b333dd1b4b8c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_89e01831f9a8_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "89e01831f9a8", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49153-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703169, "transport": "t", "ja3_hash": "d9114dca6a691a912068ad0912a9dab7", "ja3_variant_count": 1, "ja3_variants": [ "d9114dca6a691a912068ad0912a9dab7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_8fc24edd70fe_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "8fc24edd70fe", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49163-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703169, "transport": "t", "ja3_hash": "670e220e2fd76d42249054590b04f050", "ja3_variant_count": 1, "ja3_variants": [ "670e220e2fd76d42249054590b04f050" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_9b38dd297dfe_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "9b38dd297dfe", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49168-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703169, "transport": "t", "ja3_hash": "2d6b844024363110f263a64842c48829", "ja3_variant_count": 1, "ja3_variants": [ "2d6b844024363110f263a64842c48829" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_a0546e0689fc_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "a0546e0689fc", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49171-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703171, "transport": "t", "ja3_hash": "5b1b32c2139f4a8a993de7b8fe1a612e", "ja3_variant_count": 1, "ja3_variants": [ "5b1b32c2139f4a8a993de7b8fe1a612e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_a89416eb2da9_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "a89416eb2da9", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49177-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703169, "transport": "t", "ja3_hash": "d87b695f845df7a2c96d078b9e2d4db3", "ja3_variant_count": 1, "ja3_variants": [ "d87b695f845df7a2c96d078b9e2d4db3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_bad2b1bd13d4_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "bad2b1bd13d4", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49155-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703167, "transport": "t", "ja3_hash": "5242dbe63dac20c841bd3ebcb0301275", "ja3_variant_count": 1, "ja3_variants": [ "5242dbe63dac20c841bd3ebcb0301275" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_c4610a930072_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "c4610a930072", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49159-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703169, "transport": "t", "ja3_hash": "4c5f33c72e436af8fc1a611a5e5e2c1d", "ja3_variant_count": 1, "ja3_variants": [ "4c5f33c72e436af8fc1a611a5e5e2c1d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_c66b7cee1896_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "c66b7cee1896", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49161-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825518, "last_seen": 1790703168, "transport": "t", "ja3_hash": "8c1d9b776226ac1cb18dbc37a3264e8c", "ja3_variant_count": 1, "ja3_variants": [ "8c1d9b776226ac1cb18dbc37a3264e8c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_cc27769a2ea2_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "cc27769a2ea2", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49165-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703170, "transport": "t", "ja3_hash": "2d18a1794435114ef8c15c45810146dc", "ja3_variant_count": 1, "ja3_variants": [ "2d18a1794435114ef8c15c45810146dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_d0ac5cb1209a_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "d0ac5cb1209a", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49172-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703171, "transport": "t", "ja3_hash": "900a8817a4fad0b220990950b589e4e3", "ja3_variant_count": 1, "ja3_variants": [ "900a8817a4fad0b220990950b589e4e3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_d576ba9a1b51_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "d576ba9a1b51", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49154-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703169, "transport": "t", "ja3_hash": "55ce12fc45791ac16b02ab24b34ca489", "ja3_variant_count": 1, "ja3_variants": [ "55ce12fc45791ac16b02ab24b34ca489" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_efa2d734833b_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "efa2d734833b", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49158-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703169, "transport": "t", "ja3_hash": "bd56a21d0d3609022e969ba4bc8d2885", "ja3_variant_count": 1, "ja3_variants": [ "bd56a21d0d3609022e969ba4bc8d2885" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_f17337cd55b5_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "f17337cd55b5", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49166-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703171, "transport": "t", "ja3_hash": "10d2afb8014c9b6103f1e44d5474a2b7", "ja3_variant_count": 1, "ja3_variants": [ "10d2afb8014c9b6103f1e44d5474a2b7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d020500_f3042cbcf579_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d020500", "b": "f3042cbcf579", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49170-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703170, "transport": "t", "ja3_hash": "f32fdd85f37647cb961e99cb39338bb3", "ja3_variant_count": 1, "ja3_variants": [ "f32fdd85f37647cb961e99cb39338bb3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d040300_058957366436_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d040300", "b": "058957366436", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 4, "extension_count": 3, "alpn": null } }, "ja3_string": "770,49185-49178-49181-49184,10-0-11,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "c37c3f0798ad6388c71c1ffca2dedcc3", "ja3_variant_count": 1, "ja3_variants": [ "c37c3f0798ad6388c71c1ffca2dedcc3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d070100_c50f5591e341_4c2e34f23e4d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d070100", "b": "c50f5591e341", "c": "4c2e34f23e4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 7, "extension_count": 1, "alpn": null } }, "ja3_string": "770,10-47-53-49161-49162-49171-49172,0,,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791319585, "last_seen": 1791319585, "transport": "t", "ja3_hash": "c5acb5ecb3635c1c5daa08bc7f683533", "ja3_variant_count": 1, "ja3_variants": [ "c5acb5ecb3635c1c5daa08bc7f683533" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d070700_c50f5591e341_661ff8826348", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d070700", "b": "c50f5591e341", "c": "661ff8826348", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "770,49162-49161-49172-49171-53-47-10,0-5-10-11-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789450884, "last_seen": 1789450886, "transport": "t", "ja3_hash": "a5fdc0149729da1212fc5714e1d1b928", "ja3_variant_count": 1, "ja3_variants": [ "a5fdc0149729da1212fc5714e1d1b928" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d080700_dafb69683c10_18ee6cfe2d80", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d080700", "b": "dafb69683c10", "c": "18ee6cfe2d80", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 8, "extension_count": 7, "alpn": null } }, "ja3_string": "770,49171-49161-49172-49162-47-53-49170-10,0-5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 169, "first_seen": 1787495084, "last_seen": 1791353487, "transport": "t", "ja3_hash": "bf5f7815620bde1949ecc250ec7b3101", "ja3_variant_count": 1, "ja3_variants": [ "bf5f7815620bde1949ecc250ec7b3101" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d090600_c491f621fb4c_80d8baa1f8cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d090600", "b": "c491f621fb4c", "c": "80d8baa1f8cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 9, "extension_count": 6, "alpn": null } }, "ja3_string": "770,49162-49172-57-49161-49171-51-53-47-255,0-11-10-35-22-23,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 15, "first_seen": 1787697748, "last_seen": 1790717118, "transport": "t", "ja3_hash": "1d41372cac33d51bb9265e8f91bf1df0", "ja3_variant_count": 1, "ja3_variants": [ "1d41372cac33d51bb9265e8f91bf1df0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d110700_3790f16dbcf6_18ee6cfe2d80", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d110700", "b": "3790f16dbcf6", "c": "18ee6cfe2d80", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 11, "extension_count": 7, "alpn": null } }, "ja3_string": "770,10-47-53-49161-49162-49170-49171-49172-5-49159-49169,0-5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787969613, "last_seen": 1791001309, "transport": "t", "ja3_hash": "2832c3d8fd7db7c4ae5ffe8fcc768046", "ja3_variant_count": 1, "ja3_variants": [ "2832c3d8fd7db7c4ae5ffe8fcc768046" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d130300_48b83dc3bfb9_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d130300", "b": "48b83dc3bfb9", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 13, "extension_count": 3, "alpn": null } }, "ja3_string": "770,255-49162-49172-57-56-49157-49167-49161-49171-51-50-49156-49166,0-10-11,14-13-25-28-11-12-27-24-9-10-26-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787710528, "last_seen": 1791081129, "transport": "t", "ja3_hash": "12216f2b983b2391ce10bfb973c4367c", "ja3_variant_count": 1, "ja3_variants": [ "12216f2b983b2391ce10bfb973c4367c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d170600_89907b424de5_80d8baa1f8cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d170600", "b": "89907b424de5", "c": "80d8baa1f8cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 17, "extension_count": 6, "alpn": null } }, "ja3_string": "770,49171-49161-49172-49162-51-56-57-50-47-53-136-135-69-68-132-65-255,0-11-10-35-22-23,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788750545, "last_seen": 1788750545, "transport": "t", "ja3_hash": "1cda5e2b9473f2842c20a9b6fa3c3f8a", "ja3_variant_count": 1, "ja3_variants": [ "1cda5e2b9473f2842c20a9b6fa3c3f8a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d210500_1e0f66cc3f83_5551bc6d1e9a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d210500", "b": "1e0f66cc3f83", "c": "5551bc6d1e9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 21, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49160-57-51-22-4-20-21-8-6-3,0-5-10-11-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 44, "first_seen": 1787464623, "last_seen": 1791289940, "transport": "t", "ja3_hash": "7dad196697fa2c86aabe5422effe4eca", "ja3_variant_count": 1, "ja3_variants": [ "7dad196697fa2c86aabe5422effe4eca" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d220700_6ef92d04e905_767e63493228", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d220700", "b": "6ef92d04e905", "c": "767e63493228", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 22, "extension_count": 7, "alpn": null } }, "ja3_string": "770,49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-53-132-47-65,65281-0-11-10-35-22-23,29-23-30-24-25,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 100, "first_seen": 1791326656, "last_seen": 1791363210, "transport": "t", "ja3_hash": "5f0218e2ed97eb6987445e32f009fb7e", "ja3_variant_count": 1, "ja3_variants": [ "5f0218e2ed97eb6987445e32f009fb7e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d320500_5771160a495d_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d320500", "b": "5771160a495d", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 32, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49172-49162-57-56-55-54-49167-49157-53-49171-49161-51-50-49-48-49166-49156-47-154-153-152-151-150-7-49169-49159-49164-49154-5-4-255-22016,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 22016, "name": "22016 (0x5600)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787825499, "last_seen": 1791319589, "transport": "t", "ja3_hash": "5c2516aba5bf6d399c313d2b103d9954", "ja3_variant_count": 1, "ja3_variants": [ "5c2516aba5bf6d399c313d2b103d9954" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d420300_4a5d165148b5_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d420300", "b": "4a5d165148b5", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 42, "extension_count": 3, "alpn": null } }, "ja3_string": "770,4-5-10-13-16-19-22-47-48-49-50-51-53-54-55-56-57-65-68-69-102-132-135-136-150-255-49154-49155-49156-49157-49159-49160-49161-49162-49164-49165-49166-49167-49169-49170-49171-49172,0-11-10,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17-29,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509856, "last_seen": 1791290839, "transport": "t", "ja3_hash": "9ec8baa55c1238cd64f92b0c211432a0", "ja3_variant_count": 1, "ja3_variants": [ "9ec8baa55c1238cd64f92b0c211432a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d500500_59a6c70126c8_479c5bbe3102", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d500500", "b": "59a6c70126c8", "c": "479c5bbe3102", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 50, "extension_count": 5, "alpn": null } }, "ja3_string": "770,49172-49162-57-56-55-54-136-135-134-133-49167-49157-53-132-49171-49161-51-50-49-48-154-153-152-151-69-68-67-66-49166-49156-47-150-65-7-49169-49159-49164-49154-5-4-49170-49160-22-19-16-13-49165-49155-10-255,0-11-10-35-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 20, "first_seen": 1788869208, "last_seen": 1790193499, "transport": "t", "ja3_hash": "819e53a1b1502a51c778ca638b1a6a61", "ja3_variant_count": 1, "ja3_variants": [ "819e53a1b1502a51c778ca638b1a6a61" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d640300_1715b94e3896_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d640300", "b": "1715b94e3896", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182,10-0-11,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "404741491f8aac88a13ee62142c7aecb", "ja3_variant_count": 1, "ja3_variants": [ "404741491f8aac88a13ee62142c7aecb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d640300_1e98fdfb27e9_6bf8f498b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d640300", "b": "1e98fdfb27e9", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49411-49413-49409-49412-49414-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138,10-0-11,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "2b275014f91aa30d7b0bdeb0f06502f2", "ja3_variant_count": 1, "ja3_variants": [ "2b275014f91aa30d7b0bdeb0f06502f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11d6911ht_ea0618708e31_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d6911ht", "b": "ea0618708e31", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "770,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1282, "first_seen": 1787442798, "last_seen": 1791347877, "transport": "t", "ja3_hash": "006315b3ad276906ff11527f9594e5ba", "ja3_variant_count": 1, "ja3_variants": [ "006315b3ad276906ff11527f9594e5ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i040200_058957366436_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i040200", "b": "058957366436", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 2, "alpn": null } }, "ja3_string": "770,49185-49178-49181-49184,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748802, "last_seen": 1791319601, "transport": "t", "ja3_hash": "395d06a709cf2d62787ce57c0d4c8a66", "ja3_variant_count": 2, "ja3_variants": [ "395d06a709cf2d62787ce57c0d4c8a66", "b2927eac2c1b7e122fb67c30c79f949f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i040700_cefcabfea53d_28adf769107b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i040700", "b": "cefcabfea53d", "c": "28adf769107b", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 7, "alpn": null } }, "ja3_string": "770,49161-49171-49162-49172,11-65281-23-18-5-10-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 236, "first_seen": 1787448772, "last_seen": 1791346376, "transport": "t", "ja3_hash": "51da711b7d569fac858b548296cc5ca0", "ja3_variant_count": 1, "ja3_variants": [ "51da711b7d569fac858b548296cc5ca0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i080600_dafb69683c10_166ed56ebb15", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i080600", "b": "dafb69683c10", "c": "166ed56ebb15", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 6, "alpn": null } }, "ja3_string": "770,49171-49161-49172-49162-47-53-49170-10,5-10-11-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 165, "first_seen": 1787506159, "last_seen": 1791359326, "transport": "t", "ja3_hash": "bee6b3e6ef3df345dce8323ac55fe31f", "ja3_variant_count": 1, "ja3_variants": [ "bee6b3e6ef3df345dce8323ac55fe31f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i150700_0dfbaf47f5cc_e144c465795a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i150700", "b": "0dfbaf47f5cc", "c": "e144c465795a", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "770,49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-53-47-255,5-10-11-17-23-35-43,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788737389, "last_seen": 1788737389, "transport": "t", "ja3_hash": "94c7e1172dee50f3fa37f53337b1821c", "ja3_variant_count": 1, "ja3_variants": [ "94c7e1172dee50f3fa37f53337b1821c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i200800_0bf03fa604e3_fe2522846a15", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i200800", "b": "0bf03fa604e3", "c": "fe2522846a15", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 8, "alpn": null } }, "ja3_string": "770,49162-49172-57-107-53-61-49159-49161-49187-49169-49171-49191-51-103-50-5-4-47-60-10,61184-65281-10-11-35-13172-30031-5,23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 61184, "name": "61184 (0xef00)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 30031, "name": "30031 (0x754f)", "known": false }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 55, "first_seen": 1787538280, "last_seen": 1791321578, "transport": "t", "ja3_hash": "18e9afaf91db6f8a2470e7435c2a1d6b", "ja3_variant_count": 1, "ja3_variants": [ "18e9afaf91db6f8a2470e7435c2a1d6b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_13a2a23d501b_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "13a2a23d501b", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787820544, "last_seen": 1789027738, "transport": "t", "ja3_hash": "358dcfa8315581a920432fa371d4f75f", "ja3_variant_count": 1, "ja3_variants": [ "358dcfa8315581a920432fa371d4f75f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_1715b94e3896_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "1715b94e3896", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748799, "last_seen": 1791319601, "transport": "t", "ja3_hash": "97576419ccffed20d01f7ea996805a0e", "ja3_variant_count": 2, "ja3_variants": [ "97576419ccffed20d01f7ea996805a0e", "71bc7c0bea5205f71f4ec01eeeea99cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_1e98fdfb27e9_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "1e98fdfb27e9", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49411-49413-49409-49412-49414-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748800, "last_seen": 1791319600, "transport": "t", "ja3_hash": "7cd4f082091773003500e04573b13cc3", "ja3_variant_count": 2, "ja3_variants": [ "7cd4f082091773003500e04573b13cc3", "976693787881a4b326947f32bd6fe3e9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_67f0ca237a44_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "67f0ca237a44", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,11-10,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787820542, "last_seen": 1789027736, "transport": "t", "ja3_hash": "4cf905cd9c0c9726be4039ee4fa7dbfd", "ja3_variant_count": 1, "ja3_variants": [ "4cf905cd9c0c9726be4039ee4fa7dbfd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_a3acda31d846_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "a3acda31d846", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1787820541, "last_seen": 1791319599, "transport": "t", "ja3_hash": "fd449c76cf71d3dc70c71c19bd0cfccf", "ja3_variant_count": 3, "ja3_variants": [ "fd449c76cf71d3dc70c71c19bd0cfccf", "92a5a0cbf6c197caf78ddd535bdaabc6", "ca7bfb146cd804756d745dd8f2bff9e4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_e31a90cd0803_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "e31a90cd0803", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1787820540, "last_seen": 1791319599, "transport": "t", "ja3_hash": "f44c27ddb35bd3a6effa634189bc02d8", "ja3_variant_count": 3, "ja3_variants": [ "f44c27ddb35bd3a6effa634189bc02d8", "0eaa05ee342d9089e87b771465ead0ae", "41f188ded3309ebe455f84fcbf0facba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_e7b476f9520b_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "e7b476f9520b", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1787820537, "last_seen": 1791319598, "transport": "t", "ja3_hash": "41cf7ae575059d6f9a98b3de95c71539", "ja3_variant_count": 3, "ja3_variants": [ "41cf7ae575059d6f9a98b3de95c71539", "7e65b148cca26a2244514e19d228d77c", "1101d7287f077b7212708da2194e910a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i640200_f559eb9565fd_c2f961105e84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i640200", "b": "f559eb9565fd", "c": "c2f961105e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 2, "alpn": null } }, "ja3_string": "770,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,11-10,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1787820544, "last_seen": 1791319600, "transport": "t", "ja3_hash": "9ef6c95521c2ab5006c236ff0047fab1", "ja3_variant_count": 3, "ja3_variants": [ "9ef6c95521c2ab5006c236ff0047fab1", "46ab3b3aea531a6e66f5685c5243fd37", "605b7b15b1152b98baf596b3cfa4e503" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t11i990200_0df3f6915705_357e3bc58f3d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i990200", "b": "0df3f6915705", "c": "357e3bc58f3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 2, "alpn": null } }, "ja3_string": "770,184-49213-49410-49154-49-98-198-49174-49240-153-49153-49261-65-49187-36-38-115-49313-44-7-49323-124-60-163-82-49223-55-45-32-62-185-164-49250-189-49239-49176-49254-49270-146-186-107-103-17-11-49182-19-65278-53251-8-49287-97-13-49175-92-49217-49189-90-68-108-190-50-4-49256-2-49268-48-49249-49320-49177-43-64-49283-49202-49222-49295-34-49218-49299-49293-152-49204-181-51-49158-166-49243-165-49210-49169-49275-49282-102-24-49209-12-106-74-52396-139-49165-129-20-66-52-89-49186-80-49301-31-85-199-49228-49207-4870-49157-49281-105-114-49409-63-4867-4866-4865-148-49230-58-21-39-53253-53250-99-49309-175-49266-49179-100-52397-83-52395-49328-28-53-49327-49258-49264-52393-49294-168-52245-182-49247-167-49306-52243-192-49414-42-49413-49412-142-49411-49236-76-140-49237-131-49330-49333-49166-26-49332-4869-14-6-144-138-49329-160-49219-49170-49326-70-49325-16-126-49229-49203-49289-49248-49324-49322-49321-49198-49318-49317-156-49316-49315-49290-49314-87-196-79-49311-49310-171-49307-52244-75-49201-157-173-49163-86-49233-49211-197-49161-49302-49300-49180-154-27-33-54-49297-49184-49296-145-46-49225-15-0-52398-49167-49288-49253-49285-49194-49244-71-49280-49172-49279-49278-96-25-49277-49276-49159-69-49274-49273-170-23-49271-49269-49267-91-52394-49246-128-49262-18-4871-49259-49257-49255-49286-172-133-195-49252-49251-49263-141-49245-49242-116-176-49241-49171-49238-49162-49196-147-130-49234-49224-72-49232-49231-49260-49272-49226-10-183-150-49216-81-78-49181-49164-49215-193-49212-49305-49160-49208-40-49206-151-49193-49205-61-49200-49214-49319-49197-49235-49195-49284-67-49192-22-49191-49190-49188-49185-49303-49298-49291-3-49178-49173-77-49168-49183-59-161-35-49331-194-5-49155-37-49304-49156-49199-191-109-30-187-49221-180-179-178-177-53249-174-49308-49227-73-169-52392-162-104-155-158-159-88-134-49220-101-65279-49292-143-49408-41-137-136-135-1-132-125-121-120-119-188-149-49265-29-49312-57-4868-84-56-47-9,15-10,23-24-25-29-256-4588,", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 4870, "name": "4870 (0x1306)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 4871, "name": "4871 (0x1307)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false } ], "extensions": [ { "value": 15, "name": "heartbeat", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788737423, "last_seen": 1790001783, "transport": "t", "ja3_hash": "706bec56b1759c61b411f551b01a2171", "ja3_variant_count": 6, "ja3_variants": [ "706bec56b1759c61b411f551b01a2171", "923044aeda9e16eabbb44bc3bb1073d3", "58dced644ea9e4e51cbc9cfc7b366aa4", "07cc6180324d1cefb803ebcf40382fb3", "9188d6c1670d0ad22dbc300e3ff4a70d", "b5699e73c695bcd17f852491c3b6be92" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d060400_272d6f91cd02_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d060400", "b": "272d6f91cd02", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 6, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49179-49182-49185-49178-49181-49184,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710045, "last_seen": 1788842295, "transport": "t", "ja3_hash": "b9dcb8b7cad8f18737663d236068d285", "ja3_variant_count": 4, "ja3_variants": [ "b9dcb8b7cad8f18737663d236068d285", "f1e69f2ace5cf1f2ada9a07fccc545b7", "f264a1120dffe2e9c1652ab24cdf0578", "d554c462404afbfb1665a652ae168077" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150300_8daaf6152771_429494ee3f11", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (429494ee3f11) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "429494ee3f11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788457388, "last_seen": 1789701013, "transport": "t", "ja3_hash": "aef3af566cf8d969f0386e1d7c2e03a0", "ja3_variant_count": 1, "ja3_variants": [ "aef3af566cf8d969f0386e1d7c2e03a0" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150300_8daaf6152771_470e2cdabb19", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "470e2cdabb19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789862591, "last_seen": 1790202096, "transport": "t", "ja3_hash": "b7951727d9fec3ceb1cd1d29bc4da4d4", "ja3_variant_count": 2, "ja3_variants": [ "b7951727d9fec3ceb1cd1d29bc4da4d4", "b9ebf51c0b3a54c05672e8c7b3afd1c4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_a9ab1794f21f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "a9ab1794f21f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791052223, "last_seen": 1791052223, "transport": "t", "ja3_hash": "2fbfdd6c8a9bd871b28e68a13830b009", "ja3_variant_count": 1, "ja3_variants": [ "2fbfdd6c8a9bd871b28e68a13830b009" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_15e6577891ef", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "15e6577891ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-0-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790068849, "last_seen": 1790068849, "transport": "t", "ja3_hash": "a7cac8dc63c464f20fd78377d9b91b05", "ja3_variant_count": 1, "ja3_variants": [ "a7cac8dc63c464f20fd78377d9b91b05" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.7871.63 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_6c79f84a1e4a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "6c79f84a1e4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-27-45-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790881521, "last_seen": 1790881521, "transport": "t", "ja3_hash": "6bf5c49e3a02c8c00608e18fcd215ff8", "ja3_variant_count": 1, "ja3_variants": [ "6bf5c49e3a02c8c00608e18fcd215ff8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_04cf01d6322c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "04cf01d6322c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-51-10-23-17613-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790329514, "last_seen": 1790329514, "transport": "t", "ja3_hash": "5be5c97ea7fe57f292816c05987088c1", "ja3_variant_count": 1, "ja3_variants": [ "5be5c97ea7fe57f292816c05987088c1" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_f118e9da87e9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "f118e9da87e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-10-45-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791217043, "last_seen": 1791217043, "transport": "t", "ja3_hash": "2635e77363ca63799ffefe57548c2158", "ja3_variant_count": 1, "ja3_variants": [ "2635e77363ca63799ffefe57548c2158" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_4e0b33d966cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "4e0b33d966cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-11-23-0-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789526915, "last_seen": 1789526915, "transport": "t", "ja3_hash": "923634a4eb2b82fb7243a08df62376eb", "ja3_variant_count": 1, "ja3_variants": [ "923634a4eb2b82fb7243a08df62376eb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_3dff13c980b9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "3dff13c980b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-23-11-65281-16-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788962450, "last_seen": 1788962450, "transport": "t", "ja3_hash": "b9eb9353c8d14a7767d0a218f89d6311", "ja3_variant_count": 1, "ja3_variants": [ "b9eb9353c8d14a7767d0a218f89d6311" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_44a135ab3209", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "44a135ab3209", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-23-0-16-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790882508, "last_seen": 1790882508, "transport": "t", "ja3_hash": "db7747a794b98179e873ee9cdf380be5", "ja3_variant_count": 1, "ja3_variants": [ "db7747a794b98179e873ee9cdf380be5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_55c16fca920c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "55c16fca920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-17613-0-65281-23-27-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788516981, "last_seen": 1788516981, "transport": "t", "ja3_hash": "c8b1189c1b852963a6f2361f95da9c47", "ja3_variant_count": 1, "ja3_variants": [ "c8b1189c1b852963a6f2361f95da9c47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_8adbbb1f1cd4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "8adbbb1f1cd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-16-65037-27-35-0-45-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791067879, "last_seen": 1791067879, "transport": "t", "ja3_hash": "aa6cafb708be36e7c5e333c8fda7d3b9", "ja3_variant_count": 1, "ja3_variants": [ "aa6cafb708be36e7c5e333c8fda7d3b9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_40cda8dfb402", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "40cda8dfb402", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-11-5-0-17613-16-65281-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949153, "last_seen": 1789949153, "transport": "t", "ja3_hash": "d1dcefe0c49d58f2c3b95b5ab15cc549", "ja3_variant_count": 1, "ja3_variants": [ "d1dcefe0c49d58f2c3b95b5ab15cc549" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1db44c5aa782", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1db44c5aa782", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-13-5-11-17613-10-65281-65037-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949103, "last_seen": 1789949103, "transport": "t", "ja3_hash": "4346b28db0dca52137a4819114712c0a", "ja3_variant_count": 1, "ja3_variants": [ "4346b28db0dca52137a4819114712c0a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_61d4432aff07", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "61d4432aff07", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-23-0-65037-35-45-27-65281-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790533896, "last_seen": 1790533896, "transport": "t", "ja3_hash": "234ad89337e55a895082f95f069a83f7", "ja3_variant_count": 1, "ja3_variants": [ "234ad89337e55a895082f95f069a83f7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_564d7693bc92", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "564d7693bc92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-27-65281-0-35-16-45-18-17613-5-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789950111, "last_seen": 1790244506, "transport": "t", "ja3_hash": "669a60a3e6ce36cf3bdc7c7bc3759c2e", "ja3_variant_count": 3, "ja3_variants": [ "669a60a3e6ce36cf3bdc7c7bc3759c2e", "11e13976c0770048fc37ab1dd8b149ef", "cf6e4153b3ebba768f798aac0da11823" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_b302c6cb872d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "b302c6cb872d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-18-23-5-11-35-45-65037-27-17613-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789232381, "last_seen": 1789232381, "transport": "t", "ja3_hash": "b5bc3cd0623ac15d4d4300485ea360ea", "ja3_variant_count": 1, "ja3_variants": [ "b5bc3cd0623ac15d4d4300485ea360ea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d3411ht_a634f799a498_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (6f77ef117592) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d3411ht", "b": "a634f799a498", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 34, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1283, "first_seen": 1787442796, "last_seen": 1791347877, "transport": "t", "ja3_hash": "a96dc3876784813c57d302241e620acd", "ja3_variant_count": 1, "ja3_variants": [ "a96dc3876784813c57d302241e620acd" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d3511ht_66c735deec94_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (6f77ef117592) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d3511ht", "b": "66c735deec94", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 35, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1283, "first_seen": 1787442795, "last_seen": 1791347876, "transport": "t", "ja3_hash": "03a3ad27040f733ee5c9915e0903d028", "ja3_variant_count": 1, "ja3_variants": [ "03a3ad27040f733ee5c9915e0903d028" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_305e7cc661dc_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "305e7cc661dc", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49175-90-49176-49177-89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710046, "last_seen": 1788842296, "transport": "t", "ja3_hash": "9bb386a183416189b8cce1d5b0a3f371", "ja3_variant_count": 4, "ja3_variants": [ "9bb386a183416189b8cce1d5b0a3f371", "d41cdd80cbce4c05a0392a7bc1111e2b", "9744b8410a984bb2c44adc61178636fd", "b761c1e7a49b5759fbfd883ccc7a29ed" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_4607ee80f03a_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "4607ee80f03a", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49171-49191-49199-49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710048, "last_seen": 1788842297, "transport": "t", "ja3_hash": "4eb082201fa9c1eecbfec725fcfa1f5c", "ja3_variant_count": 4, "ja3_variants": [ "4eb082201fa9c1eecbfec725fcfa1f5c", "8964ee2e3e1f67db2db3c8d0dbf18ba7", "4db1cb52854e0d2a6a6a51407b182df9", "b929451b3e8eeb88c2628fd942838a1f" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_6ea97102b799_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "6ea97102b799", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,107-49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710040, "last_seen": 1788842290, "transport": "t", "ja3_hash": "937982361e499ecaa781355b80b822d0", "ja3_variant_count": 4, "ja3_variants": [ "937982361e499ecaa781355b80b822d0", "ef420e4cd4a429fe85fb06451e12369f", "0800d5d1e525fa7dc0de507e6c873879", "c6bd78815c87e6370994c16e44075802" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_a819cc8c6927_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "a819cc8c6927", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,166-58-109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710042, "last_seen": 1788842291, "transport": "t", "ja3_hash": "623371194c33f6222f0054f2e01ee456", "ja3_variant_count": 4, "ja3_variants": [ "623371194c33f6222f0054f2e01ee456", "41264a871d84b4e246c1db8ac053ec1b", "d76f5b1e29263560cf11bd4d5fffd466", "a0c89d515d20f1b2a1f667b0be6ea7c4" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_c47ce3b2bf1f_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "c47ce3b2bf1f", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,138-98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710046, "last_seen": 1788842296, "transport": "t", "ja3_hash": "e63c9d292bf6229c99b26173d57ebc1a", "ja3_variant_count": 4, "ja3_variants": [ "e63c9d292bf6229c99b26173d57ebc1a", "fb5039ae26079f961dd2e371f319455f", "38f53ffbd432ad21db3453dfb600f0f6", "66096e085f746187a4758c8f7ebb16d7" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d630400_f4a33ce78bd4_3549fbaf615c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (3549fbaf615c) with 6 fingerprints classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d630400", "b": "f4a33ce78bd4", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 63, "extension_count": 4, "alpn": null } }, "ja3_string": "771,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57,10-0-11-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710043, "last_seen": 1788842292, "transport": "t", "ja3_hash": "c0b5c70aded5de1c99d422ff06236d99", "ja3_variant_count": 4, "ja3_variants": [ "c0b5c70aded5de1c99d422ff06236d99", "4aa90cde4c98e4c0164c352aa434849f", "449c2bf4be38263ae55eb22ffba37c11", "e2ec31eb1cc52c0477adfdf955d280a8" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d6911hq_ea0618708e31_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (6f77ef117592) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d6911hq", "b": "ea0618708e31", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": "hq" } }, "ja3_string": "771,49170-49171-49159-49191-52244-49199-4865-49172-4866-49192-52393-49200-49267-49248-49266-49249-49196-49270-49327-49271-49325-52392-49188-4869-49162-4868-49195-4867-49326-52243-49324-49169-49187-10-49161-47-49160-60-154-49308-196-49312-136-156-190-53-69-61-159-49309-49315-49313-49311-157-107-65-57-186-158-132-49314-192-49310-7-103-4-51-5-22,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1282, "first_seen": 1787442799, "last_seen": 1791347877, "transport": "t", "ja3_hash": "1289771a3fce256d5fb4cb5c95b43ee6", "ja3_variant_count": 2, "ja3_variants": [ "1289771a3fce256d5fb4cb5c95b43ee6", "66d4597f171299d13a534dc61e7b931a" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12i030700_8b6334b1051c_ac8bd4dd6c01", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i030700", "b": "8b6334b1051c", "c": "ac8bd4dd6c01", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 7, "alpn": null } }, "ja3_string": "771,3-6-8,5-10-11-13-65281-15-18,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 48, "first_seen": 1787469650, "last_seen": 1791339378, "transport": "t", "ja3_hash": "22aa2bdb630c59d5ff64a34017e418c4", "ja3_variant_count": 1, "ja3_variants": [ "22aa2bdb630c59d5ff64a34017e418c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i040300_058957366436_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i040300", "b": "058957366436", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49185-49178-49181-49184,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748805, "last_seen": 1791319601, "transport": "t", "ja3_hash": "575fec939ada7e5d00cc1ba626fdbd43", "ja3_variant_count": 2, "ja3_variants": [ "575fec939ada7e5d00cc1ba626fdbd43", "1ec3556c54662e596681858541d9cb9a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i040900_847a4004cbf9_a92c7c6a82fe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i040900", "b": "847a4004cbf9", "c": "a92c7c6a82fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49196-49161-49162,11-65281-23-18-5-10-13-50-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 237, "first_seen": 1787448773, "last_seen": 1791346376, "transport": "t", "ja3_hash": "387fec6871738fb5adb3695ca1503040", "ja3_variant_count": 1, "ja3_variants": [ "387fec6871738fb5adb3695ca1503040" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i050100_7f27215065b1_e5744cedd59f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i050100", "b": "7f27215065b1", "c": "e5744cedd59f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 5, "extension_count": 1, "alpn": null } }, "ja3_string": "771,47-10-19-57-4,13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1787911800, "last_seen": 1790288720, "transport": "t", "ja3_hash": "0936656793efc6870927862aa11c885c", "ja3_variant_count": 1, "ja3_variants": [ "0936656793efc6870927862aa11c885c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i050300_d8ff220ab85b_beb9f91c6f80", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i050300", "b": "d8ff220ab85b", "c": "beb9f91c6f80", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 5, "extension_count": 3, "alpn": null } }, "ja3_string": "771,52393-49195-52392-49199-156,43-10-13,29-23,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [] }, "observed": { "count": 103, "first_seen": 1787497734, "last_seen": 1791308162, "transport": "t", "ja3_hash": "7ed05806f66476ade54c4abcdb6f1939", "ja3_variant_count": 1, "ja3_variants": [ "7ed05806f66476ade54c4abcdb6f1939" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i050400_34c2dc17cea7_f0b8f5931c7e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i050400", "b": "34c2dc17cea7", "c": "f0b8f5931c7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 5, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49195-49199-49171-156-47,10-11-13-65281,23-1-3-19-21-6-7-9-10-24-11-12-25-13-14-15-16-17-2-18-4-5-20-8-22,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789794005, "last_seen": 1789794005, "transport": "t", "ja3_hash": "1731f90b609463a8e73ef8f75d32174b", "ja3_variant_count": 1, "ja3_variants": [ "1731f90b609463a8e73ef8f75d32174b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i060100_eca7c5d91837_338aad02a631", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i060100", "b": "eca7c5d91837", "c": "338aad02a631", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 6, "extension_count": 1, "alpn": null } }, "ja3_string": "771,47-10-19-57-4-255,13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789093642, "last_seen": 1789285842, "transport": "t", "ja3_hash": "16ee84a07b55074cb2751329bf1c8811", "ja3_variant_count": 1, "ja3_variants": [ "16ee84a07b55074cb2751329bf1c8811" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i070100_ece5ae09bdd1_73175bb49c88", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i070100", "b": "ece5ae09bdd1", "c": "73175bb49c88", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 7, "extension_count": 1, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4886-771-50,4096,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4886, "name": "4886 (0x1316)", "known": false }, { "value": 771, "name": "771 (0x0303)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false } ], "extensions": [ { "value": 4096, "name": "4096 (0x1000)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 7, "first_seen": 1790161536, "last_seen": 1790678619, "transport": "t", "ja3_hash": "bf7c901de5e5d1ce3ea276c2b16063d8", "ja3_variant_count": 1, "ja3_variants": [ "bf7c901de5e5d1ce3ea276c2b16063d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i070200_c2f3549b8eb7_0c4660e5fab3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i070200", "b": "c2f3549b8eb7", "c": "0c4660e5fab3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 7, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-60433,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-5635-768-28416-3328-3584-7424-7680-10496-6656-6912-7168-7936-8192-8449-1-257-513-769-1026-2-258-529-59665-59921-60177,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 60433, "name": "60433 (0xec11)", "known": false } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 5635, "name": "5635 (0x1603)", "known": false }, { "value": 768, "name": "768 (0x0300)", "known": false }, { "value": 28416, "name": "28416 (0x6f00)", "known": false }, { "value": 3328, "name": "3328 (0x0d00)", "known": false }, { "value": 3584, "name": "3584 (0x0e00)", "known": false }, { "value": 7424, "name": "7424 (0x1d00)", "known": false }, { "value": 7680, "name": "7680 (0x1e00)", "known": false }, { "value": 10496, "name": "10496 (0x2900)", "known": false }, { "value": 6656, "name": "6656 (0x1a00)", "known": false }, { "value": 6912, "name": "6912 (0x1b00)", "known": false }, { "value": 7168, "name": "7168 (0x1c00)", "known": false }, { "value": 7936, "name": "7936 (0x1f00)", "known": false }, { "value": 8192, "name": "8192 (0x2000)", "known": false }, { "value": 8449, "name": "8449 (0x2101)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 769, "name": "769 (0x0301)", "known": false }, { "value": 1026, "name": "1026 (0x0402)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 529, "name": "529 (0x0211)", "known": false }, { "value": 59665, "name": "59665 (0xe911)", "known": false }, { "value": 59921, "name": "59921 (0xea11)", "known": false }, { "value": 60177, "name": "60177 (0xeb11)", "known": false } ], "point_formats": [] }, "observed": { "count": 7, "first_seen": 1790161537, "last_seen": 1790678619, "transport": "t", "ja3_hash": "a601869816d8cb0a518f0f66dcecb245", "ja3_variant_count": 1, "ja3_variants": [ "a601869816d8cb0a518f0f66dcecb245" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i070700_be10c564b140_ac0d2f4ec206", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i070700", "b": "be10c564b140", "c": "ac0d2f4ec206", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49326,5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790527150, "last_seen": 1790527150, "transport": "t", "ja3_hash": "29d0f7ca946f1a1eacc630fc20b88e11", "ja3_variant_count": 1, "ja3_variants": [ "29d0f7ca946f1a1eacc630fc20b88e11" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i080300_30ad22c17fce_15cf763851c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i080300", "b": "30ad22c17fce", "c": "15cf763851c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 3, "alpn": null } }, "ja3_string": "771,20-17-25-8-6-23-3-255,35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788685055, "last_seen": 1790060680, "transport": "t", "ja3_hash": "865e4305a503dc51f83a3c6b6da9fdcf", "ja3_variant_count": 1, "ja3_variants": [ "865e4305a503dc51f83a3c6b6da9fdcf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i080600_0df93f53a2f9_f28add8e7af0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i080600", "b": "0df93f53a2f9", "c": "f28add8e7af0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191,10-11-13-35-23-65281,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789854959, "last_seen": 1789854959, "transport": "t", "ja3_hash": "947ab578710446df401f3391adcd5357", "ja3_variant_count": 1, "ja3_variants": [ "947ab578710446df401f3391adcd5357" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i080900_a5784322a9f4_a92c7c6a82fe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i080900", "b": "a5784322a9f4", "c": "a92c7c6a82fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49199-49200-49171-49172-156-157-47-53,11-65281-23-18-5-10-13-50-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 242, "first_seen": 1787448768, "last_seen": 1791346376, "transport": "t", "ja3_hash": "08457f913bb93e139bca198696428c81", "ja3_variant_count": 1, "ja3_variants": [ "08457f913bb93e139bca198696428c81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i130300_8b80da21ef18_269b5d1fb7c0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i130300", "b": "8b80da21ef18", "c": "269b5d1fb7c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,10-11-13,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787646640, "last_seen": 1790292567, "transport": "t", "ja3_hash": "b881b92274f99205ebee7e9bdc064408", "ja3_variant_count": 1, "ja3_variants": [ "b881b92274f99205ebee7e9bdc064408" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i130500_2d7513195f68_e51b7354d87f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i130500", "b": "2d7513195f68", "c": "e51b7354d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2263, "first_seen": 1787443519, "last_seen": 1791362073, "transport": "t", "ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "ja3_variant_count": 1, "ja3_variants": [ "cba7f34191ef2379c1325641f6c6c4f4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i130700_2d7513195f68_ac8bd4dd6c01", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i130700", "b": "2d7513195f68", "c": "ac8bd4dd6c01", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281-15-18,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788293165, "last_seen": 1790244142, "transport": "t", "ja3_hash": "caaddd3ed0a315543d761490b01b08e0", "ja3_variant_count": 1, "ja3_variants": [ "caaddd3ed0a315543d761490b01b08e0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150100_8daaf6152771_6d763631da8d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150100", "b": "8daaf6152771", "c": "6d763631da8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 1, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789744594, "last_seen": 1789744594, "transport": "t", "ja3_hash": "d635d6b6a816ae0847dde566ef068589", "ja3_variant_count": 1, "ja3_variants": [ "d635d6b6a816ae0847dde566ef068589" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150200_8daaf6152771_9cfa503a6a65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "9cfa503a6a65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1787936454, "last_seen": 1791247233, "transport": "t", "ja3_hash": "dc62e70463eaa12e9929acaf15dc68c1", "ja3_variant_count": 1, "ja3_variants": [ "dc62e70463eaa12e9929acaf15dc68c1" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.7922.34 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12i150300_8daaf6152771_053cb7d49935", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "053cb7d49935", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788454616, "last_seen": 1789829913, "transport": "t", "ja3_hash": "538f74c69e1fde2d77bfe6311555dfd0", "ja3_variant_count": 1, "ja3_variants": [ "538f74c69e1fde2d77bfe6311555dfd0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_179c2294c086", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "179c2294c086", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788900216, "last_seen": 1788900216, "transport": "t", "ja3_hash": "88ccd2b0780749507e98edb7b176be9e", "ja3_variant_count": 1, "ja3_variants": [ "88ccd2b0780749507e98edb7b176be9e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_429494ee3f11", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "429494ee3f11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791034438, "last_seen": 1791034438, "transport": "t", "ja3_hash": "849738042177a6f68b20edb5878a6dc8", "ja3_variant_count": 1, "ja3_variants": [ "849738042177a6f68b20edb5878a6dc8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_42bfd91a72d9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "42bfd91a72d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790930524, "last_seen": 1791202530, "transport": "t", "ja3_hash": "e0209cb63dcf5ec538c75863f35a2363", "ja3_variant_count": 2, "ja3_variants": [ "e0209cb63dcf5ec538c75863f35a2363", "8a25a9bf1e83773ed3840dd965772f78" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_470e2cdabb19", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "470e2cdabb19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789007204, "last_seen": 1789007204, "transport": "t", "ja3_hash": "808f929c0df0c56f724f1caa3cdf071b", "ja3_variant_count": 1, "ja3_variants": [ "808f929c0df0c56f724f1caa3cdf071b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_5983db0d0827", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "5983db0d0827", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789296236, "last_seen": 1789296236, "transport": "t", "ja3_hash": "f327af3f363f0e559ce60e4fbf6928a6", "ja3_variant_count": 1, "ja3_variants": [ "f327af3f363f0e559ce60e4fbf6928a6" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 8 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_6297b054c2bd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "6297b054c2bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839898, "last_seen": 1788839898, "transport": "t", "ja3_hash": "15bf8c03dc730cb4f89d79e456b31d9b", "ja3_variant_count": 1, "ja3_variants": [ "15bf8c03dc730cb4f89d79e456b31d9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_6e722d94bb10", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "6e722d94bb10", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790230461, "last_seen": 1790230461, "transport": "t", "ja3_hash": "cb32812a0f0069ab702929731e270437", "ja3_variant_count": 1, "ja3_variants": [ "cb32812a0f0069ab702929731e270437" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_757efd7250b5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "757efd7250b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789218770, "last_seen": 1789218770, "transport": "t", "ja3_hash": "06d52c2323f627da8d3805a9f95b474d", "ja3_variant_count": 1, "ja3_variants": [ "06d52c2323f627da8d3805a9f95b474d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_952aae1a8b47", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "952aae1a8b47", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789754544, "last_seen": 1790777982, "transport": "t", "ja3_hash": "27ced869b50ce071227d2643300e59d7", "ja3_variant_count": 2, "ja3_variants": [ "27ced869b50ce071227d2643300e59d7", "3a9a1ea9b06a1ccc927c51e9c6e0d452" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_9c8a4aba36de", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "9c8a4aba36de", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788848230, "last_seen": 1788848230, "transport": "t", "ja3_hash": "cfb1f1afb69d84632dc5583618cfd373", "ja3_variant_count": 1, "ja3_variants": [ "cfb1f1afb69d84632dc5583618cfd373" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_a1fd15000e25", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "a1fd15000e25", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1791102393, "last_seen": 1791131134, "transport": "t", "ja3_hash": "5c51c8dc4b47e4d60bd1fb7896c0ae8a", "ja3_variant_count": 1, "ja3_variants": [ "5c51c8dc4b47e4d60bd1fb7896c0ae8a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_a29b2ac7b083", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "a29b2ac7b083", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197014, "last_seen": 1790197014, "transport": "t", "ja3_hash": "3ae8a0a3b5c3d4dd69d7d805543f3022", "ja3_variant_count": 1, "ja3_variants": [ "3ae8a0a3b5c3d4dd69d7d805543f3022" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_a50a4d66262a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "a50a4d66262a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791046899, "last_seen": 1791046899, "transport": "t", "ja3_hash": "e549352d82470fecba75eed243949136", "ja3_variant_count": 1, "ja3_variants": [ "e549352d82470fecba75eed243949136" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_cb7ba7e87116", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "cb7ba7e87116", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202833, "last_seen": 1790202833, "transport": "t", "ja3_hash": "991f3b348f5a7d0c967cd15579a11095", "ja3_variant_count": 1, "ja3_variants": [ "991f3b348f5a7d0c967cd15579a11095" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_de7c87d72c1a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "de7c87d72c1a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789754543, "last_seen": 1790458199, "transport": "t", "ja3_hash": "cb903e77752bea3813ca5129fb32cc7c", "ja3_variant_count": 2, "ja3_variants": [ "cb903e77752bea3813ca5129fb32cc7c", "c3c08ec4175a56dace7af161b43bab12" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_dfc6624762fb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "dfc6624762fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791244302, "last_seen": 1791244302, "transport": "t", "ja3_hash": "3229d41e0c9ecdade32b982e30ca14f8", "ja3_variant_count": 1, "ja3_variants": [ "3229d41e0c9ecdade32b982e30ca14f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150300_8daaf6152771_f90e5fb59c6e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150300", "b": "8daaf6152771", "c": "f90e5fb59c6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790360802, "last_seen": 1790360802, "transport": "t", "ja3_hash": "567d7afa7e9c7190b126eb2658f21f68", "ja3_variant_count": 1, "ja3_variants": [ "567d7afa7e9c7190b126eb2658f21f68" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_01a6f240da47", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "01a6f240da47", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789196273, "last_seen": 1789196273, "transport": "t", "ja3_hash": "d0f48810059faa61abec65aee0eccf69", "ja3_variant_count": 1, "ja3_variants": [ "d0f48810059faa61abec65aee0eccf69" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_08f4e96ed339", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "08f4e96ed339", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-65281-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791149953, "last_seen": 1791149953, "transport": "t", "ja3_hash": "837a2ea77d8f18bb95a5060fdbe0326e", "ja3_variant_count": 1, "ja3_variants": [ "837a2ea77d8f18bb95a5060fdbe0326e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_0cae308ccb88", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "0cae308ccb88", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788530071, "last_seen": 1788530071, "transport": "t", "ja3_hash": "56370782ea98e6be6f03006aa9f80f3c", "ja3_variant_count": 1, "ja3_variants": [ "56370782ea98e6be6f03006aa9f80f3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_1760be47067b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "1760be47067b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790655944, "last_seen": 1790655944, "transport": "t", "ja3_hash": "a3956259f80f3ca86c2255113011b14f", "ja3_variant_count": 1, "ja3_variants": [ "a3956259f80f3ca86c2255113011b14f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_1e3aa894b7ee", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "1e3aa894b7ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790097252, "last_seen": 1790097252, "transport": "t", "ja3_hash": "463264ce1887a213dec42c7fe90b5e07", "ja3_variant_count": 1, "ja3_variants": [ "463264ce1887a213dec42c7fe90b5e07" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_22a5c3089bb0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "22a5c3089bb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-18-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788777778, "last_seen": 1788777778, "transport": "t", "ja3_hash": "57cf62be24accabaa6df75ccdce29e8b", "ja3_variant_count": 1, "ja3_variants": [ "57cf62be24accabaa6df75ccdce29e8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_2af4561d971d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "2af4561d971d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790931426, "last_seen": 1790931426, "transport": "t", "ja3_hash": "dcee1c06678573c6b34a2b101a15d6a1", "ja3_variant_count": 1, "ja3_variants": [ "dcee1c06678573c6b34a2b101a15d6a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_33659e875f91", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "33659e875f91", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791006025, "last_seen": 1791006025, "transport": "t", "ja3_hash": "d887dfe9ffadd593b2070f38a0dacc9e", "ja3_variant_count": 1, "ja3_variants": [ "d887dfe9ffadd593b2070f38a0dacc9e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_352cb4ed7051", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "352cb4ed7051", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788448262, "last_seen": 1788448262, "transport": "t", "ja3_hash": "000da169b6d97fc3a93b15fc4cc7e59a", "ja3_variant_count": 1, "ja3_variants": [ "000da169b6d97fc3a93b15fc4cc7e59a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_3a1a6e53dd7d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "3a1a6e53dd7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790996042, "last_seen": 1790996042, "transport": "t", "ja3_hash": "e1efc7d62890e843166f5e84517294f9", "ja3_variant_count": 1, "ja3_variants": [ "e1efc7d62890e843166f5e84517294f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_3dfec539bd98", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "3dfec539bd98", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730568, "last_seen": 1789730568, "transport": "t", "ja3_hash": "ed2d503dafc4416d0c037cd76bf7a34b", "ja3_variant_count": 1, "ja3_variants": [ "ed2d503dafc4416d0c037cd76bf7a34b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_44b630b257ba", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "44b630b257ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789391192, "last_seen": 1789391192, "transport": "t", "ja3_hash": "ef12c166b28aa738cac07ccdde0ced61", "ja3_variant_count": 1, "ja3_variants": [ "ef12c166b28aa738cac07ccdde0ced61" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_47e60eb062aa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "47e60eb062aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-23-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788454684, "last_seen": 1788454684, "transport": "t", "ja3_hash": "17ceab730f66caadd8d7b26f4a789e27", "ja3_variant_count": 1, "ja3_variants": [ "17ceab730f66caadd8d7b26f4a789e27" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_483d8b530527", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "483d8b530527", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-65281-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789820708, "last_seen": 1789820708, "transport": "t", "ja3_hash": "5fb25e37bb35b14fce08d749c69ac4cc", "ja3_variant_count": 1, "ja3_variants": [ "5fb25e37bb35b14fce08d749c69ac4cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_4c8f8fd17022", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "4c8f8fd17022", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790239292, "last_seen": 1790239292, "transport": "t", "ja3_hash": "52727af190d52e0db39cdd37daebd43f", "ja3_variant_count": 1, "ja3_variants": [ "52727af190d52e0db39cdd37daebd43f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_5509ece6c493", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "5509ece6c493", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791247233, "last_seen": 1791247233, "transport": "t", "ja3_hash": "7bdd1213ac7eeeb8e6b5cf095eaabb1e", "ja3_variant_count": 1, "ja3_variants": [ "7bdd1213ac7eeeb8e6b5cf095eaabb1e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_5d8a6b51dd4d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "5d8a6b51dd4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790730176, "last_seen": 1790730176, "transport": "t", "ja3_hash": "30bddb200e79d57ba77d8ba37b603212", "ja3_variant_count": 1, "ja3_variants": [ "30bddb200e79d57ba77d8ba37b603212" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_5e5691d22dff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "5e5691d22dff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791035965, "last_seen": 1791035965, "transport": "t", "ja3_hash": "e6ec2e27edb689c848a8b1b048a69648", "ja3_variant_count": 1, "ja3_variants": [ "e6ec2e27edb689c848a8b1b048a69648" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_61eb770de1dc", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "61eb770de1dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790337423, "last_seen": 1790337423, "transport": "t", "ja3_hash": "be38634c1ab050675dd80427c59841ec", "ja3_variant_count": 1, "ja3_variants": [ "be38634c1ab050675dd80427c59841ec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_66b4109d398c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "66b4109d398c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788932600, "last_seen": 1788932600, "transport": "t", "ja3_hash": "ff9720c3847bc0ac95e59bc316364cbc", "ja3_variant_count": 1, "ja3_variants": [ "ff9720c3847bc0ac95e59bc316364cbc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_66bc1639a017", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "66bc1639a017", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788448261, "last_seen": 1788448261, "transport": "t", "ja3_hash": "140a4c1a3717105d58a44204a631edeb", "ja3_variant_count": 1, "ja3_variants": [ "140a4c1a3717105d58a44204a631edeb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_71806daead90", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "71806daead90", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790220359, "last_seen": 1790220359, "transport": "t", "ja3_hash": "650e270f5afec8e3bf681dfd8dfdaabd", "ja3_variant_count": 1, "ja3_variants": [ "650e270f5afec8e3bf681dfd8dfdaabd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_7607da015c17", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "7607da015c17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790709792, "last_seen": 1790709792, "transport": "t", "ja3_hash": "c514195287960879fccc0d8bfe7f5182", "ja3_variant_count": 1, "ja3_variants": [ "c514195287960879fccc0d8bfe7f5182" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_7a56f2444bd9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "7a56f2444bd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791083917, "last_seen": 1791083917, "transport": "t", "ja3_hash": "d21a7e09de6ef84922745d022a23b704", "ja3_variant_count": 1, "ja3_variants": [ "d21a7e09de6ef84922745d022a23b704" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_7defff518584", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "7defff518584", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789444996, "last_seen": 1789444996, "transport": "t", "ja3_hash": "c970eadb029304dfe3063de36878d3af", "ja3_variant_count": 1, "ja3_variants": [ "c970eadb029304dfe3063de36878d3af" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_7e198ac771ae", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "7e198ac771ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790166896, "last_seen": 1790166896, "transport": "t", "ja3_hash": "b68bcda9ea4887135082462223146e3c", "ja3_variant_count": 1, "ja3_variants": [ "b68bcda9ea4887135082462223146e3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_7e32d3339ea2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "7e32d3339ea2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790153198, "last_seen": 1790153198, "transport": "t", "ja3_hash": "682c4c8fc55289b091f8af973aedc038", "ja3_variant_count": 1, "ja3_variants": [ "682c4c8fc55289b091f8af973aedc038" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_7e6ef838d0a2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "7e6ef838d0a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789701008, "last_seen": 1789701008, "transport": "t", "ja3_hash": "2c625136f763b1cb0ce0d2c77855c3bd", "ja3_variant_count": 1, "ja3_variants": [ "2c625136f763b1cb0ce0d2c77855c3bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_881e9db808b7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "881e9db808b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-11-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790869269, "last_seen": 1790869269, "transport": "t", "ja3_hash": "dcffea79eb7c69c787dff4810943d766", "ja3_variant_count": 1, "ja3_variants": [ "dcffea79eb7c69c787dff4810943d766" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_95460fc905c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "95460fc905c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-17613-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788448163, "last_seen": 1788448163, "transport": "t", "ja3_hash": "1a827c12b4708b127e29c6426d24889c", "ja3_variant_count": 1, "ja3_variants": [ "1a827c12b4708b127e29c6426d24889c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a3e22a03c307", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a3e22a03c307", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-4832-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789587733, "last_seen": 1789587733, "transport": "t", "ja3_hash": "9407b52719784e6908b3ff3861b9fe01", "ja3_variant_count": 1, "ja3_variants": [ "9407b52719784e6908b3ff3861b9fe01" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a79eb5675868", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a79eb5675868", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-51-43,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790168398, "last_seen": 1790168398, "transport": "t", "ja3_hash": "6b8ba0622d4604cec7c34c802fca30f4", "ja3_variant_count": 1, "ja3_variants": [ "6b8ba0622d4604cec7c34c802fca30f4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a8f3ba2754c7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a8f3ba2754c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51764-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790605457, "last_seen": 1790605457, "transport": "t", "ja3_hash": "87ff9e2897aeb23b463a4acbf543e19c", "ja3_variant_count": 1, "ja3_variants": [ "87ff9e2897aeb23b463a4acbf543e19c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_a9aef3f04aaf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "a9aef3f04aaf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789202028, "last_seen": 1789202028, "transport": "t", "ja3_hash": "5d68eb132bc279941e2cd7673e36d848", "ja3_variant_count": 1, "ja3_variants": [ "5d68eb132bc279941e2cd7673e36d848" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_c427bfe75be1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "c427bfe75be1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51764-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788454684, "last_seen": 1788454684, "transport": "t", "ja3_hash": "2448afc9f5238283cb18616b5f4def8b", "ja3_variant_count": 1, "ja3_variants": [ "2448afc9f5238283cb18616b5f4def8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_ca53dcc15d11", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "ca53dcc15d11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790620300, "last_seen": 1790620300, "transport": "t", "ja3_hash": "ac0ddcba6239b3a056ba0222cd713e3c", "ja3_variant_count": 1, "ja3_variants": [ "ac0ddcba6239b3a056ba0222cd713e3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_ea4cde416e08", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "ea4cde416e08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-10-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789730575, "last_seen": 1790312654, "transport": "t", "ja3_hash": "d91360d0e457f5df362cc01a6dc5a35d", "ja3_variant_count": 2, "ja3_variants": [ "d91360d0e457f5df362cc01a6dc5a35d", "5a7cbd935b68a0f9566df2054138ed05" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150400_8daaf6152771_f526fe466a0f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150400", "b": "8daaf6152771", "c": "f526fe466a0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790111182, "last_seen": 1790111182, "transport": "t", "ja3_hash": "6f027242dc743265f16731de3bb5700d", "ja3_variant_count": 1, "ja3_variants": [ "6f027242dc743265f16731de3bb5700d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_7bd54d6701ef_110b9cfecf33", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "7bd54d6701ef", "c": "110b9cfecf33", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,52393-52392-49196-49195-49200-49199-157-156-49162-49161-49171-49170-53-47-10,43-10-13-23-65281,25-24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 102, "first_seen": 1787497833, "last_seen": 1791308261, "transport": "t", "ja3_hash": "94b830560a8d5ef6b05cd569c9a38a9e", "ja3_variant_count": 1, "ja3_variants": [ "94b830560a8d5ef6b05cd569c9a38a9e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_01800640e677", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "01800640e677", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-51-11-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790244507, "last_seen": 1790244507, "transport": "t", "ja3_hash": "677224a739f4a704a35059ebc27a6fa0", "ja3_variant_count": 1, "ja3_variants": [ "677224a739f4a704a35059ebc27a6fa0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_09129a92aad7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "09129a92aad7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-27-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790547689, "last_seen": 1790547689, "transport": "t", "ja3_hash": "55d1f4a43020b5c08f9d43768b78ded1", "ja3_variant_count": 1, "ja3_variants": [ "55d1f4a43020b5c08f9d43768b78ded1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_0976df58e096", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "0976df58e096", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790234296, "last_seen": 1790234296, "transport": "t", "ja3_hash": "ededfd6077037bfb25a54a1b9d45d77b", "ja3_variant_count": 1, "ja3_variants": [ "ededfd6077037bfb25a54a1b9d45d77b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_102967639b4b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "102967639b4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-51-45-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790196878, "last_seen": 1790196878, "transport": "t", "ja3_hash": "80f076f9a5970470a73761308a139034", "ja3_variant_count": 1, "ja3_variants": [ "80f076f9a5970470a73761308a139034" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_116ba12e1f7f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "116ba12e1f7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-13-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788776667, "last_seen": 1788776667, "transport": "t", "ja3_hash": "be8d0bf060f8bc61bb8cb9fcb8864420", "ja3_variant_count": 1, "ja3_variants": [ "be8d0bf060f8bc61bb8cb9fcb8864420" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_19615b360095", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "19615b360095", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789375381, "last_seen": 1789375381, "transport": "t", "ja3_hash": "ec85f60e24c37602c9961d2b6a494e2b", "ja3_variant_count": 1, "ja3_variants": [ "ec85f60e24c37602c9961d2b6a494e2b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_1bcb1ee50776", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "1bcb1ee50776", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-27-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789865333, "last_seen": 1789865333, "transport": "t", "ja3_hash": "4df60df3422655bb22de295dcb52bf92", "ja3_variant_count": 1, "ja3_variants": [ "4df60df3422655bb22de295dcb52bf92" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_222ac04d7587", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "222ac04d7587", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-17613-51-18,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789980488, "last_seen": 1789980488, "transport": "t", "ja3_hash": "32cfeadc3b5d70cfbb050e43f892cf60", "ja3_variant_count": 1, "ja3_variants": [ "32cfeadc3b5d70cfbb050e43f892cf60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_224fdc61fdec", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "224fdc61fdec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-13-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790842308, "last_seen": 1790842308, "transport": "t", "ja3_hash": "c6eb09c93ec83c3d6c1b077be0a3fd40", "ja3_variant_count": 1, "ja3_variants": [ "c6eb09c93ec83c3d6c1b077be0a3fd40" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_23ba83f97f66", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "23ba83f97f66", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789226265, "last_seen": 1789226265, "transport": "t", "ja3_hash": "44e5dd58e48e4b6da860e587175478ba", "ja3_variant_count": 1, "ja3_variants": [ "44e5dd58e48e4b6da860e587175478ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_242c9289aa66", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "242c9289aa66", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790881294, "last_seen": 1790881294, "transport": "t", "ja3_hash": "3c9a4dcd51621cf60ccd5bb3a6197b9c", "ja3_variant_count": 1, "ja3_variants": [ "3c9a4dcd51621cf60ccd5bb3a6197b9c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_250be5d88db1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "250be5d88db1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-5-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791020642, "last_seen": 1791020642, "transport": "t", "ja3_hash": "af263397f4667f3b57885995b227a3bc", "ja3_variant_count": 1, "ja3_variants": [ "af263397f4667f3b57885995b227a3bc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_2ae2e10a93e2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "2ae2e10a93e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-35-17613-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788899780, "last_seen": 1788899780, "transport": "t", "ja3_hash": "9a94f6f47c708acbe1f8d4aeb1fffedd", "ja3_variant_count": 1, "ja3_variants": [ "9a94f6f47c708acbe1f8d4aeb1fffedd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_2fb408fa92ca", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "2fb408fa92ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-13-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790338753, "last_seen": 1790338753, "transport": "t", "ja3_hash": "b3a4d0d0f93a4539f76cf793caf60591", "ja3_variant_count": 1, "ja3_variants": [ "b3a4d0d0f93a4539f76cf793caf60591" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_31dcace5b1ee", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "31dcace5b1ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-51-45-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789587733, "last_seen": 1790124041, "transport": "t", "ja3_hash": "2a6578042c190f969165ccc966785423", "ja3_variant_count": 2, "ja3_variants": [ "2a6578042c190f969165ccc966785423", "0bbad0bf882c13b0c87b7746bfb6ed26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3bf9fd7717d6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3bf9fd7717d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-35-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791007279, "last_seen": 1791007279, "transport": "t", "ja3_hash": "6963f53a30e938ee4fe2c3efcdb84104", "ja3_variant_count": 1, "ja3_variants": [ "6963f53a30e938ee4fe2c3efcdb84104" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3d16c8249ef5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3d16c8249ef5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-11-17613-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788945092, "last_seen": 1788945092, "transport": "t", "ja3_hash": "07c619e2f01a11a65a2c552ef19b64a9", "ja3_variant_count": 1, "ja3_variants": [ "07c619e2f01a11a65a2c552ef19b64a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3d59468d8604", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3d59468d8604", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-5-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790329176, "last_seen": 1790329176, "transport": "t", "ja3_hash": "82c242a47679e17f95192bc56ef361e2", "ja3_variant_count": 1, "ja3_variants": [ "82c242a47679e17f95192bc56ef361e2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3e544b883c05", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3e544b883c05", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51764-35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790682872, "last_seen": 1790682872, "transport": "t", "ja3_hash": "d65f818eff030dcd5d685bce6e8cd29f", "ja3_variant_count": 1, "ja3_variants": [ "d65f818eff030dcd5d685bce6e8cd29f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_3eb7f0d26a79", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "3eb7f0d26a79", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788967850, "last_seen": 1788967850, "transport": "t", "ja3_hash": "2f041b173a827b8b13e025eee7299109", "ja3_variant_count": 1, "ja3_variants": [ "2f041b173a827b8b13e025eee7299109" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_4752b973f44d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "4752b973f44d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-45-51-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790716358, "last_seen": 1790716358, "transport": "t", "ja3_hash": "2962301c969eea950d7a668f1e2c00a0", "ja3_variant_count": 1, "ja3_variants": [ "2962301c969eea950d7a668f1e2c00a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_4c8821db59d8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "4c8821db59d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789411689, "last_seen": 1789411689, "transport": "t", "ja3_hash": "3a537f7f14f7236d907ceb9c9882f81e", "ja3_variant_count": 1, "ja3_variants": [ "3a537f7f14f7236d907ceb9c9882f81e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_50538c0944ff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "50538c0944ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-18-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790042172, "last_seen": 1790042172, "transport": "t", "ja3_hash": "2ffaaf05c07f9565c9b05b2e4ffc89d7", "ja3_variant_count": 1, "ja3_variants": [ "2ffaaf05c07f9565c9b05b2e4ffc89d7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_55ca340e66b4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "55ca340e66b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790055349, "last_seen": 1790055349, "transport": "t", "ja3_hash": "9c99bf475180a32706ac86621091b494", "ja3_variant_count": 1, "ja3_variants": [ "9c99bf475180a32706ac86621091b494" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_5ed3235fd4aa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "5ed3235fd4aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-5-11-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790242405, "last_seen": 1790242405, "transport": "t", "ja3_hash": "fa9572874da1fe9fe300a0c2f21c7265", "ja3_variant_count": 1, "ja3_variants": [ "fa9572874da1fe9fe300a0c2f21c7265" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_65ad6b57c247", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "65ad6b57c247", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-65281-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790788774, "last_seen": 1790788774, "transport": "t", "ja3_hash": "f55f5f4a813968bdc20cd24014a715f1", "ja3_variant_count": 1, "ja3_variants": [ "f55f5f4a813968bdc20cd24014a715f1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_65c886645622", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "65c886645622", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-10-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788866540, "last_seen": 1788866540, "transport": "t", "ja3_hash": "145345d6f5c97eb715884f3b84ccbecd", "ja3_variant_count": 1, "ja3_variants": [ "145345d6f5c97eb715884f3b84ccbecd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_66eb3556960d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "66eb3556960d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-45-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790637777, "last_seen": 1790637777, "transport": "t", "ja3_hash": "8d56818b183cf69b16827a111f1ec306", "ja3_variant_count": 1, "ja3_variants": [ "8d56818b183cf69b16827a111f1ec306" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_68b06b747d92", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "68b06b747d92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-27-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197013, "last_seen": 1790197013, "transport": "t", "ja3_hash": "bc3430b8b326223b25f1029d21f19666", "ja3_variant_count": 1, "ja3_variants": [ "bc3430b8b326223b25f1029d21f19666" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_81e3d0738d42", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "81e3d0738d42", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-65281-23-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788515684, "last_seen": 1788515684, "transport": "t", "ja3_hash": "56f208e13ab5ba4ac7065c0bb77e465c", "ja3_variant_count": 1, "ja3_variants": [ "56f208e13ab5ba4ac7065c0bb77e465c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_8ad9fa289276", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "8ad9fa289276", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-27-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790424892, "last_seen": 1790424892, "transport": "t", "ja3_hash": "9610874acba868babb6aee3058dc7ce9", "ja3_variant_count": 1, "ja3_variants": [ "9610874acba868babb6aee3058dc7ce9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_93ec3ea36b13", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "93ec3ea36b13", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789845091, "last_seen": 1789845091, "transport": "t", "ja3_hash": "7c174abf2f0e8291e8e19346b6566bb3", "ja3_variant_count": 1, "ja3_variants": [ "7c174abf2f0e8291e8e19346b6566bb3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_9f61a387b165", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "9f61a387b165", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-13-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790846932, "last_seen": 1790846932, "transport": "t", "ja3_hash": "632a82f58f1fdf40e1f25552c41cd20d", "ja3_variant_count": 1, "ja3_variants": [ "632a82f58f1fdf40e1f25552c41cd20d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a1d81c2ae94d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a1d81c2ae94d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839898, "last_seen": 1788839898, "transport": "t", "ja3_hash": "4e041b1c0fc3b1abc3ec080681b1d904", "ja3_variant_count": 1, "ja3_variants": [ "4e041b1c0fc3b1abc3ec080681b1d904" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a202b8bd85f2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a202b8bd85f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788552176, "last_seen": 1788552176, "transport": "t", "ja3_hash": "0e05c641c768d17054d39db8bb864170", "ja3_variant_count": 1, "ja3_variants": [ "0e05c641c768d17054d39db8bb864170" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a39d27633ca5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a39d27633ca5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-23-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790652048, "last_seen": 1790652048, "transport": "t", "ja3_hash": "0b1e0c7a37985843063fe820144d3a00", "ja3_variant_count": 1, "ja3_variants": [ "0b1e0c7a37985843063fe820144d3a00" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_a674c5bdd415", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "a674c5bdd415", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789577401, "last_seen": 1789577401, "transport": "t", "ja3_hash": "0ec1b0734c71b6f13686bb2f8f342b02", "ja3_variant_count": 1, "ja3_variants": [ "0ec1b0734c71b6f13686bb2f8f342b02" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_c1bbfa6f134b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "c1bbfa6f134b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-51-65281-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790465468, "last_seen": 1790465468, "transport": "t", "ja3_hash": "decfa588a9390ef143ffe7ecfd67c0ed", "ja3_variant_count": 1, "ja3_variants": [ "decfa588a9390ef143ffe7ecfd67c0ed" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_c6a9f6071f7d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "c6a9f6071f7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-11-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791093920, "last_seen": 1791093920, "transport": "t", "ja3_hash": "1d111fa01be59a752a850eee41f49f73", "ja3_variant_count": 1, "ja3_variants": [ "1d111fa01be59a752a850eee41f49f73" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_d20cc2c26531", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "d20cc2c26531", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-18-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790777798, "last_seen": 1790777798, "transport": "t", "ja3_hash": "c6ecc10d0789122aa1b8a2bec389d7da", "ja3_variant_count": 1, "ja3_variants": [ "c6ecc10d0789122aa1b8a2bec389d7da" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_da8aa5dd8ed0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "da8aa5dd8ed0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789478739, "last_seen": 1789478739, "transport": "t", "ja3_hash": "2efdd0c6b680fa89d5eae8d8d77821b1", "ja3_variant_count": 1, "ja3_variants": [ "2efdd0c6b680fa89d5eae8d8d77821b1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_daacfa3084ae", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "daacfa3084ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-65281-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791024307, "last_seen": 1791024307, "transport": "t", "ja3_hash": "c1e10c09213a9e627453f42b7add6504", "ja3_variant_count": 1, "ja3_variants": [ "c1e10c09213a9e627453f42b7add6504" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_dc254b3e63fa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "dc254b3e63fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-23-5-17613,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788533129, "last_seen": 1788533129, "transport": "t", "ja3_hash": "20cb196c6e3286b201562479e658e311", "ja3_variant_count": 1, "ja3_variants": [ "20cb196c6e3286b201562479e658e311" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_dcfce5b6b595", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "dcfce5b6b595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-51-18-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790400253, "last_seen": 1790400253, "transport": "t", "ja3_hash": "36b8ac6f061c84af86c559e5f67a4d5f", "ja3_variant_count": 1, "ja3_variants": [ "36b8ac6f061c84af86c559e5f67a4d5f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_e081682b17c3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "e081682b17c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-65037-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788903786, "last_seen": 1788903786, "transport": "t", "ja3_hash": "7eea7a4b9ce5f737567bb9aa354c7bce", "ja3_variant_count": 1, "ja3_variants": [ "7eea7a4b9ce5f737567bb9aa354c7bce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_e282c78868cf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "e282c78868cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-18-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790568479, "last_seen": 1790568479, "transport": "t", "ja3_hash": "6570e6fc772c5077a9d5a4706de75f54", "ja3_variant_count": 1, "ja3_variants": [ "6570e6fc772c5077a9d5a4706de75f54" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_e9aa03c69910", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "e9aa03c69910", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-35-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790337424, "last_seen": 1790337424, "transport": "t", "ja3_hash": "dc980836022491fb91a7138f8f74c6a8", "ja3_variant_count": 1, "ja3_variants": [ "dc980836022491fb91a7138f8f74c6a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f37fcd17fffe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f37fcd17fffe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789582578, "last_seen": 1789582578, "transport": "t", "ja3_hash": "439ad760eda61ca5040d25e18bcbc2f2", "ja3_variant_count": 1, "ja3_variants": [ "439ad760eda61ca5040d25e18bcbc2f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f54363eb0dc8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f54363eb0dc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-27-5-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790535868, "last_seen": 1790535868, "transport": "t", "ja3_hash": "7fb06a5d75e8a6b48a50a3885d5ab507", "ja3_variant_count": 1, "ja3_variants": [ "7fb06a5d75e8a6b48a50a3885d5ab507" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_7745a645a683", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "7745a645a683", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-35-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788625012, "last_seen": 1789457763, "transport": "t", "ja3_hash": "8e5fd246136b7cfa111c8c38254b92cc", "ja3_variant_count": 2, "ja3_variants": [ "8e5fd246136b7cfa111c8c38254b92cc", "a515cd40e233cd237af7bab57ea2d4c8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_b3015c124462", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "b3015c124462", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-17613-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791256616, "last_seen": 1791256616, "transport": "t", "ja3_hash": "9aff1521b41e4f85218b6b5753e82d44", "ja3_variant_count": 1, "ja3_variants": [ "9aff1521b41e4f85218b6b5753e82d44" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_00d2147fa99d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "00d2147fa99d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-45-23-13-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790856645, "last_seen": 1790856645, "transport": "t", "ja3_hash": "3a34790499e7690bae4f5fc499305bca", "ja3_variant_count": 1, "ja3_variants": [ "3a34790499e7690bae4f5fc499305bca" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_01d8b72fe249", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "01d8b72fe249", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-5-45-65281-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790595257, "last_seen": 1790595257, "transport": "t", "ja3_hash": "fddfc9a7ee87e695499abe6c799c97fe", "ja3_variant_count": 1, "ja3_variants": [ "fddfc9a7ee87e695499abe6c799c97fe" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_0244615f4da5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "0244615f4da5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-23-51764-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015035, "last_seen": 1789015035, "transport": "t", "ja3_hash": "b66f74a524a04a3a5d4a855d18cd4a8a", "ja3_variant_count": 1, "ja3_variants": [ "b66f74a524a04a3a5d4a855d18cd4a8a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_0e477a0f81f3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "0e477a0f81f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-17613-5-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789047868, "last_seen": 1789047868, "transport": "t", "ja3_hash": "a1b992c2ff8d8a9527d808f6dd0740a7", "ja3_variant_count": 1, "ja3_variants": [ "a1b992c2ff8d8a9527d808f6dd0740a7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_1ce115d943c6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "1ce115d943c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-23-5-51-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790338754, "last_seen": 1790338754, "transport": "t", "ja3_hash": "f9ba45ec638ef3aaa85aae75394a2dc8", "ja3_variant_count": 1, "ja3_variants": [ "f9ba45ec638ef3aaa85aae75394a2dc8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_247d44d7f131", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "247d44d7f131", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-51-17613-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789662838, "last_seen": 1789662838, "transport": "t", "ja3_hash": "ab187c085e2c0150d1d3010cf0271782", "ja3_variant_count": 1, "ja3_variants": [ "ab187c085e2c0150d1d3010cf0271782" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_2a80361c6323", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "2a80361c6323", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-45-5-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790003000, "last_seen": 1790003000, "transport": "t", "ja3_hash": "d01bd0dfc048e9270ced6dceb643b2b4", "ja3_variant_count": 1, "ja3_variants": [ "d01bd0dfc048e9270ced6dceb643b2b4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_2a9e97a78566", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "2a9e97a78566", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-10-65281-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791222053, "last_seen": 1791222053, "transport": "t", "ja3_hash": "fb6d37b5618369517f9cba723b25dd06", "ja3_variant_count": 1, "ja3_variants": [ "fb6d37b5618369517f9cba723b25dd06" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_33d6f3e43cf9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "33d6f3e43cf9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-13-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791170340, "last_seen": 1791170340, "transport": "t", "ja3_hash": "3b06c1ac40c276b83cb6a3b85dea2cba", "ja3_variant_count": 1, "ja3_variants": [ "3b06c1ac40c276b83cb6a3b85dea2cba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_3b404ede3c3e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "3b404ede3c3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-23-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791248960, "last_seen": 1791248960, "transport": "t", "ja3_hash": "846b7d5d75b775e951ed8bd140c041e4", "ja3_variant_count": 1, "ja3_variants": [ "846b7d5d75b775e951ed8bd140c041e4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_3e4a892e9e67", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "3e4a892e9e67", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-65037-13-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789651378, "last_seen": 1789651378, "transport": "t", "ja3_hash": "5899b3fdc951575a7d9300e50dc178dc", "ja3_variant_count": 1, "ja3_variants": [ "5899b3fdc951575a7d9300e50dc178dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_420a22341378", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "420a22341378", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-51-35-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790338254, "last_seen": 1790338254, "transport": "t", "ja3_hash": "0e339a642b822dc906c376336bf34cc9", "ja3_variant_count": 1, "ja3_variants": [ "0e339a642b822dc906c376336bf34cc9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_43f65e97a82d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "43f65e97a82d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-23-27-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791241355, "last_seen": 1791241355, "transport": "t", "ja3_hash": "18fe597bd73a6cff2a0c7120081c4a77", "ja3_variant_count": 1, "ja3_variants": [ "18fe597bd73a6cff2a0c7120081c4a77" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_4879a369b4ee", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "4879a369b4ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-45-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789715432, "last_seen": 1789715432, "transport": "t", "ja3_hash": "bec52af5c8c68fc82d8617c14bc0d3c6", "ja3_variant_count": 1, "ja3_variants": [ "bec52af5c8c68fc82d8617c14bc0d3c6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_48b7f1f93bfa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "48b7f1f93bfa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-35-45-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791275628, "last_seen": 1791275628, "transport": "t", "ja3_hash": "8e41257835f0d7b2b5cd2577172eaf7b", "ja3_variant_count": 1, "ja3_variants": [ "8e41257835f0d7b2b5cd2577172eaf7b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_516b346301c2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "516b346301c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-23-27-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790520858, "last_seen": 1790520858, "transport": "t", "ja3_hash": "e42f73f66953b75aafa13d61080e2e61", "ja3_variant_count": 1, "ja3_variants": [ "e42f73f66953b75aafa13d61080e2e61" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_58a740fa37c8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "58a740fa37c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-17613-13-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790728504, "last_seen": 1790728504, "transport": "t", "ja3_hash": "6d407b759a3d9ab461e648a637bdbb5c", "ja3_variant_count": 1, "ja3_variants": [ "6d407b759a3d9ab461e648a637bdbb5c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_5fcaa16892e9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "5fcaa16892e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-51-17613-11-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790869316, "last_seen": 1790869316, "transport": "t", "ja3_hash": "13dfe4aa6f6e5a92593bfb33395ed514", "ja3_variant_count": 1, "ja3_variants": [ "13dfe4aa6f6e5a92593bfb33395ed514" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_67aba61281a0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "67aba61281a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-51-27-11-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789580052, "last_seen": 1789580052, "transport": "t", "ja3_hash": "aa260a06f5483b6d7ec2c81ecb453af3", "ja3_variant_count": 1, "ja3_variants": [ "aa260a06f5483b6d7ec2c81ecb453af3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_71d5f53619f1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "71d5f53619f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-13-18-45-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197011, "last_seen": 1790197011, "transport": "t", "ja3_hash": "8d5473a81000e1fc70680adf5a963ac7", "ja3_variant_count": 1, "ja3_variants": [ "8d5473a81000e1fc70680adf5a963ac7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_805b947456aa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "805b947456aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-27-35-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457561, "last_seen": 1789457561, "transport": "t", "ja3_hash": "f0c21b0bb23f5405446563dcbbc49160", "ja3_variant_count": 1, "ja3_variants": [ "f0c21b0bb23f5405446563dcbbc49160" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_899825fd7fbd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "899825fd7fbd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-10-51-27-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790337425, "last_seen": 1790337425, "transport": "t", "ja3_hash": "5f20550ef7238085435ab8556a3cd4d8", "ja3_variant_count": 1, "ja3_variants": [ "5f20550ef7238085435ab8556a3cd4d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_8c9359f722f2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "8c9359f722f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-17613-51764-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788610115, "last_seen": 1788610115, "transport": "t", "ja3_hash": "c75f6ca162c0a524a75a67d135893c1a", "ja3_variant_count": 1, "ja3_variants": [ "c75f6ca162c0a524a75a67d135893c1a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_945d5bd8660d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "945d5bd8660d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,17613-65281-51-13-5-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789722659, "last_seen": 1789722659, "transport": "t", "ja3_hash": "7ee4339af1b353af5ea45e046a93749d", "ja3_variant_count": 1, "ja3_variants": [ "7ee4339af1b353af5ea45e046a93749d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_9d0256f72e4c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "9d0256f72e4c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-65037-27-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790104041, "last_seen": 1790104041, "transport": "t", "ja3_hash": "33192c9350f027e5ce79bbfc09519823", "ja3_variant_count": 1, "ja3_variants": [ "33192c9350f027e5ce79bbfc09519823" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_a6331aaf8248", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "a6331aaf8248", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-5-17613-11-18,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790188281, "last_seen": 1790188281, "transport": "t", "ja3_hash": "624c0c5b0c71645569e1a4d6fb21b6bd", "ja3_variant_count": 1, "ja3_variants": [ "624c0c5b0c71645569e1a4d6fb21b6bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_b5f96f221b9a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "b5f96f221b9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-10-13-51-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790329402, "last_seen": 1790329402, "transport": "t", "ja3_hash": "75c0d0b649dfbe41c808ec0f1ceb7b4e", "ja3_variant_count": 1, "ja3_variants": [ "75c0d0b649dfbe41c808ec0f1ceb7b4e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_b8e3477cd7fd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "b8e3477cd7fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-45-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790778538, "last_seen": 1790778538, "transport": "t", "ja3_hash": "3aa9c1dad38b1b2dbd7a967a7a2d2658", "ja3_variant_count": 1, "ja3_variants": [ "3aa9c1dad38b1b2dbd7a967a7a2d2658" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_b97f863ef523", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "b97f863ef523", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-17613-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790572463, "last_seen": 1790572463, "transport": "t", "ja3_hash": "38c85eef1696a35f6a767ac33fb40eb1", "ja3_variant_count": 1, "ja3_variants": [ "38c85eef1696a35f6a767ac33fb40eb1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_bc0f43c4d1a2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "bc0f43c4d1a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-17613-27-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791248959, "last_seen": 1791248959, "transport": "t", "ja3_hash": "5cee454c858af850656899c2ed79af4d", "ja3_variant_count": 1, "ja3_variants": [ "5cee454c858af850656899c2ed79af4d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_c7869da3bc1d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "c7869da3bc1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-18-51-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839893, "last_seen": 1788839893, "transport": "t", "ja3_hash": "5994d0dc73ee0462b7ceeb798e3089f8", "ja3_variant_count": 1, "ja3_variants": [ "5994d0dc73ee0462b7ceeb798e3089f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_caf03ee8a141", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "caf03ee8a141", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-11-18-23-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791278937, "last_seen": 1791278937, "transport": "t", "ja3_hash": "8fabf6b158dd152b7cd4f2f39e491276", "ja3_variant_count": 1, "ja3_variants": [ "8fabf6b158dd152b7cd4f2f39e491276" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_cb406a45a737", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "cb406a45a737", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-51-10-27-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790384331, "last_seen": 1790384331, "transport": "t", "ja3_hash": "0b9ede71b0767b9bc02a26298cd7abe5", "ja3_variant_count": 1, "ja3_variants": [ "0b9ede71b0767b9bc02a26298cd7abe5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_d08d401a6376", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "d08d401a6376", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-13-17613-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791044485, "last_seen": 1791044485, "transport": "t", "ja3_hash": "29a43d0458a9b1b7a451b64178522a75", "ja3_variant_count": 1, "ja3_variants": [ "29a43d0458a9b1b7a451b64178522a75" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_d09f7859e250", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "d09f7859e250", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-35-65037-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790775872, "last_seen": 1790775872, "transport": "t", "ja3_hash": "ae5804437a754bae21b63a812c9ae614", "ja3_variant_count": 1, "ja3_variants": [ "ae5804437a754bae21b63a812c9ae614" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_d318822c57b5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "d318822c57b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-18-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790402642, "last_seen": 1790402642, "transport": "t", "ja3_hash": "79dea301f6a8556d115ebdd8389b166d", "ja3_variant_count": 1, "ja3_variants": [ "79dea301f6a8556d115ebdd8389b166d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_d61ca43b9b59", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "d61ca43b9b59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-27-35-10-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790595120, "last_seen": 1790595120, "transport": "t", "ja3_hash": "19a296b3400e080fb4a2f2ece16de06c", "ja3_variant_count": 1, "ja3_variants": [ "19a296b3400e080fb4a2f2ece16de06c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_d68a9a3bdfb3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "d68a9a3bdfb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-65037-17613-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791037178, "last_seen": 1791037178, "transport": "t", "ja3_hash": "187948fb3a40e5d063ddf9b7fa9e4bae", "ja3_variant_count": 1, "ja3_variants": [ "187948fb3a40e5d063ddf9b7fa9e4bae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_d7c691e3681a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "d7c691e3681a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-10-45-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790531417, "last_seen": 1790531417, "transport": "t", "ja3_hash": "0154af7c5d0a0d62b9d99952cd866f27", "ja3_variant_count": 1, "ja3_variants": [ "0154af7c5d0a0d62b9d99952cd866f27" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_eb03998f1280", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "eb03998f1280", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-45-23-35-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790929015, "last_seen": 1790929015, "transport": "t", "ja3_hash": "caaff80c8c1363d18ecc6ecd9acb155b", "ja3_variant_count": 1, "ja3_variants": [ "caaff80c8c1363d18ecc6ecd9acb155b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_f15a90f17e69", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "f15a90f17e69", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-11-27-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790584836, "last_seen": 1790584836, "transport": "t", "ja3_hash": "510851f29358033d8365361ad939021f", "ja3_variant_count": 1, "ja3_variants": [ "510851f29358033d8365361ad939021f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_fbf20f65ba58", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "fbf20f65ba58", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-27-5-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790572462, "last_seen": 1790572462, "transport": "t", "ja3_hash": "b4ee970605ee237b46acbc93cc55e887", "ja3_variant_count": 1, "ja3_variants": [ "b4ee970605ee237b46acbc93cc55e887" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_fdc68449c839", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "fdc68449c839", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-17613-18-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789638544, "last_seen": 1789638544, "transport": "t", "ja3_hash": "91513d30ee2383679cb3ff76e47a2062", "ja3_variant_count": 1, "ja3_variants": [ "91513d30ee2383679cb3ff76e47a2062" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_8daaf6152771_ffec64202672", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "ffec64202672", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-35-23-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790166979, "last_seen": 1790166979, "transport": "t", "ja3_hash": "738891381dfd96ca365c55a860592192", "ja3_variant_count": 1, "ja3_variants": [ "738891381dfd96ca365c55a860592192" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150600_d68b136fe8d9_e7e480e5a997", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "d68b136fe8d9", "c": "e7e480e5a997", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789016470, "last_seen": 1789016470, "transport": "t", "ja3_hash": "e9d8351d9365fe7b2c666bf31aad662f", "ja3_variant_count": 1, "ja3_variants": [ "e9d8351d9365fe7b2c666bf31aad662f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_8f619b424eae", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "8f619b424eae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-27-18-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789134681, "last_seen": 1789134681, "transport": "t", "ja3_hash": "8cc90659e8ac41ab5a59329c6e20921d", "ja3_variant_count": 1, "ja3_variants": [ "8cc90659e8ac41ab5a59329c6e20921d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_04edf95b0ad5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "04edf95b0ad5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-18-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789948966, "last_seen": 1789948966, "transport": "t", "ja3_hash": "42ad1769627fb12e48316514c36b13ed", "ja3_variant_count": 1, "ja3_variants": [ "42ad1769627fb12e48316514c36b13ed" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_0b4779f83205", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "0b4779f83205", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-13-27-17613-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790039848, "last_seen": 1790039848, "transport": "t", "ja3_hash": "0cc78861de8f3c8595064fdd6ff4576e", "ja3_variant_count": 1, "ja3_variants": [ "0cc78861de8f3c8595064fdd6ff4576e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_0eb9c53350b9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "0eb9c53350b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-11-65281-5-27-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790160092, "last_seen": 1790160092, "transport": "t", "ja3_hash": "9516f8896b27ba2cd2226915ed57ef5c", "ja3_variant_count": 1, "ja3_variants": [ "9516f8896b27ba2cd2226915ed57ef5c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_16029295323e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "16029295323e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-65281-10-18-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791040710, "last_seen": 1791040710, "transport": "t", "ja3_hash": "dc4df319008e3c4c7fb6e37d2018d3c7", "ja3_variant_count": 1, "ja3_variants": [ "dc4df319008e3c4c7fb6e37d2018d3c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_1994a38f1d08", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "1994a38f1d08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-23-65037-10-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789398579, "last_seen": 1789398579, "transport": "t", "ja3_hash": "0d103301e1f351181c473ef1d99aaaa1", "ja3_variant_count": 1, "ja3_variants": [ "0d103301e1f351181c473ef1d99aaaa1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_2aeef566ab24", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "2aeef566ab24", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,10-23-17613-18-35-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789580982, "last_seen": 1789580982, "transport": "t", "ja3_hash": "8aa65c22194d49902c9cf2f2ac82c400", "ja3_variant_count": 1, "ja3_variants": [ "8aa65c22194d49902c9cf2f2ac82c400" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_313881862f12", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "313881862f12", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-18-27-11-51-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789375380, "last_seen": 1789375380, "transport": "t", "ja3_hash": "f58719739bf93e418df1965cadbf2107", "ja3_variant_count": 1, "ja3_variants": [ "f58719739bf93e418df1965cadbf2107" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_32012d139755", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "32012d139755", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-17613-13-45-10-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723896, "last_seen": 1788723896, "transport": "t", "ja3_hash": "2931c10b9183fc6706afddc381a6a7f8", "ja3_variant_count": 1, "ja3_variants": [ "2931c10b9183fc6706afddc381a6a7f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_421cf2d8d718", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "421cf2d8d718", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-35-10-45-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789112194, "last_seen": 1789112194, "transport": "t", "ja3_hash": "3429b170a45116dae26c0bb85d2249ec", "ja3_variant_count": 1, "ja3_variants": [ "3429b170a45116dae26c0bb85d2249ec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_4228b9b7b7b6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "4228b9b7b7b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-23-65281-27-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790402642, "last_seen": 1790402642, "transport": "t", "ja3_hash": "416044d1bf4fd7a0f6b0bfb761a275e4", "ja3_variant_count": 1, "ja3_variants": [ "416044d1bf4fd7a0f6b0bfb761a275e4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_4c48fad04450", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "4c48fad04450", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-65281-18-5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790870964, "last_seen": 1790870964, "transport": "t", "ja3_hash": "92b20de764a5d9d249a6847b152c8a9e", "ja3_variant_count": 1, "ja3_variants": [ "92b20de764a5d9d249a6847b152c8a9e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_4f4618a685ef", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "4f4618a685ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-45-17613-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790242107, "last_seen": 1790242107, "transport": "t", "ja3_hash": "af6990e4ff5748b12a68533b2c43db82", "ja3_variant_count": 1, "ja3_variants": [ "af6990e4ff5748b12a68533b2c43db82" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_5610e14bdfaa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "5610e14bdfaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-10-23-17613-13-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790340576, "last_seen": 1790340576, "transport": "t", "ja3_hash": "1188ab8cb32b6dd6b09a5bba6d65c4c1", "ja3_variant_count": 1, "ja3_variants": [ "1188ab8cb32b6dd6b09a5bba6d65c4c1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_6469fbe3116a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "6469fbe3116a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-23-17613-13-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790754169, "last_seen": 1790754169, "transport": "t", "ja3_hash": "3164a73948375d63bc402956594539c3", "ja3_variant_count": 1, "ja3_variants": [ "3164a73948375d63bc402956594539c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_687b9db53c94", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "687b9db53c94", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-18-11-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789776058, "last_seen": 1789776058, "transport": "t", "ja3_hash": "0de8fd93b2a15d5c6dddb8e918d50efe", "ja3_variant_count": 1, "ja3_variants": [ "0de8fd93b2a15d5c6dddb8e918d50efe" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_6af402bf20c0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "6af402bf20c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-65037-27-35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789814550, "last_seen": 1789814550, "transport": "t", "ja3_hash": "88faf8104fdad2980340d8225611140a", "ja3_variant_count": 1, "ja3_variants": [ "88faf8104fdad2980340d8225611140a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_7919cf04b481", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "7919cf04b481", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-27-23-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788719110, "last_seen": 1788719110, "transport": "t", "ja3_hash": "c6e49604a2113426640264e015b84317", "ja3_variant_count": 1, "ja3_variants": [ "c6e49604a2113426640264e015b84317" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_7f4ef2835752", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "7f4ef2835752", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-27-11-5-51-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790220362, "last_seen": 1790220362, "transport": "t", "ja3_hash": "536a4ff1e926b5c64829814f0ec69ee2", "ja3_variant_count": 1, "ja3_variants": [ "536a4ff1e926b5c64829814f0ec69ee2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_805d2cf86e22", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "805d2cf86e22", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-35-13-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790248109, "last_seen": 1790248109, "transport": "t", "ja3_hash": "7438ee98b28206ebfdb9f46779637cd1", "ja3_variant_count": 1, "ja3_variants": [ "7438ee98b28206ebfdb9f46779637cd1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_903034a50661", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "903034a50661", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-65281-45-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790955770, "last_seen": 1790955770, "transport": "t", "ja3_hash": "3bec8ee120a56f6365b4a9d10510e317", "ja3_variant_count": 1, "ja3_variants": [ "3bec8ee120a56f6365b4a9d10510e317" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_917a617eb137", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "917a617eb137", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-10-27-65281-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790972561, "last_seen": 1790972561, "transport": "t", "ja3_hash": "ea78455640a055ef514c1acf66ee0cc3", "ja3_variant_count": 1, "ja3_variants": [ "ea78455640a055ef514c1acf66ee0cc3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_99bdf495daa1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "99bdf495daa1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-23-65281-45-51-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788968980, "last_seen": 1788968980, "transport": "t", "ja3_hash": "e557bf0d8433cef5c61f65a0dc577786", "ja3_variant_count": 1, "ja3_variants": [ "e557bf0d8433cef5c61f65a0dc577786" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_9c41bb23d52a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "9c41bb23d52a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-10-51-13-35-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790449706, "last_seen": 1790449706, "transport": "t", "ja3_hash": "1b9f0e49a47b10430a80381921b4901b", "ja3_variant_count": 1, "ja3_variants": [ "1b9f0e49a47b10430a80381921b4901b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_a6dcce0805ac", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "a6dcce0805ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-65281-10-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789065558, "last_seen": 1789065558, "transport": "t", "ja3_hash": "10eb901c8cf4252c064415063c37712c", "ja3_variant_count": 1, "ja3_variants": [ "10eb901c8cf4252c064415063c37712c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_ab2e45d2b724", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "ab2e45d2b724", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-5-23-10-35-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790117740, "last_seen": 1790117740, "transport": "t", "ja3_hash": "b356d8122d16efc4aa785bcce3299a93", "ja3_variant_count": 1, "ja3_variants": [ "b356d8122d16efc4aa785bcce3299a93" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_b2062c75dfe4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "b2062c75dfe4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-18-11-65281-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791179602, "last_seen": 1791179602, "transport": "t", "ja3_hash": "8573a9835c15f2f4d15e9af1c03fdd6d", "ja3_variant_count": 1, "ja3_variants": [ "8573a9835c15f2f4d15e9af1c03fdd6d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_b2946b7a14ed", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "b2946b7a14ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-13-17613-45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788570642, "last_seen": 1788570642, "transport": "t", "ja3_hash": "c40202eb1e406ca1d47039253d0b3eee", "ja3_variant_count": 1, "ja3_variants": [ "c40202eb1e406ca1d47039253d0b3eee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_b50dca8658cf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "b50dca8658cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-45-10-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788441654, "last_seen": 1788441654, "transport": "t", "ja3_hash": "b2e0d2b872196aabc86d474bc5b051df", "ja3_variant_count": 1, "ja3_variants": [ "b2e0d2b872196aabc86d474bc5b051df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_b8209d16eb76", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "b8209d16eb76", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-51-27-23-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788542023, "last_seen": 1788542023, "transport": "t", "ja3_hash": "dd27d1e24aff608f9134ead3fed81fff", "ja3_variant_count": 1, "ja3_variants": [ "dd27d1e24aff608f9134ead3fed81fff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_ba65f5f01167", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "ba65f5f01167", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-11-10-17613-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790941890, "last_seen": 1790941890, "transport": "t", "ja3_hash": "188580b59d4cf87fbf0f7ce113a6d260", "ja3_variant_count": 1, "ja3_variants": [ "188580b59d4cf87fbf0f7ce113a6d260" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_c283641aaa71", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "c283641aaa71", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-27-18-23-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791047809, "last_seen": 1791047809, "transport": "t", "ja3_hash": "cb6c6a7ee2572acf4595c8fd6e98c6b6", "ja3_variant_count": 1, "ja3_variants": [ "cb6c6a7ee2572acf4595c8fd6e98c6b6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_c5153ce0e336", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "c5153ce0e336", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-5-51-27-11-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790338627, "last_seen": 1790338627, "transport": "t", "ja3_hash": "d3da6aec55c7124f8862207e105a261c", "ja3_variant_count": 1, "ja3_variants": [ "d3da6aec55c7124f8862207e105a261c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cbd3439583ff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cbd3439583ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-18-65281-23-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789218769, "last_seen": 1789218769, "transport": "t", "ja3_hash": "27e91a32f76839ce9c967b93c687e5ed", "ja3_variant_count": 1, "ja3_variants": [ "27e91a32f76839ce9c967b93c687e5ed" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_cc0779be0edb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "cc0779be0edb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-17613-23-45-5-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789463332, "last_seen": 1789463332, "transport": "t", "ja3_hash": "b63c5aeace3f6d31322a3ec252fb0b6c", "ja3_variant_count": 1, "ja3_variants": [ "b63c5aeace3f6d31322a3ec252fb0b6c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_d6adc066398d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "d6adc066398d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-5-35-65037-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791271243, "last_seen": 1791271243, "transport": "t", "ja3_hash": "64352785ac3ab7d8304dbfd5cb86aa73", "ja3_variant_count": 1, "ja3_variants": [ "64352785ac3ab7d8304dbfd5cb86aa73" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_d8fe17bb5186", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "d8fe17bb5186", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-13-23-51-10-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788900418, "last_seen": 1788900418, "transport": "t", "ja3_hash": "a5383ee1e16157074fb1da870a001f1c", "ja3_variant_count": 1, "ja3_variants": [ "a5383ee1e16157074fb1da870a001f1c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_daa5799f1017", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "daa5799f1017", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-45-65281-17613-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791035384, "last_seen": 1791035384, "transport": "t", "ja3_hash": "bba66c391ccaec9b7683d5c53891c4cf", "ja3_variant_count": 1, "ja3_variants": [ "bba66c391ccaec9b7683d5c53891c4cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f09ea86c8e0a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f09ea86c8e0a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-35-65037-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788866660, "last_seen": 1788866660, "transport": "t", "ja3_hash": "8b39ad5736ee95d4a4744d8b47f2282d", "ja3_variant_count": 1, "ja3_variants": [ "8b39ad5736ee95d4a4744d8b47f2282d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f580a902950d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f580a902950d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-45-27-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790337420, "last_seen": 1790337420, "transport": "t", "ja3_hash": "46a3c942b3315d2bbe1d8ed8680856bd", "ja3_variant_count": 1, "ja3_variants": [ "46a3c942b3315d2bbe1d8ed8680856bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f5faed24e712", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f5faed24e712", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-11-17613-35-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790730174, "last_seen": 1790730174, "transport": "t", "ja3_hash": "9a2c9e93719b4977dfda98a0526d4332", "ja3_variant_count": 1, "ja3_variants": [ "9a2c9e93719b4977dfda98a0526d4332" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_f7ed08e160c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "f7ed08e160c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-65037-27-65281-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789466453, "last_seen": 1789466453, "transport": "t", "ja3_hash": "0ac5dccb7c89d25445c1e4e11eed0f75", "ja3_variant_count": 1, "ja3_variants": [ "0ac5dccb7c89d25445c1e4e11eed0f75" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_fbccb213263b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "fbccb213263b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-45-51764-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789425377, "last_seen": 1789425377, "transport": "t", "ja3_hash": "48de3a6ac861fecaa0a48f6f7e1551fa", "ja3_variant_count": 1, "ja3_variants": [ "48de3a6ac861fecaa0a48f6f7e1551fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150700_8daaf6152771_fef2d5dabe42", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "fef2d5dabe42", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-51-10-65281-45-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788953300, "last_seen": 1790020002, "transport": "t", "ja3_hash": "a82d6c992723148bc09ca4814242b88f", "ja3_variant_count": 2, "ja3_variants": [ "a82d6c992723148bc09ca4814242b88f", "bd64e8f742017e15002b8aa8aecc99e4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_c745986123b2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "c745986123b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-18-65037-17613-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788623853, "last_seen": 1788623853, "transport": "t", "ja3_hash": "a2fc9b380e8bbfa56a506d0094edc566", "ja3_variant_count": 1, "ja3_variants": [ "a2fc9b380e8bbfa56a506d0094edc566" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_0119391a25f1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "0119391a25f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-51-65281-10-45-11-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790211132, "last_seen": 1790211132, "transport": "t", "ja3_hash": "29870420acbaf2a87e21115132b6878c", "ja3_variant_count": 1, "ja3_variants": [ "29870420acbaf2a87e21115132b6878c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_0978cf1f6ec7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "0978cf1f6ec7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-51764-17613-13-65037-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791035935, "last_seen": 1791035935, "transport": "t", "ja3_hash": "15623a1d73246f470dd0d892f1761894", "ja3_variant_count": 1, "ja3_variants": [ "15623a1d73246f470dd0d892f1761894" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_1182c0001add", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "1182c0001add", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-10-18-11-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789720569, "last_seen": 1789720569, "transport": "t", "ja3_hash": "fade8736c7bf9a09d029be9aeeb3d9eb", "ja3_variant_count": 1, "ja3_variants": [ "fade8736c7bf9a09d029be9aeeb3d9eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_27ce5fc7f32f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "27ce5fc7f32f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-13-10-45-35-27-5,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789430565, "last_seen": 1789430565, "transport": "t", "ja3_hash": "109e8c59643bf49e1af666a1ef05be96", "ja3_variant_count": 1, "ja3_variants": [ "109e8c59643bf49e1af666a1ef05be96" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_3eb8879bfe40", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "3eb8879bfe40", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-23-65037-45-17613-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790800526, "last_seen": 1790800526, "transport": "t", "ja3_hash": "cbc444c93b3f7a07f5d075692f1994ab", "ja3_variant_count": 1, "ja3_variants": [ "cbc444c93b3f7a07f5d075692f1994ab" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_4884167d2bfb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "4884167d2bfb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-11-35-45-51764-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790129507, "last_seen": 1790129507, "transport": "t", "ja3_hash": "bfd3e8749d66ba744844794e5b8deff9", "ja3_variant_count": 1, "ja3_variants": [ "bfd3e8749d66ba744844794e5b8deff9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_4a658035ce01", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "4a658035ce01", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-18-35-11-27-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788889490, "last_seen": 1788889490, "transport": "t", "ja3_hash": "13d3bc354432edb32078c7db75c98620", "ja3_variant_count": 1, "ja3_variants": [ "13d3bc354432edb32078c7db75c98620" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_4cd9689b0b84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "4cd9689b0b84", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-11-51-27-45-65281-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791272589, "last_seen": 1791272589, "transport": "t", "ja3_hash": "e8f6b030cf432a8c9cd360037fc2afe7", "ja3_variant_count": 1, "ja3_variants": [ "e8f6b030cf432a8c9cd360037fc2afe7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_59f5fcb7ee87", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "59f5fcb7ee87", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-11-23-35-45-5-18,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790133435, "last_seen": 1790133435, "transport": "t", "ja3_hash": "952a16c88b04d0f37d8a09d29d23a2d2", "ja3_variant_count": 1, "ja3_variants": [ "952a16c88b04d0f37d8a09d29d23a2d2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_63aba6a9e593", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "63aba6a9e593", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-11-45-23-5-65281-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789880523, "last_seen": 1789880523, "transport": "t", "ja3_hash": "2faeddb0f308167f4de4c807fbdb19d1", "ja3_variant_count": 1, "ja3_variants": [ "2faeddb0f308167f4de4c807fbdb19d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_671a3422175e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "671a3422175e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-45-10-65281-27-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790728760, "last_seen": 1790728760, "transport": "t", "ja3_hash": "d27adc9c6e64809113e9c0f68e6eb83c", "ja3_variant_count": 1, "ja3_variants": [ "d27adc9c6e64809113e9c0f68e6eb83c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_6951a13b3eb8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "6951a13b3eb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-45-13-10-35-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789979304, "last_seen": 1789979304, "transport": "t", "ja3_hash": "55645d9367ff524682bf57b8c066d8d9", "ja3_variant_count": 1, "ja3_variants": [ "55645d9367ff524682bf57b8c066d8d9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_84d6b11c5164", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "84d6b11c5164", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-23-51-11-45-10-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789820703, "last_seen": 1789820703, "transport": "t", "ja3_hash": "5bccf670c4c917607da3d16e10680524", "ja3_variant_count": 1, "ja3_variants": [ "5bccf670c4c917607da3d16e10680524" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_878636a543e9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "878636a543e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-23-13-5-35-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790694083, "last_seen": 1790694083, "transport": "t", "ja3_hash": "090d625080f5aa966d3d63906e62a756", "ja3_variant_count": 1, "ja3_variants": [ "090d625080f5aa966d3d63906e62a756" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_8abed4c1a5f9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "8abed4c1a5f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-65037-18-10-65281-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791192514, "last_seen": 1791192514, "transport": "t", "ja3_hash": "5f97eaeea9fcbabb70d7f8985f0d6ec8", "ja3_variant_count": 1, "ja3_variants": [ "5f97eaeea9fcbabb70d7f8985f0d6ec8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_8b5bd30a4bda", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "8b5bd30a4bda", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-51-5-10-11-18-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789734398, "last_seen": 1789734398, "transport": "t", "ja3_hash": "01083658063e8b796ada470dcdea6ec5", "ja3_variant_count": 1, "ja3_variants": [ "01083658063e8b796ada470dcdea6ec5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_97104e8bf74f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "97104e8bf74f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-17613-65281-45-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790049219, "last_seen": 1790049219, "transport": "t", "ja3_hash": "b1b134951820ead29a01742cb9693f77", "ja3_variant_count": 1, "ja3_variants": [ "b1b134951820ead29a01742cb9693f77" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_9bfcd33a77b9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "9bfcd33a77b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-65281-18-27-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790933779, "last_seen": 1790933779, "transport": "t", "ja3_hash": "c374b5d5c5b0f1a459374de76c6a79d1", "ja3_variant_count": 1, "ja3_variants": [ "c374b5d5c5b0f1a459374de76c6a79d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_a3418fd89c4f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "a3418fd89c4f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-13-45-35-5-18-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790584516, "last_seen": 1790584516, "transport": "t", "ja3_hash": "923b4ef095831d9fff66d36e8aa7cb74", "ja3_variant_count": 1, "ja3_variants": [ "923b4ef095831d9fff66d36e8aa7cb74" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_a3eee565380f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "a3eee565380f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-10-11-65037-45-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790329177, "last_seen": 1790329177, "transport": "t", "ja3_hash": "0975145527cddf5e19c1b1230bea1159", "ja3_variant_count": 1, "ja3_variants": [ "0975145527cddf5e19c1b1230bea1159" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_a93b2330953c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "a93b2330953c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-17613-27-45-18-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790694083, "last_seen": 1790694083, "transport": "t", "ja3_hash": "2c19d5237c121caf17ee99ef04ef80bd", "ja3_variant_count": 1, "ja3_variants": [ "2c19d5237c121caf17ee99ef04ef80bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_ac6d7d3928e6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "ac6d7d3928e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-27-18-45-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024389, "last_seen": 1789024389, "transport": "t", "ja3_hash": "e91ff2b5252f817aabd30d3ac0c758f8", "ja3_variant_count": 1, "ja3_variants": [ "e91ff2b5252f817aabd30d3ac0c758f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_b358dc08cdd6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "b358dc08cdd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51764-45-10-27-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790124046, "last_seen": 1790124046, "transport": "t", "ja3_hash": "cde0594a7d0a8c7f3ea7bb9fe48bfaf1", "ja3_variant_count": 1, "ja3_variants": [ "cde0594a7d0a8c7f3ea7bb9fe48bfaf1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_b44bc9adcc12", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "b44bc9adcc12", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-5-17613-65037-10-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791042939, "last_seen": 1791042939, "transport": "t", "ja3_hash": "ddb0861782238194c0f89da054a17b82", "ja3_variant_count": 1, "ja3_variants": [ "ddb0861782238194c0f89da054a17b82" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_c2f3a15180e3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "c2f3a15180e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-13-17613-23-35-51-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789617347, "last_seen": 1789617347, "transport": "t", "ja3_hash": "21779b42ae12628c99b2a2e02eaef1c0", "ja3_variant_count": 1, "ja3_variants": [ "21779b42ae12628c99b2a2e02eaef1c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_c9593a00344f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "c9593a00344f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-51764-27-11-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790697523, "last_seen": 1790697523, "transport": "t", "ja3_hash": "1330a35954423b5bfc94a8bb8aedb80a", "ja3_variant_count": 1, "ja3_variants": [ "1330a35954423b5bfc94a8bb8aedb80a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_cf8eddec5566", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "cf8eddec5566", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-27-65281-13-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790311849, "last_seen": 1790311849, "transport": "t", "ja3_hash": "998e51377a6ba50435ffa25e2515f2fa", "ja3_variant_count": 1, "ja3_variants": [ "998e51377a6ba50435ffa25e2515f2fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_d04a0919d58a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "d04a0919d58a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-10-35-17613-13-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791251439, "last_seen": 1791251439, "transport": "t", "ja3_hash": "8b10350694b9bf901be510b72dad4378", "ja3_variant_count": 1, "ja3_variants": [ "8b10350694b9bf901be510b72dad4378" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_daba6ed279e1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "daba6ed279e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-35-18-65281-5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789813430, "last_seen": 1789813430, "transport": "t", "ja3_hash": "10b397c7f665999c6f5f45bcc3908d14", "ja3_variant_count": 1, "ja3_variants": [ "10b397c7f665999c6f5f45bcc3908d14" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_dd9c0a47ff3c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "dd9c0a47ff3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-51764-27-23-45-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790063269, "last_seen": 1790063269, "transport": "t", "ja3_hash": "b5cba16f6db4f79ad7741a5a6ca13180", "ja3_variant_count": 1, "ja3_variants": [ "b5cba16f6db4f79ad7741a5a6ca13180" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_e47fd13f142d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "e47fd13f142d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-35-13-11-10-51-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788739901, "last_seen": 1788739901, "transport": "t", "ja3_hash": "12a97e7334869d14586eb8d013c914ba", "ja3_variant_count": 1, "ja3_variants": [ "12a97e7334869d14586eb8d013c914ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_e58632cb12e2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "e58632cb12e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-35-18-11-23-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791012088, "last_seen": 1791012088, "transport": "t", "ja3_hash": "94dcff037918e6f3ab0e0aa205b37cbd", "ja3_variant_count": 1, "ja3_variants": [ "94dcff037918e6f3ab0e0aa205b37cbd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_e624693ac96d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "e624693ac96d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-5-13-35-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790104333, "last_seen": 1790104333, "transport": "t", "ja3_hash": "23d6ab4e4abb763e91316077024f8da2", "ja3_variant_count": 1, "ja3_variants": [ "23d6ab4e4abb763e91316077024f8da2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_e73e6c74de17", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "e73e6c74de17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,4832-13-35-17613-11-45-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788481946, "last_seen": 1788481946, "transport": "t", "ja3_hash": "65d4107a1080c83203d0b18a3b399d8b", "ja3_variant_count": 1, "ja3_variants": [ "65d4107a1080c83203d0b18a3b399d8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_ea73e512526b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "ea73e512526b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-17613-23-65037-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790553847, "last_seen": 1790553847, "transport": "t", "ja3_hash": "a8939d0f8cb457b6545a30b98e3af5f9", "ja3_variant_count": 1, "ja3_variants": [ "a8939d0f8cb457b6545a30b98e3af5f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_ebac0085aa10", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "ebac0085aa10", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-10-35-23-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789390434, "last_seen": 1789390434, "transport": "t", "ja3_hash": "80dc28c07c6543767d7a6b8c046c4dbe", "ja3_variant_count": 1, "ja3_variants": [ "80dc28c07c6543767d7a6b8c046c4dbe" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_ebd478606790", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "ebd478606790", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-13-51-10-27-11-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789624091, "last_seen": 1789624091, "transport": "t", "ja3_hash": "0eee5f319aad6d455b47070512a69dee", "ja3_variant_count": 1, "ja3_variants": [ "0eee5f319aad6d455b47070512a69dee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f189b76dff9a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f189b76dff9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-18-65281-27-13-51-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790773581, "last_seen": 1790773581, "transport": "t", "ja3_hash": "9f77112fcb29a9f0be0bb9126658f569", "ja3_variant_count": 1, "ja3_variants": [ "9f77112fcb29a9f0be0bb9126658f569" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150800_8daaf6152771_f59b0e7c6b94", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "f59b0e7c6b94", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-11-27-51-10-17613-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789273189, "last_seen": 1789273189, "transport": "t", "ja3_hash": "00c68c235dad2ba8ab1506fe99e0984c", "ja3_variant_count": 1, "ja3_variants": [ "00c68c235dad2ba8ab1506fe99e0984c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_e232167ddf61", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "e232167ddf61", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-10-13-27-17613-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791164268, "last_seen": 1791164268, "transport": "t", "ja3_hash": "46b303f335d97fe2269a19e62831de63", "ja3_variant_count": 1, "ja3_variants": [ "46b303f335d97fe2269a19e62831de63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_144e79f2b795", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "144e79f2b795", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-65037-10-18-65281-17613-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791280848, "last_seen": 1791280848, "transport": "t", "ja3_hash": "41e2da4f5455193320a6e048e68d6c57", "ja3_variant_count": 1, "ja3_variants": [ "41e2da4f5455193320a6e048e68d6c57" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_30e1ab43fcd7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "30e1ab43fcd7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-4832-23-11-10-65281-45-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788561557, "last_seen": 1788561557, "transport": "t", "ja3_hash": "2c02a8886f6bf13d955ec645740ba8a2", "ja3_variant_count": 1, "ja3_variants": [ "2c02a8886f6bf13d955ec645740ba8a2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_509800b4487e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "509800b4487e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-18-23-45-11-17613-51-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791280337, "last_seen": 1791280337, "transport": "t", "ja3_hash": "b0c9a5d30b68f204f6e82b7b5a1ea9b2", "ja3_variant_count": 1, "ja3_variants": [ "b0c9a5d30b68f204f6e82b7b5a1ea9b2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_6872b0a511c5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "6872b0a511c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-23-18-45-13-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788827064, "last_seen": 1788827064, "transport": "t", "ja3_hash": "b712d81458f9bb6c37c7b5be48f44b57", "ja3_variant_count": 1, "ja3_variants": [ "b712d81458f9bb6c37c7b5be48f44b57" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_930b74051380", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "930b74051380", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-23-10-13-5-17613-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524400, "last_seen": 1790524400, "transport": "t", "ja3_hash": "36748b1898028caca8881ad75e1b0621", "ja3_variant_count": 1, "ja3_variants": [ "36748b1898028caca8881ad75e1b0621" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_9411754aeb44", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "9411754aeb44", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51764-5-65281-27-45-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791035385, "last_seen": 1791035385, "transport": "t", "ja3_hash": "7794e5582169f7f72294232b0c4f545d", "ja3_variant_count": 1, "ja3_variants": [ "7794e5582169f7f72294232b0c4f545d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_abe983eacb40", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "abe983eacb40", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-5-18-23-65037-35-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791222051, "last_seen": 1791222051, "transport": "t", "ja3_hash": "212f1d45b68ecd1d265b18f32ce9fad4", "ja3_variant_count": 1, "ja3_variants": [ "212f1d45b68ecd1d265b18f32ce9fad4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_b0c8fca644ea", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "b0c8fca644ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-17613-13-5-65281-23-51-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791202866, "last_seen": 1791202866, "transport": "t", "ja3_hash": "c28ef3d7e0a5776283dd3912ad4a802f", "ja3_variant_count": 1, "ja3_variants": [ "c28ef3d7e0a5776283dd3912ad4a802f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_d2304f9bd766", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "d2304f9bd766", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-23-5-13-18-51-17613-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788459810, "last_seen": 1788459810, "transport": "t", "ja3_hash": "7a5fdb6cfe16d0e5321b6e16b755ee5d", "ja3_variant_count": 1, "ja3_variants": [ "7a5fdb6cfe16d0e5321b6e16b755ee5d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_d64835f94562", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "d64835f94562", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-23-11-65281-65037-5-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789283213, "last_seen": 1789283213, "transport": "t", "ja3_hash": "dfd7f2a8a20ebd3f23804a8aa16b87f6", "ja3_variant_count": 1, "ja3_variants": [ "dfd7f2a8a20ebd3f23804a8aa16b87f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_f6408215eadb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "f6408215eadb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-51-35-65281-17613-18-23-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789024333, "last_seen": 1789024333, "transport": "t", "ja3_hash": "c7a7df4cf91a79f6de968f2c620bc757", "ja3_variant_count": 1, "ja3_variants": [ "c7a7df4cf91a79f6de968f2c620bc757" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i150900_8daaf6152771_fb0ce4178a8a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150900", "b": "8daaf6152771", "c": "fb0ce4178a8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-11-27-17613-5-13-23-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791038802, "last_seen": 1791038802, "transport": "t", "ja3_hash": "ee4cf1f4311160787b16ad007e955566", "ja3_variant_count": 1, "ja3_variants": [ "ee4cf1f4311160787b16ad007e955566" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_01f562deb691", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "01f562deb691", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-23-45-13-65037-35-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789063158, "last_seen": 1789063158, "transport": "t", "ja3_hash": "9b4ac02c600caa1f0d4b6ae57557515c", "ja3_variant_count": 1, "ja3_variants": [ "9b4ac02c600caa1f0d4b6ae57557515c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_0b80059163df", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "0b80059163df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-5-65281-35-51-27-45-10-18,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790570073, "last_seen": 1790570097, "transport": "t", "ja3_hash": "277596480c85383eed2ee1fb966aafc6", "ja3_variant_count": 1, "ja3_variants": [ "277596480c85383eed2ee1fb966aafc6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_29886661fa57", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "29886661fa57", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-18-10-51-17613-45-5-65281-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789651390, "last_seen": 1789651390, "transport": "t", "ja3_hash": "b0fb51eccc047d929770a9765b3af49f", "ja3_variant_count": 1, "ja3_variants": [ "b0fb51eccc047d929770a9765b3af49f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_482cff946a4e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "482cff946a4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-45-27-11-51-23-65281-10-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789269978, "last_seen": 1789269978, "transport": "t", "ja3_hash": "689bd60904c44fbc7e8640f5dd4e0214", "ja3_variant_count": 1, "ja3_variants": [ "689bd60904c44fbc7e8640f5dd4e0214" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_8462dad036ee", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "8462dad036ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-65281-13-51764-5-23-27-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789338146, "last_seen": 1789338146, "transport": "t", "ja3_hash": "87f401b8bf7f74f9b3d6b5dcb0fa447d", "ja3_variant_count": 1, "ja3_variants": [ "87f401b8bf7f74f9b3d6b5dcb0fa447d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_8a97fec6fd4e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "8a97fec6fd4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-27-65037-18-13-5-35-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790400255, "last_seen": 1790400255, "transport": "t", "ja3_hash": "19bf4c954a6cc2a951cf433e27352346", "ja3_variant_count": 1, "ja3_variants": [ "19bf4c954a6cc2a951cf433e27352346" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_b455883f8077", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "b455883f8077", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-13-65037-35-27-23-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790947614, "last_seen": 1790947614, "transport": "t", "ja3_hash": "8cb09f7ad71fcbb9c20ba63f1e2d2601", "ja3_variant_count": 1, "ja3_variants": [ "8cb09f7ad71fcbb9c20ba63f1e2d2601" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_b84e1c3297c6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "b84e1c3297c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-18-27-13-45-35-65281-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789218767, "last_seen": 1789218767, "transport": "t", "ja3_hash": "aa61ebd6555d2913c3c437a96ec72699", "ja3_variant_count": 1, "ja3_variants": [ "aa61ebd6555d2913c3c437a96ec72699" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_c4ab09096119", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "c4ab09096119", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-65281-35-45-23-27-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789059650, "last_seen": 1789059650, "transport": "t", "ja3_hash": "9610cc7886688598fdad2f9a4ba23e9f", "ja3_variant_count": 1, "ja3_variants": [ "9610cc7886688598fdad2f9a4ba23e9f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_d5542cd256a2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "d5542cd256a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-65281-23-18-17613-27-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788870926, "last_seen": 1788870926, "transport": "t", "ja3_hash": "17c2bc44124fb6b0c9c77e9b97ccd02d", "ja3_variant_count": 1, "ja3_variants": [ "17c2bc44124fb6b0c9c77e9b97ccd02d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_d5d0dfbe9a7f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "d5d0dfbe9a7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-11-18-27-65281-65037-10-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508417, "last_seen": 1788508417, "transport": "t", "ja3_hash": "4502c9a87aa19c9d9e0489266c46832c", "ja3_variant_count": 1, "ja3_variants": [ "4502c9a87aa19c9d9e0489266c46832c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151000_8daaf6152771_f1fd2a088266", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151000", "b": "8daaf6152771", "c": "f1fd2a088266", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-27-10-45-18-35-65281-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788455438, "last_seen": 1788455438, "transport": "t", "ja3_hash": "68a81b9bbc6f3edf514da7f4f53ca0f0", "ja3_variant_count": 1, "ja3_variants": [ "68a81b9bbc6f3edf514da7f4f53ca0f0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_51210984fb12", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "51210984fb12", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-65037-18-17613-23-16-5-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790849773, "last_seen": 1790849773, "transport": "t", "ja3_hash": "fb7691d34c919211ed3684b0e123b7ec", "ja3_variant_count": 1, "ja3_variants": [ "fb7691d34c919211ed3684b0e123b7ec" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_042a1bab70c7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "042a1bab70c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-23-51-18-5-11-35-17613-45-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790137337, "last_seen": 1790137337, "transport": "t", "ja3_hash": "eb5b4027c7b849ef8f34365b7c8cb348", "ja3_variant_count": 1, "ja3_variants": [ "eb5b4027c7b849ef8f34365b7c8cb348" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_14ec9f72a66f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "14ec9f72a66f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-23-13-45-51764-11-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789163816, "last_seen": 1789163816, "transport": "t", "ja3_hash": "19c79e63f9bb1f523dc3bb0d39646bbc", "ja3_variant_count": 1, "ja3_variants": [ "19c79e63f9bb1f523dc3bb0d39646bbc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151100_8daaf6152771_97dcd5df63d3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151100", "b": "8daaf6152771", "c": "97dcd5df63d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-27-23-17613-5-45-65037-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789482541, "last_seen": 1789482541, "transport": "t", "ja3_hash": "495c74266eb212091cbc8d491d9a73e5", "ja3_variant_count": 1, "ja3_variants": [ "495c74266eb212091cbc8d491d9a73e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_5466b74892d6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "5466b74892d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-17613-10-27-11-65281-16-13-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789003587, "last_seen": 1789156961, "transport": "t", "ja3_hash": "0dbd4b024341a2638ebf2e89830b8fc7", "ja3_variant_count": 2, "ja3_variants": [ "0dbd4b024341a2638ebf2e89830b8fc7", "6650ba84dcef5e88d02fb14a37c96b71" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": true } }, { "hash": "t12i151200_8daaf6152771_22913f1e526a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "22913f1e526a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-23-45-18-27-11-35-17513-5-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790949380, "last_seen": 1790949380, "transport": "t", "ja3_hash": "1f8a90039386bff217519eda73714140", "ja3_variant_count": 1, "ja3_variants": [ "1f8a90039386bff217519eda73714140" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151200_8daaf6152771_6dd9beb9e8e7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151200", "b": "8daaf6152771", "c": "6dd9beb9e8e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-51-17613-23-65281-35-10-5-45-18-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789651386, "last_seen": 1789651386, "transport": "t", "ja3_hash": "b1bb23992a7593dc3dfcc88f104e53cf", "ja3_variant_count": 1, "ja3_variants": [ "b1bb23992a7593dc3dfcc88f104e53cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_58353b83dcd9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "58353b83dcd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-16-13-11-18-51764-10-65281-5-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790910043, "last_seen": 1790910043, "transport": "t", "ja3_hash": "0e10167e36b9824ba45aed9233337422", "ja3_variant_count": 1, "ja3_variants": [ "0e10167e36b9824ba45aed9233337422" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12i151300_8daaf6152771_3bb554c0827c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151300", "b": "8daaf6152771", "c": "3bb554c0827c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-65281-23-45-17613-5-18-13-27-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788848233, "last_seen": 1788848233, "transport": "t", "ja3_hash": "0e45700daf8732684cdfe09886a41b25", "ja3_variant_count": 1, "ja3_variants": [ "0e45700daf8732684cdfe09886a41b25" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151300_8daaf6152771_7c5372f3ba7a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151300", "b": "8daaf6152771", "c": "7c5372f3ba7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-11-17613-23-51764-18-27-5-65281-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790615293, "last_seen": 1790615293, "transport": "t", "ja3_hash": "3fb2fe712f2f8b3bae57f16612f94169", "ja3_variant_count": 1, "ja3_variants": [ "3fb2fe712f2f8b3bae57f16612f94169" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i151300_8daaf6152771_9df3429c194d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i151300", "b": "8daaf6152771", "c": "9df3429c194d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-27-45-11-13-23-5-65281-65037-18-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790599764, "last_seen": 1790599764, "transport": "t", "ja3_hash": "19323bf4389976cebba2ba1430343af6", "ja3_variant_count": 1, "ja3_variants": [ "19323bf4389976cebba2ba1430343af6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i160100_09c69efcb4db_af088bb94252", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i160100", "b": "09c69efcb4db", "c": "af088bb94252", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 16, "extension_count": 1, "alpn": null } }, "ja3_string": "771,47-10-19-57-4-49195-49199-49196-49200-52393-52392-49171-49172-156-157-53,13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1787847661, "last_seen": 1788572940, "transport": "t", "ja3_hash": "799b30521ece672fae5d0cec76e8d728", "ja3_variant_count": 1, "ja3_variants": [ "799b30521ece672fae5d0cec76e8d728" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i160700_8cdfa2d4673b_ac0d2f4ec206", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i160700", "b": "8cdfa2d4673b", "c": "ac0d2f4ec206", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 16, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10,5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 186, "first_seen": 1787506158, "last_seen": 1791359321, "transport": "t", "ja3_hash": "1ded1585cb6c61b529e75ada28fb83a4", "ja3_variant_count": 1, "ja3_variants": [ "1ded1585cb6c61b529e75ada28fb83a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i170700_5b57614c22b0_72474e793a45", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i170700", "b": "5b57614c22b0", "c": "72474e793a45", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,23-65281-10-11-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788480424, "last_seen": 1791001570, "transport": "t", "ja3_hash": "d96c1d2ceaa1ed7410be3e41e572a4d0", "ja3_variant_count": 2, "ja3_variants": [ "d96c1d2ceaa1ed7410be3e41e572a4d0", "83808e66b02872002c3a9e4de6f75d6a" ], "user_agents": { "libredtail-http": 82 }, "ua_disagreement": false } }, { "hash": "t12i180600_4b22cbed5bed_2dae41c691ec", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i180600", "b": "4b22cbed5bed", "c": "2dae41c691ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790524831, "last_seen": 1790524831, "transport": "t", "ja3_hash": "43016d7f7f9336b17c884650d0d2545d", "ja3_variant_count": 1, "ja3_variants": [ "43016d7f7f9336b17c884650d0d2545d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i190700_d83cc789557e_16bbda4055b2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i190700", "b": "d83cc789557e", "c": "16bbda4055b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,5-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789883393, "last_seen": 1789883393, "transport": "t", "ja3_hash": "72a589da586844d7f0818ce684948eea", "ja3_variant_count": 1, "ja3_variants": [ "72a589da586844d7f0818ce684948eea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i200600_22c523c4c553_2dae41c691ec", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i200600", "b": "22c523c4c553", "c": "2dae41c691ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788660193, "last_seen": 1789495593, "transport": "t", "ja3_hash": "113d359fe776f0b5704058d8b6474b77", "ja3_variant_count": 1, "ja3_variants": [ "113d359fe776f0b5704058d8b6474b77" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i210600_76e208dd3e22_f28add8e7af0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i210600", "b": "76e208dd3e22", "c": "f28add8e7af0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 21, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787818143, "last_seen": 1789132424, "transport": "t", "ja3_hash": "c12f54a3f91dc7bafd92cb59fe009a35", "ja3_variant_count": 1, "ja3_variants": [ "c12f54a3f91dc7bafd92cb59fe009a35" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i230700_31bea9ec6298_ac0d2f4ec206", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i230700", "b": "31bea9ec6298", "c": "ac0d2f4ec206", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 23, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49161-158-52392-52394-51-61-22-49162-57-49171-10-49172-156-157-47-53-49170,5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787847002, "last_seen": 1791331104, "transport": "t", "ja3_hash": "c725869cef931ac26d9adb2cebee59d0", "ja3_variant_count": 1, "ja3_variants": [ "c725869cef931ac26d9adb2cebee59d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i250300_8b6f115445cc_15cf763851c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i250300", "b": "8b6f115445cc", "c": "15cf763851c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 3, "alpn": null } }, "ja3_string": "771,163-159-107-106-57-56-136-135-162-158-103-64-51-50-154-153-69-68-22-19-21-18-20-17-255,35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788685058, "last_seen": 1790060683, "transport": "t", "ja3_hash": "5c6742b9d3940f70850ee675a5fdb1f0", "ja3_variant_count": 1, "ja3_variants": [ "5c6742b9d3940f70850ee675a5fdb1f0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i280500_b75078996b15_e4066bfb94a3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i280500", "b": "b75078996b15", "c": "e4066bfb94a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 28, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49196-49162-49195-52393-49161-49200-49172-49199-52392-49171-159-57-56-107-158-52394-51-50-103-22-19-157-53-61-156-47-60-10,65281-10-11-13-28,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790282842, "last_seen": 1790284174, "transport": "t", "ja3_hash": "36ee0383c7ea77794fe2299966284a00", "ja3_variant_count": 1, "ja3_variants": [ "36ee0383c7ea77794fe2299966284a00" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i280600_b75078996b15_6b16546de802", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i280600", "b": "b75078996b15", "c": "6b16546de802", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 28, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49162-49195-52393-49161-49200-49172-49199-52392-49171-159-57-56-107-158-52394-51-50-103-22-19-157-53-61-156-47-60-10,23-65281-10-11-13-28,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790125536, "last_seen": 1790125538, "transport": "t", "ja3_hash": "2721086155e2e6e30e32ea61f4d477a7", "ja3_variant_count": 1, "ja3_variants": [ "2721086155e2e6e30e32ea61f4d477a7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i280800_0df5e5c63df4_686390af6b8e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i280800", "b": "0df5e5c63df4", "c": "686390af6b8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 28, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,5-10-11-13-50-17-23-43,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 28, "first_seen": 1787496476, "last_seen": 1790617152, "transport": "t", "ja3_hash": "ca39305c183742559eb9946bcb9dc220", "ja3_variant_count": 1, "ja3_variants": [ "ca39305c183742559eb9946bcb9dc220" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i280900_0df5e5c63df4_f30da352415d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i280900", "b": "0df5e5c63df4", "c": "f30da352415d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 28, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,5-10-11-17-23-35-13-43-50,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1789364870, "last_seen": 1790584526, "transport": "t", "ja3_hash": "4b87071f1e281a29892a3ed863c6cff5", "ja3_variant_count": 1, "ja3_variants": [ "4b87071f1e281a29892a3ed863c6cff5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i300600_27daee6acec1_3c5a66c06c35", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i300600", "b": "27daee6acec1", "c": "3c5a66c06c35", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-52393-49196-49161-49162-49187-49188-49199-52392-49200-49171-49172-49191-49192-158-52394-159-51-57-103-107-156-157-60-61-47-53-10-5-255,11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 431, "first_seen": 1787444121, "last_seen": 1791360243, "transport": "t", "ja3_hash": "9812cdc989e02988bd1f0734fb6ed1a5", "ja3_variant_count": 1, "ja3_variants": [ "9812cdc989e02988bd1f0734fb6ed1a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i320300_992cb694dc73_1ea9011b3dfa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i320300", "b": "992cb694dc73", "c": "1ea9011b3dfa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 32, "extension_count": 3, "alpn": null } }, "ja3_string": "771,136-150-156-157-158-159-255-49154-49155-49156-49157-49159-49160-49161-49162-49164-49165-49166-49167-49169-49170-49171-49172-49187-49188-49191-49195-49196-49199-49200-49201-49202,11-10-13,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509858, "last_seen": 1791290840, "transport": "t", "ja3_hash": "73093a575f06249c4e9af8b3f1accf00", "ja3_variant_count": 1, "ja3_variants": [ "73093a575f06249c4e9af8b3f1accf00" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i330500_5172cef6ed69_021165082e1c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i330500", "b": "5172cef6ed69", "c": "021165082e1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 33, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49162-49161-49160-49192-49191-49172-49171-49170-61-60-53-47-10-49159-49169-5-4-49195-49199-156,5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 115, "first_seen": 1787659763, "last_seen": 1791007257, "transport": "t", "ja3_hash": "02f32644e1b0655c19aaa3a2d6778b1e", "ja3_variant_count": 1, "ja3_variants": [ "02f32644e1b0655c19aaa3a2d6778b1e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i340100_280581216cf5_e2a7de7a8184", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i340100", "b": "280581216cf5", "c": "e2a7de7a8184", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 34, "extension_count": 1, "alpn": null } }, "ja3_string": "771,4-5-10-13-16-19-22-47-48-49-50-51-53-54-55-56-57-60-61-62-63-64-65-68-69-102-103-104-105-106-107-132-135-255,13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 56, "first_seen": 1787509860, "last_seen": 1791290841, "transport": "t", "ja3_hash": "524ee2140c42a7c18bb1f571838920c0", "ja3_variant_count": 1, "ja3_variants": [ "524ee2140c42a7c18bb1f571838920c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i340800_0ca14b6c4d46_686390af6b8e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i340800", "b": "0ca14b6c4d46", "c": "686390af6b8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 34, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-157-156-61-60-53-47-255,5-10-11-13-50-17-23-43,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791057923, "last_seen": 1791057923, "transport": "t", "ja3_hash": "41fdeaaebdca76e1c186c23604e601cc", "ja3_variant_count": 1, "ja3_variants": [ "41fdeaaebdca76e1c186c23604e601cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i350400_8f004308c246_b623d8bb4e99", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i350400", "b": "8f004308c246", "c": "b623d8bb4e99", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-49191-49187-49161-49162-52394-158-159-103-107-51-57-60-49170-22-10-5-49169-49159-52243-52244,11-65281-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790827864, "last_seen": 1790827864, "transport": "t", "ja3_hash": "5b3e1aace2a82c5659782450b670467a", "ja3_variant_count": 1, "ja3_variants": [ "5b3e1aace2a82c5659782450b670467a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i400600_9479543b8654_a8cc486ca5dc", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i400600", "b": "9479543b8654", "c": "a8cc486ca5dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 40, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,11-10-35-22-23-13,29-23-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790652409, "last_seen": 1791323660, "transport": "t", "ja3_hash": "a0f0c6b3a95195695c3a5ceecc004df1", "ja3_variant_count": 1, "ja3_variants": [ "a0f0c6b3a95195695c3a5ceecc004df1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i460400_0b5b145d87b5_c70a3c84db07", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i460400", "b": "0b5b145d87b5", "c": "c70a3c84db07", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 46, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49172-49162-57-56-55-54-136-135-134-133-49167-49157-53-132-49196-49171-49161-51-50-49-48-154-153-152-151-69-68-67-66-49166-49156-47-150-65-7-49195-49170-49160-22-19-16-13-49165-49155-10-255,11-10-35-13,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1790760376, "last_seen": 1790760825, "transport": "t", "ja3_hash": "461727a4f25d2b419d5b5f700a814c43", "ja3_variant_count": 1, "ja3_variants": [ "461727a4f25d2b419d5b5f700a814c43" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i460900_5f5519fb12cc_1f7ae294493e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i460900", "b": "5f5519fb12cc", "c": "1f7ae294493e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 46, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,5-10-11-17-23-35-13-43-50,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788737388, "last_seen": 1788737388, "transport": "t", "ja3_hash": "e5366eba948b57f85abd35fbefe42ab8", "ja3_variant_count": 1, "ja3_variants": [ "e5366eba948b57f85abd35fbefe42ab8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i520700_3874cc0afe49_e59803268f14", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i520700", "b": "3874cc0afe49", "c": "e59803268f14", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 52, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52244-52243-49199-49195-49200-49196-49169-49159-49191-49187-49171-49161-49192-49188-49172-49162-52245-158-159-103-107-51-57-5-4-156-157-60-61-47-53-49170-22-10-3-8-6-20-17-25-23-50-49160-18-19-21-56-64-102-106-162-163,5-10-11-13-65281-15-18,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789168134, "last_seen": 1790132739, "transport": "t", "ja3_hash": "7bbd07c800a4622ee5d17f7cd8e090a8", "ja3_variant_count": 1, "ja3_variants": [ "7bbd07c800a4622ee5d17f7cd8e090a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i560500_8aab05645947_a1e935682795", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i560500", "b": "8aab05645947", "c": "a1e935682795", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 56, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49200-49196-49202-49198-49199-49195-49201-49197-163-159-162-158-49192-49188-49172-49162-49194-49190-49167-49157-107-106-57-56-49191-49187-49171-49161-49193-49189-49166-49156-103-64-51-50-49170-49160-49165-49155-136-135-22-19-69-68-157-156-61-53-60-47-132-10-65-255,11-10-35-13-15,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790008568, "last_seen": 1790008568, "transport": "t", "ja3_hash": "82f1e02ee17da563e023c7f005f4778a", "ja3_variant_count": 1, "ja3_variants": [ "82f1e02ee17da563e023c7f005f4778a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i570500_2a2bed94251f_a1e935682795", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i570500", "b": "2a2bed94251f", "c": "a1e935682795", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 57, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-49177-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-49176-49201-49197-49193-49189-49166-49156-156-60-47-150-65-49169-49159-49174-49164-49154-5-4-49170-49160-49175-49165-49155-10-49168-49158-49173-49163-49153-59-2-1-255,11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787697748, "last_seen": 1790717113, "transport": "t", "ja3_hash": "588552cc67787a99af4abff0d403246f", "ja3_variant_count": 1, "ja3_variants": [ "588552cc67787a99af4abff0d403246f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_13a2a23d501b_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "13a2a23d501b", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820539, "last_seen": 1789485423, "transport": "t", "ja3_hash": "959859366519cbdef2c6991b03378ef0", "ja3_variant_count": 1, "ja3_variants": [ "959859366519cbdef2c6991b03378ef0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_1715b94e3896_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "1715b94e3896", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748797, "last_seen": 1791319601, "transport": "t", "ja3_hash": "828a5add4bfafbe0fa24637a22cca1d1", "ja3_variant_count": 2, "ja3_variants": [ "828a5add4bfafbe0fa24637a22cca1d1", "7890734f5cee2a90d9ec810c830b2bec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_1e98fdfb27e9_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "1e98fdfb27e9", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49411-49413-49409-49412-49414-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748801, "last_seen": 1791319600, "transport": "t", "ja3_hash": "e08e2d7f10c70b2cee08b9d63dbfed58", "ja3_variant_count": 2, "ja3_variants": [ "e08e2d7f10c70b2cee08b9d63dbfed58", "7ec0635c5b87e19b618f8f1a9a11521d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_67f0ca237a44_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "67f0ca237a44", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820536, "last_seen": 1789485420, "transport": "t", "ja3_hash": "68082d845dc2534498110c423f39473b", "ja3_variant_count": 1, "ja3_variants": [ "68082d845dc2534498110c423f39473b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_a3acda31d846_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "a3acda31d846", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820537, "last_seen": 1789485420, "transport": "t", "ja3_hash": "63c56605bc721bba4b0e7f1cb2d5779d", "ja3_variant_count": 1, "ja3_variants": [ "63c56605bc721bba4b0e7f1cb2d5779d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_a3acda31d846_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "a3acda31d846", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748801, "last_seen": 1791319599, "transport": "t", "ja3_hash": "750e52561b0bd913cc818db50258e912", "ja3_variant_count": 2, "ja3_variants": [ "750e52561b0bd913cc818db50258e912", "9a503d7ad61152dfcc90e7fbf360df74" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_e31a90cd0803_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "e31a90cd0803", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820540, "last_seen": 1789485423, "transport": "t", "ja3_hash": "6ea56d00087701f5f5966aa8b8934588", "ja3_variant_count": 1, "ja3_variants": [ "6ea56d00087701f5f5966aa8b8934588" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_e31a90cd0803_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "e31a90cd0803", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748803, "last_seen": 1791319599, "transport": "t", "ja3_hash": "c5eb8e5c26ad136adf35aa344958ff7f", "ja3_variant_count": 2, "ja3_variants": [ "c5eb8e5c26ad136adf35aa344958ff7f", "aa629a21006ebb749c4006cfc36f92c5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_e7b476f9520b_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "e7b476f9520b", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820536, "last_seen": 1789485421, "transport": "t", "ja3_hash": "459efaaa689b1ca1bec85684cf67ad3f", "ja3_variant_count": 1, "ja3_variants": [ "459efaaa689b1ca1bec85684cf67ad3f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_e7b476f9520b_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "e7b476f9520b", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748804, "last_seen": 1791319598, "transport": "t", "ja3_hash": "6c33bc0be081a797d722d9fac5701296", "ja3_variant_count": 2, "ja3_variants": [ "6c33bc0be081a797d722d9fac5701296", "5ea215cc33f7dc2cdd06ff11eb4dc828" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_f559eb9565fd_99875426d20b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "f559eb9565fd", "c": "99875426d20b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,11-10-13,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787820537, "last_seen": 1789485421, "transport": "t", "ja3_hash": "0b2c4fb4f756d343be439d5da03aed59", "ja3_variant_count": 1, "ja3_variants": [ "0b2c4fb4f756d343be439d5da03aed59" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i640300_f559eb9565fd_c54f48fd7c65", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i640300", "b": "f559eb9565fd", "c": "c54f48fd7c65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "771,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,11-10-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748804, "last_seen": 1791319600, "transport": "t", "ja3_hash": "0e9605b8aa092831a4d7ec86dc1e758b", "ja3_variant_count": 2, "ja3_variants": [ "0e9605b8aa092831a4d7ec86dc1e758b", "732a5ee3351cc78669ebfca32d9d3d61" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i700500_b8b0f76b4bb5_a1e935682795", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i700500", "b": "b8b0f76b4bb5", "c": "a1e935682795", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 70, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49200-49196-49202-49198-49199-49195-49201-49197-165-163-161-159-164-162-160-158-49192-49188-49172-49162-49194-49190-49167-49157-107-106-105-104-57-56-55-54-49191-49187-49171-49161-49193-49189-49166-49156-103-64-63-62-51-50-49-48-136-135-134-133-69-68-67-66-157-156-61-53-60-47-132-65-49169-49159-49164-49154-5-255,11-10-35-13-15,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788646457, "last_seen": 1788646457, "transport": "t", "ja3_hash": "7233131c9641dc3d3c77395c1ff2e9b6", "ja3_variant_count": 1, "ja3_variants": [ "7233131c9641dc3d3c77395c1ff2e9b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i990300_0df3f6915705_071c21b1fa59", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i990300", "b": "0df3f6915705", "c": "071c21b1fa59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 3, "alpn": null } }, "ja3_string": "771,184-49213-49410-49154-49-98-198-49174-49240-153-49153-49261-65-49187-36-38-115-49313-44-7-49323-124-60-163-82-49223-55-45-32-62-185-164-49250-189-49239-49176-49254-49270-146-186-107-103-17-11-49182-19-65278-53251-8-49287-97-13-49175-92-49217-49189-90-68-108-190-50-4-49256-2-49268-48-49249-49320-49177-43-64-49283-49202-49222-49295-34-49218-49299-49293-152-49204-181-51-49158-166-49243-165-49210-49169-49275-49282-102-24-49209-12-106-74-52396-139-49165-129-20-66-52-89-49186-80-49301-31-85-199-49228-49207-4870-49157-49281-105-114-49409-63-4867-4866-4865-148-49230-58-21-39-53253-53250-99-49309-175-49266-49179-100-52397-83-52395-49328-28-53-49327-49258-49264-52393-49294-168-52245-182-49247-167-49306-52243-192-49414-42-49413-49412-142-49411-49236-76-140-49237-131-49330-49333-49166-26-49332-4869-14-6-144-138-49329-160-49219-49170-49326-70-49325-16-126-49229-49203-49289-49248-49324-49322-49321-49198-49318-49317-156-49316-49315-49290-49314-87-196-79-49311-49310-171-49307-52244-75-49201-157-173-49163-86-49233-49211-197-49161-49302-49300-49180-154-27-33-54-49297-49184-49296-145-46-49225-15-0-52398-49167-49288-49253-49285-49194-49244-71-49280-49172-49279-49278-96-25-49277-49276-49159-69-49274-49273-170-23-49271-49269-49267-91-52394-49246-128-49262-18-4871-49259-49257-49255-49286-172-133-195-49252-49251-49263-141-49245-49242-116-176-49241-49171-49238-49162-49196-147-130-49234-49224-72-49232-49231-49260-49272-49226-10-183-150-49216-81-78-49181-49164-49215-193-49212-49305-49160-49208-40-49206-151-49193-49205-61-49200-49214-49319-49197-49235-49195-49284-67-49192-22-49191-49190-49188-49185-49303-49298-49291-3-49178-49173-77-49168-49183-59-161-35-49331-194-5-49155-37-49304-49156-49199-191-109-30-187-49221-180-179-178-177-53249-174-49308-49227-73-169-52392-162-104-155-158-159-88-134-49220-101-65279-49292-143-49408-41-137-136-135-1-132-125-121-120-119-188-149-49265-29-49312-57-4868-84-56-47-9,15-10-13,23-24-25-29-256-4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 4870, "name": "4870 (0x1306)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 4871, "name": "4871 (0x1307)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false } ], "extensions": [ { "value": 15, "name": "heartbeat", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788737422, "last_seen": 1790001787, "transport": "t", "ja3_hash": "fa4add698de78af3f899ed0ad0d151b2", "ja3_variant_count": 6, "ja3_variants": [ "fa4add698de78af3f899ed0ad0d151b2", "aa82b4c88a71a80e83685286b3b28a52", "2e52ac7f5d41255a352402a340d0c8a6", "8d8844f72415e1293e36b4df8a5ef3fa", "243b1c57d0c94e6b05b220d541281d7c", "8550470887205f8a73d1458115d0864b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i990500_b17e8abcd084_d6ccc26a9df5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i990500", "b": "b17e8abcd084", "c": "d6ccc26a9df5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-59-138-139-142-143-146-147-176-177-180-181-184-185-49153-49154-49155-49158-49159-49160-49163-49164-49165-49168-49169-49170-49173-49174-49175-49178-49179-49180-49203-49204-49209-49210-49211-49161-49162-49171-49172-49195-49196-49199-49200-52392-52393-47-53-60-61-156-157-49187-49188-49191-49192,65281-10-11-13-23,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1787497603, "last_seen": 1791308026, "transport": "t", "ja3_hash": "9bcb56367336f5ef69ae82a8fa79cf2f", "ja3_variant_count": 1, "ja3_variants": [ "9bcb56367336f5ef69ae82a8fa79cf2f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i990600_a40d17a72bcb_4446390ac224", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i990600", "b": "a40d17a72bcb", "c": "4446390ac224", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 6, "alpn": null } }, "ja3_string": "771,5-4-2-1-22-51-57-58-24-53-10-27-47-52-49168-49158-49173-49163-49153-59-49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-56-55-54-136-135-134-133-49177-167-109-137-49202-49198-49194-49190-49167-49157-157-61-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-50-49-48-154-153-152-151-69-68-67-66-49176-166-108-155-70-49201-49197-49193-49189-49166-49156-156-60-150-65-49170-49160-19-16-13-49175-49165-49155-7-49169-49159-49174-49164-49154-255,11-10-35-13-15-21,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 76, "first_seen": 1787911742, "last_seen": 1790288719, "transport": "t", "ja3_hash": "548f8886dcfeeab8d28d3346a63b70c5", "ja3_variant_count": 1, "ja3_variants": [ "548f8886dcfeeab8d28d3346a63b70c5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d131200_f57a46bbacb6_7bba5f463f1f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "LeakIX l9scan \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131200", "b": "f57a46bbacb6", "c": "7bba5f463f1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790433957, "last_seen": 1790433978, "transport": "t", "ja3_hash": "757aede698ad3bd7f418e775dd4fd916", "ja3_variant_count": 1, "ja3_variants": [ "757aede698ad3bd7f418e775dd4fd916" ], "user_agents": { "Mozilla/5.0 (l9scan/2.0.1353e25393e2937313e26363; +https://leakix.net)": 3 }, "ua_disagreement": false } }, { "hash": "t13d131300_f57a46bbacb6_db66201a557f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "LeakIX l9scan \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131300", "b": "f57a46bbacb6", "c": "db66201a557f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 55, "first_seen": 1787605999, "last_seen": 1790473333, "transport": "t", "ja3_hash": "09ed92ccbc8eac201dc0fb108a58d04f", "ja3_variant_count": 1, "ja3_variants": [ "09ed92ccbc8eac201dc0fb108a58d04f" ], "user_agents": { "Mozilla/5.0 (l9scan/2.0.1353e25393e2937313e26363; +https://leakix.net)": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 4, "SofyaBot/1.0 (+https://sofya.co/bot)": 3 }, "ua_disagreement": true } }, { "hash": "t13d131400_f57a46bbacb6_5b9f26b9c901", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "LeakIX l9scan \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131400", "b": "f57a46bbacb6", "c": "5b9f26b9c901", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 14, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51-45-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 540, "first_seen": 1787606006, "last_seen": 1790473370, "transport": "t", "ja3_hash": "0980a0280c6477e5141882ed4a3217bd", "ja3_variant_count": 1, "ja3_variants": [ "0980a0280c6477e5141882ed4a3217bd" ], "user_agents": { "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/grokbot)": 4, "Mozilla/5.0 (l9scan/2.0.1353e25393e2937313e26363; +https://leakix.net)": 142, "Mozilla/5.0 (compatible; meta-externalagent/1.1; +https://developers.facebook.com/docs/sharing/webmasters/crawler)": 4 }, "ua_disagreement": true } }, { "hash": "t13d131400_f57a46bbacb6_b112600dc5d3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "LeakIX l9scan \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131400", "b": "f57a46bbacb6", "c": "b112600dc5d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 14, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51-45-41,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 96, "first_seen": 1790433947, "last_seen": 1791155515, "transport": "t", "ja3_hash": "2428c87b08fdda8750e81fa77bc9b284", "ja3_variant_count": 1, "ja3_variants": [ "2428c87b08fdda8750e81fa77bc9b284" ], "user_agents": { "Mozilla/5.0 (l9scan/2.0.1353e25393e2937313e26363; +https://leakix.net)": 93 }, "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_1cdbd3ccf684", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "1cdbd3ccf684", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-5-0-11-65037-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788656550, "last_seen": 1788656550, "transport": "t", "ja3_hash": "0e1cb56b7a9d49980c3b5977f850de26", "ja3_variant_count": 1, "ja3_variants": [ "0e1cb56b7a9d49980c3b5977f850de26" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_26b6e44d6663", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "26b6e44d6663", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-11-0-35-23-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789754519, "last_seen": 1789754519, "transport": "t", "ja3_hash": "be4b8a8a4451041df07793e445c04b5d", "ja3_variant_count": 1, "ja3_variants": [ "be4b8a8a4451041df07793e445c04b5d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_4c7f327d0ccd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "4c7f327d0ccd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-27-17613-18-0-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790881503, "last_seen": 1790881503, "transport": "t", "ja3_hash": "9c81a13bb67a33badf7060d12dedacfa", "ja3_variant_count": 1, "ja3_variants": [ "9c81a13bb67a33badf7060d12dedacfa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_3d27a256c82e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "3d27a256c82e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-0-11-43-18-10-35-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791243029, "last_seen": 1791243029, "transport": "t", "ja3_hash": "b35e3b505eea79ffd90cedab72ff35ef", "ja3_variant_count": 1, "ja3_variants": [ "b35e3b505eea79ffd90cedab72ff35ef" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_ac5ee1d2f7ad", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "ac5ee1d2f7ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-10-35-18-17613-11-0-27-45-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949153, "last_seen": 1789949153, "transport": "t", "ja3_hash": "8f3b6c219d05060d051953d03d7b8375", "ja3_variant_count": 1, "ja3_variants": [ "8f3b6c219d05060d051953d03d7b8375" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4b3619f2f796", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4b3619f2f796", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-65037-43-27-18-10-45-16-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949142, "last_seen": 1789949142, "transport": "t", "ja3_hash": "d66cefc6aa4dee43436da6a9f69794c8", "ja3_variant_count": 1, "ja3_variants": [ "d66cefc6aa4dee43436da6a9f69794c8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_a61184fcb7de", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "a61184fcb7de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-13-65037-0-16-18-43-23-27-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790756063, "last_seen": 1790756063, "transport": "t", "ja3_hash": "84f86b61180e801c8bce24c1b513f5e9", "ja3_variant_count": 1, "ja3_variants": [ "84f86b61180e801c8bce24c1b513f5e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_bb278c3c0a31", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "bb278c3c0a31", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-0-11-43-10-35-16-13-27-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790615732, "last_seen": 1790615732, "transport": "t", "ja3_hash": "a9de83ce2e51a58dd0d2a681028ac1f2", "ja3_variant_count": 1, "ja3_variants": [ "a9de83ce2e51a58dd0d2a681028ac1f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f7ecccdeaaaf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f7ecccdeaaaf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-43-0-27-16-35-11-10-17613-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790655674, "last_seen": 1790655674, "transport": "t", "ja3_hash": "44a030ab4821c08f600671d36252f0c9", "ja3_variant_count": 1, "ja3_variants": [ "44a030ab4821c08f600671d36252f0c9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_8136a903b543", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "8136a903b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-18-43-45-65037-11-17613-23-13-27-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788448526, "last_seen": 1788448526, "transport": "t", "ja3_hash": "a28866b5109f8ffe841dd5561ac8ce31", "ja3_variant_count": 1, "ja3_variants": [ "a28866b5109f8ffe841dd5561ac8ce31" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_0427074fac13", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "0427074fac13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-17613-16-35-0-11-10-65281-5-27-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788455440, "last_seen": 1790659265, "transport": "t", "ja3_hash": "e60539ec16761b259bb22506909cba9e", "ja3_variant_count": 2, "ja3_variants": [ "e60539ec16761b259bb22506909cba9e", "4b23e1686d9093a87072e36f3c668185" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_29cc620b70cd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "29cc620b70cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-23-45-10-43-0-35-16-27-65281-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790881541, "last_seen": 1790881541, "transport": "t", "ja3_hash": "5b0371cb3c2f01af968d5df3c6352679", "ja3_variant_count": 1, "ja3_variants": [ "5b0371cb3c2f01af968d5df3c6352679" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_575ccd9a49f1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "575ccd9a49f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-17613-13-11-18-65037-65281-35-0-45-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788469368, "last_seen": 1788469368, "transport": "t", "ja3_hash": "39265c1813bb5804be59dc31c92ce29c", "ja3_variant_count": 1, "ja3_variants": [ "39265c1813bb5804be59dc31c92ce29c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_d161217c7c0e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "d161217c7c0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-0-5-43-23-45-27-65281-17613-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788557903, "last_seen": 1788557903, "transport": "t", "ja3_hash": "82c99e1abb244e1915d572ccf9cd2366", "ja3_variant_count": 1, "ja3_variants": [ "82c99e1abb244e1915d572ccf9cd2366" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_29d740e03d48", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "29d740e03d48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-13-27-0-11-17613-65281-65037-23-5-43-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790538512, "last_seen": 1791208541, "transport": "t", "ja3_hash": "c1ddf4298a2f1d3581fda602d681a3d8", "ja3_variant_count": 3, "ja3_variants": [ "c1ddf4298a2f1d3581fda602d681a3d8", "805fcd98777676eb349724ab8125292e", "203c249ed36b161cba00db91a3a7fc94" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": true } }, { "hash": "t13d1514h2_8daaf6152771_382d3b6b503d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "382d3b6b503d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-11-45-16-0-27-18-5-17613-13-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789950132, "last_seen": 1790279582, "transport": "t", "ja3_hash": "4e087692f2c098f7f078d1af38298fda", "ja3_variant_count": 2, "ja3_variants": [ "4e087692f2c098f7f078d1af38298fda", "edce7b26429ba1cb9a43632f3e17b589" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1514h2_8daaf6152771_935464bafaea", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "935464bafaea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-10-13-0-5-43-16-51764-23-35-65281-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790320209, "last_seen": 1790320209, "transport": "t", "ja3_hash": "a95ed4e113376da440c0d3a4c154c00f", "ja3_variant_count": 1, "ja3_variants": [ "a95ed4e113376da440c0d3a4c154c00f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f7b3724c8ded", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f7b3724c8ded", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-17613-16-0-5-18-45-35-23-43-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789754435, "last_seen": 1791196452, "transport": "t", "ja3_hash": "fb626685fd9fea0a3a9afcf5983a76e1", "ja3_variant_count": 4, "ja3_variants": [ "fb626685fd9fea0a3a9afcf5983a76e1", "8a96d995d386a03bab66e2e039f6f878", "0573d00ff096070946da6663c717d453", "dea0dfa6327c1b12a1c6f550d8e20f62" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1515h2_8daaf6152771_b97abf3585a2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "b97abf3585a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-10-23-5-65281-65037-16-0-35-18-11-17613-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788967527, "last_seen": 1790334935, "transport": "t", "ja3_hash": "7306663eb68b937cc81ade57c549e02d", "ja3_variant_count": 2, "ja3_variants": [ "7306663eb68b937cc81ade57c549e02d", "0f6e3929fa8b1361a739e69ca32f66df" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_15f78a57d473", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "15f78a57d473", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51764-13-18-10-65281-16-5-65037-23-27-43-45-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790320630, "last_seen": 1790320630, "transport": "t", "ja3_hash": "215a1ad9e391cf5ae87823a107729ee8", "ja3_variant_count": 1, "ja3_variants": [ "215a1ad9e391cf5ae87823a107729ee8" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_284cd94dc111", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "284cd94dc111", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-18-23-27-35-43-11-5-10-65037-45-65281-17613-51-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 127, "first_seen": 1788442005, "last_seen": 1791362833, "transport": "t", "ja3_hash": "902c26655925c9054614b2ea863a27d0", "ja3_variant_count": 127, "ja3_variants": [ "902c26655925c9054614b2ea863a27d0", "d2894cc437de2ea662afee0cd0b16035", "6db257cefae608b68bc9f7fb8a05cebc", "a0c0792152e74009a5314b37222245c6", "b9ec7bcdfd34658d12fe0df034b34130", "1097830e1b709a8b35cc91fc8e95e085", "ae03093c665a3b7aa4ae9cc5d7d19736", "dede8b1fbfda509fd5924bb3226fea02", "27a1b7e79807a94ec5d97a2bd109d59d", "b087297c97e8ef09c92e1445defce0b3", "b1d2569baabbf738c5494e4b29cab180", "fdd1a91fd25f3755913e44c4f4761c7b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 439, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 454, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 24, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 126, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 84, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)": 19, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 87 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_2c66ae2d0ce4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "2c66ae2d0ce4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-11-10-23-45-0-16-27-18-13-65037-51-35-17613-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 146, "first_seen": 1788455481, "last_seen": 1791361945, "transport": "t", "ja3_hash": "70bad57c259ed3461ca46c299c1bd9be", "ja3_variant_count": 146, "ja3_variants": [ "70bad57c259ed3461ca46c299c1bd9be", "0b35cea2a2cc2c5798b9db231819267b", "9ba312fe64d7d51b0eb69aa8c9404d95", "5138443689e2d930a642c7ba43aa1ec4", "ff4c9048a8f0359d60ca978804547562", "6b8c644f556f769618432f8d5970006e", "78f3436637c361bfe495f3eee355c4ba", "0c2041781298762bb146d127ff31493e", "2538d65aae41bceacc4e4717c24e7f3e", "950ae74a1ddfc5a8c75c5550e6ae6e81", "f5ded4e0f4568c6ebef5371075764611", "37532b306ba8974e057fe6b26f582370" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 509, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 734, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 138, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 2, "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)": 22, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 Edg/155.0.0.0": 45, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 9, "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 168, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_4fce3e8e6c1f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "4fce3e8e6c1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-13-27-23-43-35-18-5-10-65037-11-0-17613-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 128, "first_seen": 1788455482, "last_seen": 1791361875, "transport": "t", "ja3_hash": "ab9fcc47a341919c2dfb123dd6e12ae4", "ja3_variant_count": 128, "ja3_variants": [ "ab9fcc47a341919c2dfb123dd6e12ae4", "5c0b9feb9d1eef2dfa846f7ea6d79c3c", "39df6907f9669075d2f5edd1b9908b3e", "d3b3af94ae9024248b09afc294372999", "871945f7ce9a3f317c656728d31a5212", "dda487e3e2e42a3d9756e472a6df4d0c", "b3fc2dee4d8de60b9664f228e68bbd7b", "9860050318189b220cb7b6f27d64fc89", "f8a75ba5f355779fc0f6762d3c54f8aa", "f8b950accbda7cf8b2f53d9677739ef4", "22acf5a6576700066b29ae8484d8feba", "a7937bb192a772fafe17529f2cb1d756" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 289, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 327, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Linux; Android 15; 23049RAD8C Build/AQ3A.241006.001) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.8010.36 Mobile Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 143, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 86, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 52, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 163, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_6698f0c401b6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "6698f0c401b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-65037-5-17613-51-65281-45-13-0-35-10-27-11-16-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 122, "first_seen": 1788442003, "last_seen": 1791361945, "transport": "t", "ja3_hash": "dc2e97814dfbe155a453744cd7abf7af", "ja3_variant_count": 122, "ja3_variants": [ "dc2e97814dfbe155a453744cd7abf7af", "fb9a61a5104991b5178e49aca7feb3c5", "bf04bfb818e268b4e02be5b2844693bd", "30060045a5689a466eae4086f9a0bf7f", "2b935c4a36144e049f3b8aac118516cf", "e27d1f496859d4bb6482fed7b8425172", "b596a6b407eba56bd1e0edeb0fb19453", "713b163d9b182d620076394b022bca97", "788fa16932aa71ce870465014e4180dc", "61f18a45568c8697e0cc3cb611175a36", "614456462a794da9a6ae14b7b489fa79", "94aaa4654062a62c1913d55d9e1a95a8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 108, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 21, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 330, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 49, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 397, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 160, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 183, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 52, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_a26a6bb28320", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a26a6bb28320", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-65281-23-51-10-17613-18-5-0-27-35-65037-11-43-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 109, "first_seen": 1788442002, "last_seen": 1791361946, "transport": "t", "ja3_hash": "fb57a88f57c6a563c9ed1582ac6cb04f", "ja3_variant_count": 109, "ja3_variants": [ "fb57a88f57c6a563c9ed1582ac6cb04f", "5087e21bd3e6f79f03280891a959bb8d", "701b2a3c2643269cf5b5956db8d5263d", "455a346a5e3c463caf58000657c4547a", "542c7c4eee077dc99eaf634f5b64d32d", "f8e0e105871ee167f868fe18b514525a", "fbedb2814c891f5d0c9b3363705e2052", "7a57ea2fef1127ae392809fda5c930f5", "83b8837165c44a8d856412519e6e3de8", "430244931d67086a2aa172ffee8b23b5", "83f830dc348561e0b16df9863a8691f1", "0b03b30d3ff34e27e25cc1c9e301941a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 314, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.8010.12 Safari/537.36": 1198, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 41, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 85, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 242, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 62, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 17, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d1516h2_8daaf6152771_db113fc12e09", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "db113fc12e09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-18-17613-10-65281-51-5-35-0-13-16-11-27-23-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 22763, "first_seen": 1788442614, "last_seen": 1791363257, "transport": "t", "ja3_hash": "091b5b7b79dabfb28d2e6d498acabcfd", "ja3_variant_count": 22622, "ja3_variants": [ "091b5b7b79dabfb28d2e6d498acabcfd", "17332c4d59d8d9f5e95f42b5c7c3e34f", "b0f12e6217b9ae88be7eb4297345f5ea", "56b4b271fce9b7336bd50fece4e7598e", "98690eb17430304efe93b275ad758c88", "b6cd5e42a5a5459df31d8a9327996839", "fff3b004f91860d3485feb7495152b4e", "284f0e89dc283e0c547ae463c9d05b88", "ec645150e8aa146d698f063822f5bf74", "1c0f9fedeec1a93042ed28ff6a186fe7", "11a60fc550259d835f2869571676a26a", "d1310adc56bebc892864ae20669c066f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36": 25388, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.7778.0 Safari/537.36": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 994, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 3181, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 21, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 6868, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.162 Safari/537.36": 224, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 2380, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1336, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5968, "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 1345, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.1.0 Safari/537.36 Edg/128.1.0": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.1 Safari/537.36 Edg/135.0.1": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 6, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1889, "Mozilla/5.0 (Linux; Android 10; SM-G981A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Mobile Safari/537.36 EdgA/80.0.361.48": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 10, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 21, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 143, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 500, "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 104, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 34, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1648, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 10, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 25, "Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deepseek.com/)": 16, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 450, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 271, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 482, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/147.0.7727.15 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 172, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0 Safari/537.36": 462, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 188, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 14, "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 121, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.175 Safari/537.36": 550, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 44, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 46, "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 94, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.0.0 Mobile/15E148 Safari/604.1": 118, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 38, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 53, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0 Safari/537.36": 86, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 12, "Mozilla/5.0 (Linux; Android 15; SM-S938B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36": 129, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 2162, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 26, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.7390.0 Safari/537.36": 436, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 25, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 164, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 ForestEngine/1.0 (+https://forestengine.net/#opt-out)": 18, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 114, "AtlasBot/1.0 (+https://atlas.harmoniamix.com/bot)": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 5, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.0.0 Mobile/15E148 Safari/604.1": 185, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 532, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.1.0 Safari/537.36 Edg/135.1.0": 11, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 128, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.1 Safari/537.36 Edg/128.0.1": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 202, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0 Safari/537.36": 549, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 32, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 140, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 35, "Mozilla/5.0 (compatible; ForestEngine/1.0; +https://forestengine.net/)": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 118, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 86, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.7827.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 152, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 12, "Sogou web spider/4.0": 151, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.1.0 Safari/537.36 Edg/128.1.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 28, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 19, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 13, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0 Safari/537.36": 234, "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.googl": 33, "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)": 13, "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 398, "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)": 12, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic.com)": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 15, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 366, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 10, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot": 9, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 10, "YisouSpider": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 13, "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)": 18, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 16, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 443, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 21, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 230, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 10, "namazu-cache-plus-ceph-body/1.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0 Safari/537.36": 4024, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 6, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 30, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Mobile Safari/537.36": 165, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.1.0 Safari/537.36 Edg/128.1.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 8, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 38, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 14, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 139, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.1 Safari/537.36 Edg/135.0.1": 12, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.163 Safari/537.36": 274, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 31, "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 117, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 6, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 22, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/136.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 5, "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)": 15, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 10, "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)": 5, "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)": 8, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot)": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 44, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 8, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.1.0 Safari/537.36 Edg/128.1.0": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 8, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anthropic.com)": 20, "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)": 20, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.7632.26 Mobile Safari/537.36": 20, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 14, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.1 Safari/537.36 Edg/128.0.1": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 10, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0 Safari/537.36 Edg/130.0.0": 16, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 274, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 7, "CCBot/2.0 (https://commoncrawl.org/faq/)": 9, "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)": 11, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 110, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.1 Safari/537.36 Edg/128.0.1": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 70, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 52, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.1.0 Safari/537.36 Edg/135.1.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.1 Safari/537.36 Edg/128.0.1": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 4, "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)": 13, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1": 101, "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)": 11, "Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36 aweme_230400 JsSdk/1": 40, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36": 4, "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)": 9, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 10, "Go-http-client/2.0": 1, "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)": 9, "Mozilla/5.0 (iPhone; CPU iPhone OS 15_7 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Criw/120.0.0.0 Mobile/15E148 Safari/537.36": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 8, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 4, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.1 Safari/537.36 Edg/135.0.1": 7, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 20, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 16, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0 Safari/537.36 Edg/133.0.0": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0 Safari/537.36 Edg/130.0.0": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0 Safari/537.36 Edg/130.0.0": 26, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0 Safari/537.36 Edg/130.0.0": 6, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.1 Safari/537.36 Edg/128.0.1": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 72, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0 Safari/537.36 Edg/130.0.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.1.0 Safari/537.36 Edg/128.1.0": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 27, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 4, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Safari/537.36": 46, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 11, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7339.0 Safari/537.36": 226, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/116.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.1 Safari/537.36 Edg/135.0.1": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)": 20, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)": 12, "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 69, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 4, "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 6, "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 6, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 91, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.6.2 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.1.0 Safari/537.36 Edg/135.1.0": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 SamanthaDoubao/2.29.12": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)": 5, "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)": 7, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) CodeBuddyCN/1.106.1 Chrome/138.0.7204.251 Electron/37.7.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 8, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 45, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0 Safari/537.36 Edg/132.0.0": 7, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.1 Safari/537.36 Edg/135.0.1": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 8, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/145.0.7632.55 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0 Safari/537.36 Edg/128.0.0": 5, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 4, "Mozilla/5.0 (X11; CrOS x86_64 14150.87.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.124 Safari/537.36": 4, "Mozilla/5.0 (Linux; U; Android 13; zh-cn; PFCM00 Build/TP1A.220905.001) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/115.0.5790.168 Mobile Safari/537.36 HeyTapBrowser/": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.1 Safari/537.36 Edg/128.0.1": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0 Safari/537.36 Edg/130.0.0": 14, "Mozilla/5.0 (Linux; Android 14; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.7499.4 Mobile Safari/537.36": 188, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) CodeBuddyCN/1.106.1 Chrome/138.0.7204.251 Electron/37.7.0 Safari/537.36": 4, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.1.0 Safari/537.36 Edg/135.1.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.5163.1269 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 15, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.1 Safari/537.36 Edg/135.0.1": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 39, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 11, "Mozilla/5.0 (iPhone; CPU iPhone OS 15_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1.1 Mobile/15E148 Safari/605.1.15": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 Edg/143.0.0.0": 31, "Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 4, "Mozilla/5.0 (Linux; Android 10; SM-N950F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Mobile Safari/537.36": 22, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.1.0 Safari/537.36 Edg/133.1.0": 8, "Mozilla/5.0 (Linux; Android 13; SM-A037U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0": 14, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.1.0 Safari/537.36 Edg/134.1.0": 4, "HanaleiBot runid=beta-stage-integration-test": 15, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1; +http://www.google.com/bot.html) Chrome/140.0.0.0 Safari/537.36": 33, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.0 Safari/537.36 Edg/132.1.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 90, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0 Safari/537.36 Edg/134.0.0": 8, "Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.1.0 Safari/537.36 Edg/135.1.0": 5, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddyAI/5.5.2 workbuddy-ai/5.5.2 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/147.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 31, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36": 72, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 7, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.1.0 Safari/537.36 Edg/135.1.0": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/30.0 Chrome/143.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)": 9, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.1 Safari/537.36 Edg/131.0.1": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 YaBrowser/26.6.0.0 Safari/537.36": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.5.6 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 3, "Brightbot 1.0": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 34, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Code/1.138.0 Chrome/148.0.7778.280 Electron/42.10.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36": 1, "\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36\"": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.1.0 Safari/537.36 Edg/128.1.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 50, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 EdgA/149.0.0.0": 31, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) QQ/9.9.36-53644 Chrome/144.0.7559.60 Electron/40.0.0 Safari/537.36 OS/win32,x64,10.0.22631,Windows ": 1, "Mozilla/5.0 (Linux; Android 13; PFFM10 Build/TP1A.220905.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.181 Mobile Safari/537.36 aweme_250000 JsSdk/1.": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.1 Safari/537.36 Edg/129.0.1": 4, "com.google.android.googlequicksearchbox/301810370 (Linux; U; Android 15; en_IN; LAVA LXX504; Build/AP3A.240905.015.A2; Cronet/147.0.7727.132)": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Bravebot/1.0; +https://search.brave.com/help/brave-search-crawler) Chrome/W.X.Y.Z Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.5948.1368 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (iPad; CPU OS 26_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.7727.47 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.7.3 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.1 Safari/537.36 Edg/135.0.1": 2 }, "ua_disagreement": true } }, { "hash": "t13d1518h2_8daaf6152771_6c776d3bdae5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "6c776d3bdae5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-5-17613-51764-45-51-4832-43-0-10-35-13-18-23-11-27-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789731442, "last_seen": 1791258882, "transport": "t", "ja3_hash": "fecfb53291c3ac7a73bfd997812dc746", "ja3_variant_count": 4, "ja3_variants": [ "fecfb53291c3ac7a73bfd997812dc746", "20ef01b68650e7d17d6f3247680a9a77", "f26fa7c932bf59119a384744cce3f146", "d6da78d73baaab6a2c943baf6c762ba9" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_ab0a1bf427ad_7a68ffdc4b3d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "ImageBot (research) \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "7a68ffdc4b3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 149, "first_seen": 1787467733, "last_seen": 1791230821, "transport": "t", "ja3_hash": "4bdac5abde98465c2a2ffd5401d73cfd", "ja3_variant_count": 2, "ja3_variants": [ "4bdac5abde98465c2a2ffd5401d73cfd", "a1ebe7f90a577e9399eaa60be3c67721" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124 Safari/537.36": 30, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120 Safari/537.36": 10, "Open2Real-Love-Academy-Catalog/1.0 (metadata importer)": 2, "Mozilla/5.0 (compatible; wp2shell-audit/3.1)": 4, "Python-urllib/3.14": 4, "ImageBot/1.0 (compatible; research crawler; +https://github.com/rom1504/img2dataset; opt-out: abuse.notification.dcomp12b@gmail.com;": 32 }, "ua_disagreement": true } }, { "hash": "t13d190600_9c2f387b437f_82b0993b6ad8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (82b0993b6ad8) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d190600", "b": "9c2f387b437f", "c": "82b0993b6ad8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4871-4870-4869-4868-4865-4866-4867-49332-49333-199-198-49330-49328-49331-49329-49411-49413-49412-49414,43-10-0-11-13-51,23-24-25-29-256-4588-41,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4871, "name": "4871 (0x1307)", "known": false }, { "value": 4870, "name": "4870 (0x1306)", "known": false }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710042, "last_seen": 1788842286, "transport": "t", "ja3_hash": "21219b880ef26c2510377db4c00826f5", "ja3_variant_count": 11, "ja3_variants": [ "21219b880ef26c2510377db4c00826f5", "4271fa2d59f87f8372dd8556b90d6b2f", "811ee76bda3969ee572b8518b24130e5", "4ce96adf70403fc18f4fcec2a74f95ad", "718337ca7694e38b0dbdeacff34fea1f", "b754c7556ee474203f1720aec3ec1eef", "0f4a63bb415896649602402180894560", "e4231b37295f4aee1b5e2e5236f0f13b", "b808ec2204f311d7f305f271f078bde4", "0adeb621db37ef98458c8073c3a76ecd", "a3cb62f17d6fe3e436441fff413f3797" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d191000_9dc949149365_27f0a1fdd87d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "SemrushBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d191000", "b": "9dc949149365", "c": "27f0a1fdd87d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-11-65281-23-18-5-10-13-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 83, "first_seen": 1787475191, "last_seen": 1791359149, "transport": "t", "ja3_hash": "6f298f9c6526379529df529f91fc2557", "ja3_variant_count": 2, "ja3_variants": [ "6f298f9c6526379529df529f91fc2557", "1be8360b66649edee1de25f81d98ec27" ], "user_agents": { "Go-http-client/1.1": 15, "Mozilla/5.0 (compatible; SemrushBot-BA; +http://www.semrush.com/bot.html)": 20, "Mozilla/5.0 (Linux; U; Android 4.3; en-us; sdk Build/MR1) AppleWebKit/536.23 (KHTML, like Gecko) Version/4.3 Mobile Safari/536.23": 1, "Mozilla/5.0 (X11; Linux x86_64)": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0": 6, "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0": 4 }, "ua_disagreement": true } }, { "hash": "t13d1910h2_9dc949149365_466c27a6074e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "zgrab \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1910h2", "b": "9dc949149365", "c": "466c27a6074e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-13-65281-16-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1787834202, "last_seen": 1791261628, "transport": "t", "ja3_hash": "3fed133de60c35724739b913924b6c24", "ja3_variant_count": 2, "ja3_variants": [ "3fed133de60c35724739b913924b6c24", "b102b73a090f4079a02e520bc16cc6cf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 2, "Mozilla/5.0 zgrab/0.x": 7, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/105.0.1668.84 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 3 }, "ua_disagreement": true } }, { "hash": "t13d301000_3c43a67630b3_27f0a1fdd87d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Internet Measurement \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301000", "b": "3c43a67630b3", "c": "27f0a1fdd87d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49160-49170-10-49188-49192-49187-49191-60-61-49159-49169-5-4-4865-4866-4867,0-5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 40, "first_seen": 1787643865, "last_seen": 1791345630, "transport": "t", "ja3_hash": "26086471650ff2aef650d748b8b581b4", "ja3_variant_count": 1, "ja3_variants": [ "26086471650ff2aef650d748b8b581b4" ], "user_agents": { "Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)": 40 }, "ua_disagreement": false } }, { "hash": "t13d3013h1_1d37bd780c83_7a68ffdc4b3d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Shares its JA4_c (7a68ffdc4b3d) with 1 fingerprint classified as scanner, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d3013h1", "b": "1d37bd780c83", "c": "7a68ffdc4b3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790956920, "last_seen": 1790956920, "transport": "t", "ja3_hash": "5c61aa698ca199140221fbd080112c46", "ja3_variant_count": 1, "ja3_variants": [ "5c61aa698ca199140221fbd080112c46" ], "user_agents": { "webapp-mapper-authorized-probe/0.1": 1 }, "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d311000_8ae6a2f5ac15_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "SemrushBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "8ae6a2f5ac15", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-47-49196-49200-49327-49325-49195-49199-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-157-49313-49309-156-49312-49308-61-60-53-65-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 19463, "first_seen": 1787450655, "last_seen": 1791363393, "transport": "t", "ja3_hash": "e4228d1fa6f13a432e4bc5ff54841b91", "ja3_variant_count": 1, "ja3_variants": [ "e4228d1fa6f13a432e4bc5ff54841b91" ], "user_agents": { "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)": 19461, "Mozilla/5.0 (compatible; BacklinksExtendedBot)": 2 }, "ua_disagreement": false } }, { "hash": "t13d351300_bfa337485184_07030ae8cff1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "MJ12bot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d351300", "b": "bfa337485184", "c": "07030ae8cff1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51-27,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 218, "first_seen": 1787455859, "last_seen": 1790478873, "transport": "t", "ja3_hash": "946df659d56e0ff7ee9c15561df14a6f", "ja3_variant_count": 1, "ja3_variants": [ "946df659d56e0ff7ee9c15561df14a6f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko; GeedoShopProductFinder) Chrome/142.0.0.0 Safari/537.36": 58, "Mozilla/5.0 (compatible; MJ12bot/v2.0.5; http://mj12bot.com/)": 330, "Mozilla/5.0 (compatible; MJ12bot/v2.0.7; http://mj12bot.com/)": 11 }, "ua_disagreement": true } }, { "hash": "t13d491300_bd868743f55c_fb34c6f268a0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Barkrowler (Babbar) \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d491300", "b": "bd868743f55c", "c": "fb34c6f268a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6214, "first_seen": 1787488905, "last_seen": 1791357414, "transport": "t", "ja3_hash": "d7a2543716f784e8de73ffe3f7f6234b", "ja3_variant_count": 1, "ja3_variants": [ "d7a2543716f784e8de73ffe3f7f6234b" ], "user_agents": { "Mozilla/5.0 (compatible; SERankingBacklinksBot/1.0; +https://seranking.com/backlinks-crawler)": 5105, "Mozilla/5.0 (compatible; Barkrowler/0.9; +https://babbar.tech/crawler)": 1014, "Mozilla/5.0 (compatible; IbouBot/1.0; +bot@ibou.io; +https://ibou.io/iboubot.html)": 167 }, "ua_disagreement": false } }, { "hash": "t13i021000_62ed6f6ca7ad_4a12575e92d6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i021000", "b": "62ed6f6ca7ad", "c": "4a12575e92d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865,11-65281-23-18-5-10-13-50-43-51,24-23-25-4588-4589-4587,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241275, "last_seen": 1790241275, "transport": "t", "ja3_hash": "b01f6f8bcc34ddd2b6c3ffe398c2e83c", "ja3_variant_count": 1, "ja3_variants": [ "b01f6f8bcc34ddd2b6c3ffe398c2e83c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i021000_9d5106e3f751_1f11001baa05", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i021000", "b": "9d5106e3f751", "c": "1f11001baa05", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 2, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-255,11-10-35-5-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791319589, "last_seen": 1791319589, "transport": "t", "ja3_hash": "3ee732b0e85ffe0d95e6cba14ed6a859", "ja3_variant_count": 1, "ja3_variants": [ "3ee732b0e85ffe0d95e6cba14ed6a859" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i030500_55b375c5d22e_fe63f8dcebdd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i030500", "b": "55b375c5d22e", "c": "fe63f8dcebdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867,43-10-51-13-45,29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 29, "first_seen": 1787497632, "last_seen": 1791308060, "transport": "t", "ja3_hash": "d190b714adb9da7a09ec21bd4ce7fbfc", "ja3_variant_count": 1, "ja3_variants": [ "d190b714adb9da7a09ec21bd4ce7fbfc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i030700_55b375c5d22e_81ef6f8817e6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i030700", "b": "55b375c5d22e", "c": "81ef6f8817e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4866-4865-4867,5-10-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788737388, "last_seen": 1790001652, "transport": "t", "ja3_hash": "80edc6169d3210b7ba479fc100785a05", "ja3_variant_count": 1, "ja3_variants": [ "80edc6169d3210b7ba479fc100785a05" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i030800_55b375c5d22e_75ab3bfddadf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i030800", "b": "55b375c5d22e", "c": "75ab3bfddadf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867,18-65037-5-10-13-50-43-51,29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790266805, "last_seen": 1790266805, "transport": "t", "ja3_hash": "17d45b29895168f5a80923ffe68aae4f", "ja3_variant_count": 1, "ja3_variants": [ "17d45b29895168f5a80923ffe68aae4f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i031000_55b375c5d22e_4a12575e92d6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i031000", "b": "55b375c5d22e", "c": "4a12575e92d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 241, "first_seen": 1787448766, "last_seen": 1791346376, "transport": "t", "ja3_hash": "4b7c9e5cd9596f4aafe940b8fc41ff89", "ja3_variant_count": 1, "ja3_variants": [ "4b7c9e5cd9596f4aafe940b8fc41ff89" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i040600_ed60d9558351_88dfcb89e28d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i040600", "b": "ed60d9558351", "c": "88dfcb89e28d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4868-4869-4867-4865,43-10-51-13-28-58,25-24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "curves": [ { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 103, "first_seen": 1787497665, "last_seen": 1791308095, "transport": "t", "ja3_hash": "d9bf2387fc9b4a3f9df93a296b365b60", "ja3_variant_count": 1, "ja3_variants": [ "d9bf2387fc9b4a3f9df93a296b365b60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i040900_16476d049b0b_78f1d400d464", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i040900", "b": "16476d049b0b", "c": "78f1d400d464", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788293169, "last_seen": 1790244141, "transport": "t", "ja3_hash": "ea217b0edcd93778471552ba0b796f81", "ja3_variant_count": 1, "ja3_variants": [ "ea217b0edcd93778471552ba0b796f81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i061000_da75d768228b_ab7e3b40a677", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i061000", "b": "da75d768228b", "c": "ab7e3b40a677", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 6, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49196-49200-49195-49199-4866-4865,11-65281-23-18-5-10-13-50-43-51,24-23-25-4588-4589-4587,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241272, "last_seen": 1790241272, "transport": "t", "ja3_hash": "f1c17379d74c47ae2b6617a80a3e205a", "ja3_variant_count": 1, "ja3_variants": [ "f1c17379d74c47ae2b6617a80a3e205a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i061000_da75d768228b_f50d94e863eb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i061000", "b": "da75d768228b", "c": "f50d94e863eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 6, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-4865-4866,11-65281-23-18-5-10-13-50-43-51,4588-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788907291, "last_seen": 1788907291, "transport": "t", "ja3_hash": "b4fb1b956ae2af8396e0787b58a35fdc", "ja3_variant_count": 1, "ja3_variants": [ "b4fb1b956ae2af8396e0787b58a35fdc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i070500_c2f3549b8eb7_5e8227e97453", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i070500", "b": "c2f3549b8eb7", "c": "5e8227e97453", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 7, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-13-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 9, "first_seen": 1790161531, "last_seen": 1790678617, "transport": "t", "ja3_hash": "8f950f06c4b112e92e53cea3c8731df9", "ja3_variant_count": 1, "ja3_variants": [ "8f950f06c4b112e92e53cea3c8731df9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i100900_61a7ad8aa9b6_0a2341ea6ed8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i100900", "b": "61a7ad8aa9b6", "c": "0a2341ea6ed8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-43-23-5-13-11-45-51-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788629397, "last_seen": 1788685614, "transport": "t", "ja3_hash": "bac9a31adf24d326224f73d5d9e5294f", "ja3_variant_count": 3, "ja3_variants": [ "bac9a31adf24d326224f73d5d9e5294f", "e75aa4ca740b3c8d6618197e7f332694", "1fb51071f4cc44db3af98f59b88d83fa" ], "user_agents": { "Mozilla/5.0 (compatible; ArgusScanner/0.1; +http://example/abuse)": 3 }, "ua_disagreement": false } }, { "hash": "t13i100900_61a7ad8aa9b6_36363f539193", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i100900", "b": "61a7ad8aa9b6", "c": "36363f539193", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-5-11-43-35-23-13-45-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 21, "first_seen": 1788629376, "last_seen": 1788685609, "transport": "t", "ja3_hash": "6bfba35f3e00524eab6e3f1cd352672d", "ja3_variant_count": 21, "ja3_variants": [ "6bfba35f3e00524eab6e3f1cd352672d", "7d96ff11c806a833a24218b3c03fb4bc", "55ac31f635517b509d31857e7a01b488", "21d0f752f6d538e67b4262c3d34836b4", "feaed223336489b7a730a8a45df15191", "6d13f5320f544bb9db165b11c2c2db3b", "f1e3298e4ad4366455fd56ed81dbffeb", "339b382146426496922404b1e008eea9", "8a54775b1be5df526176bec6a906fe9f", "51e4db5927a1d37cd267856def20f6e5", "fd626503ea5a5d78a01ff03fb0ba75f3", "053f6a2c6d496b654fb607da7d6a032b" ], "user_agents": { "Mozilla/5.0 (compatible; ArgusScanner/0.1; +http://example/abuse)": 21 }, "ua_disagreement": false } }, { "hash": "t13i100900_61a7ad8aa9b6_cb8fff09048f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i100900", "b": "61a7ad8aa9b6", "c": "cb8fff09048f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-35-45-43-11-13-23-10-5,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788792958, "last_seen": 1790292568, "transport": "t", "ja3_hash": "8c5c24dffd3f008618730f4ceac5a245", "ja3_variant_count": 8, "ja3_variants": [ "8c5c24dffd3f008618730f4ceac5a245", "0cfb752f2170450e826f929b18e7b09b", "24544fd2fc619c0b9455794ac5c7f1ad", "442470ce01e218f4ac1e9ae08cf0433f", "23a8eab24c3aa0d4192ac61a915cb183", "831acf3093c90da33dcde8a7863d8ea7", "0e830fbe30d26efe5271acd5347a5101", "bf5390248884b355591704f59438045e" ], "user_agents": { "Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)": 8 }, "ua_disagreement": false } }, { "hash": "t13i110400_47af8f603342_261fd6f5b3c3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i110400", "b": "47af8f603342", "c": "261fd6f5b3c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 11, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4867-4866-4865-52393-52392-49196-49195-49200-49199-157-156,43-10-51-13,23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 103, "first_seen": 1787497499, "last_seen": 1791307927, "transport": "t", "ja3_hash": "a4dafb4b9e44210d112ac4e7e695a007", "ja3_variant_count": 1, "ja3_variants": [ "a4dafb4b9e44210d112ac4e7e695a007" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i121000_a538d02d76d5_f6eeaf393d2e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i121000", "b": "a538d02d76d5", "c": "f6eeaf393d2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 12, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191-255,11-10-35-5-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790086868, "last_seen": 1790086908, "transport": "t", "ja3_hash": "64415168a62acdefdaa061ac3ae40abc", "ja3_variant_count": 1, "ja3_variants": [ "64415168a62acdefdaa061ac3ae40abc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i130500_f6a34bea2645_193c2c6852e3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i130500", "b": "f6a34bea2645", "c": "193c2c6852e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4869-4868-4865-4866-4867-49332-49333-199-198-49330-49328-49331-49329,11-43-10-13-51,23-24-25-29-256-41,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788748798, "last_seen": 1791319598, "transport": "t", "ja3_hash": "bf3372e1a919e16dea0c9fbd3e8e894a", "ja3_variant_count": 4, "ja3_variants": [ "bf3372e1a919e16dea0c9fbd3e8e894a", "1250ad853027dbb09f740be347daa56f", "7ce763df7955862f14bb8d5ba5c29e7c", "af75dc975811f91028a69a9bdae90b94" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i131200_f57a46bbacb6_1bd98dace775", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i131200", "b": "f57a46bbacb6", "c": "1bd98dace775", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 12, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-50-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790140885, "last_seen": 1791336041, "transport": "t", "ja3_hash": "21f6f572ee66e2f8dfd6bcfd23c697ba", "ja3_variant_count": 1, "ja3_variants": [ "21f6f572ee66e2f8dfd6bcfd23c697ba" ], "user_agents": { "CGrab/v8.24.1-dev-throughput": 4 }, "ua_disagreement": false } }, { "hash": "t13i131200_f57a46bbacb6_fb48f8b98a29", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "LeakIX l9scan \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131200", "b": "f57a46bbacb6", "c": "fb48f8b98a29", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 12, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-50-43-51-45,29-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789888739, "last_seen": 1791007627, "transport": "t", "ja3_hash": "1e4ab5fa7cf27b076ed20f64fc8fb1d9", "ja3_variant_count": 2, "ja3_variants": [ "1e4ab5fa7cf27b076ed20f64fc8fb1d9", "0d19b15a013ea9e1ae313614888f79f5" ], "user_agents": { "Mozilla/5.0 (l9scan/2.0.1353e25393e2937313e26363; +https://leakix.net)": 1 }, "ua_disagreement": false } }, { "hash": "t13i131300_f57a46bbacb6_3b244d8fbcc8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "LeakIX l9scan \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131300", "b": "f57a46bbacb6", "c": "3b244d8fbcc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 13, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-50-43-51-45-41,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1791007628, "last_seen": 1791007643, "transport": "t", "ja3_hash": "37b3769f942aae0789e38e380a532088", "ja3_variant_count": 1, "ja3_variants": [ "37b3769f942aae0789e38e380a532088" ], "user_agents": { "Mozilla/5.0 (l9scan/2.0.1353e25393e2937313e26363; +https://leakix.net)": 14 }, "ua_disagreement": false } }, { "hash": "t13i150300_8daaf6152771_b5ff496981bd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150300", "b": "8daaf6152771", "c": "b5ff496981bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788445539, "last_seen": 1788840272, "transport": "t", "ja3_hash": "46b89da47adc5b34ed99707f0f528a4a", "ja3_variant_count": 1, "ja3_variants": [ "46b89da47adc5b34ed99707f0f528a4a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_014dc203c7fa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "014dc203c7fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789701006, "last_seen": 1789701006, "transport": "t", "ja3_hash": "f213b6f26417cd09e767545d5deae78d", "ja3_variant_count": 1, "ja3_variants": [ "f213b6f26417cd09e767545d5deae78d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_024997845cf4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "024997845cf4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-43-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835359, "last_seen": 1788835359, "transport": "t", "ja3_hash": "89c0a2e3bd7cae00b0e5303f887bbf58", "ja3_variant_count": 1, "ja3_variants": [ "89c0a2e3bd7cae00b0e5303f887bbf58" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_05c53552625a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "05c53552625a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790933525, "last_seen": 1790933525, "transport": "t", "ja3_hash": "7aef2972b788c3209e8670c46bd75bd3", "ja3_variant_count": 1, "ja3_variants": [ "7aef2972b788c3209e8670c46bd75bd3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_0d7a0ba91c3d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "0d7a0ba91c3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791022073, "last_seen": 1791022073, "transport": "t", "ja3_hash": "cd4aa4d42c3f5e6a51b1b4d232445b09", "ja3_variant_count": 1, "ja3_variants": [ "cd4aa4d42c3f5e6a51b1b4d232445b09" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_0ec65e18cde9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "0ec65e18cde9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-23-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791121995, "last_seen": 1791121995, "transport": "t", "ja3_hash": "269ab4bb6fbea94f11c7a09ba3f376d2", "ja3_variant_count": 1, "ja3_variants": [ "269ab4bb6fbea94f11c7a09ba3f376d2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_1a3cd45dc4b9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "1a3cd45dc4b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-51-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788625004, "last_seen": 1788625004, "transport": "t", "ja3_hash": "1a1012159c5e3ec5dd0169049df2a2c7", "ja3_variant_count": 1, "ja3_variants": [ "1a1012159c5e3ec5dd0169049df2a2c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_2308128a4120", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "2308128a4120", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791254600, "last_seen": 1791254600, "transport": "t", "ja3_hash": "d6a83e314e7d4dcae43a996573851c57", "ja3_variant_count": 1, "ja3_variants": [ "d6a83e314e7d4dcae43a996573851c57" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_25d6209ebdaa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "25d6209ebdaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790637450, "last_seen": 1791102393, "transport": "t", "ja3_hash": "332cbe957aec9d56e43ded2698fcf0d6", "ja3_variant_count": 2, "ja3_variants": [ "332cbe957aec9d56e43ded2698fcf0d6", "508c38e976d48712eda923bd5e561240" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_2a5202253832", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "2a5202253832", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-65281-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790106274, "last_seen": 1790106274, "transport": "t", "ja3_hash": "0487e1e98e9cf02b4ff903a28e8ab306", "ja3_variant_count": 1, "ja3_variants": [ "0487e1e98e9cf02b4ff903a28e8ab306" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_2eaf8a81dea6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "2eaf8a81dea6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-43-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789415761, "last_seen": 1790658027, "transport": "t", "ja3_hash": "f600a9fc1fbc430ea2e8eaf443297dd9", "ja3_variant_count": 2, "ja3_variants": [ "f600a9fc1fbc430ea2e8eaf443297dd9", "fc05521b9bd46a96726a451e5a8682c5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_36e529f5ad51", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "36e529f5ad51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197012, "last_seen": 1790197012, "transport": "t", "ja3_hash": "afb57b9ab7b8f538d1ef288ae4c10fd6", "ja3_variant_count": 1, "ja3_variants": [ "afb57b9ab7b8f538d1ef288ae4c10fd6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_6f1c4c6ca70f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "6f1c4c6ca70f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790938610, "last_seen": 1790938610, "transport": "t", "ja3_hash": "c220d295e83e17c3c7d483707106f2a0", "ja3_variant_count": 1, "ja3_variants": [ "c220d295e83e17c3c7d483707106f2a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_7da48e0795c5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "7da48e0795c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790671910, "last_seen": 1791162605, "transport": "t", "ja3_hash": "0624cea045a402778d4b6feba0e86eb5", "ja3_variant_count": 2, "ja3_variants": [ "0624cea045a402778d4b6feba0e86eb5", "06c31098d7d6b868d6b56356c390e02d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_b3920c47a2b1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "b3920c47a2b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791219044, "last_seen": 1791219044, "transport": "t", "ja3_hash": "ec4a0c7675506c0815bd55e780248d76", "ja3_variant_count": 1, "ja3_variants": [ "ec4a0c7675506c0815bd55e780248d76" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_b40a7f959961", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "b40a7f959961", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-13-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790415330, "last_seen": 1790415330, "transport": "t", "ja3_hash": "1b0428f71d3337cb7dd124a20be4b185", "ja3_variant_count": 1, "ja3_variants": [ "1b0428f71d3337cb7dd124a20be4b185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_c0309c43b57f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "c0309c43b57f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789986365, "last_seen": 1789986365, "transport": "t", "ja3_hash": "ce81748ad5ab823e98c4d9a50ebbf8f8", "ja3_variant_count": 1, "ja3_variants": [ "ce81748ad5ab823e98c4d9a50ebbf8f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_c8eab2dea575", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "c8eab2dea575", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791240292, "last_seen": 1791240292, "transport": "t", "ja3_hash": "7ed533a72088eff967f8c98a9d05820d", "ja3_variant_count": 1, "ja3_variants": [ "7ed533a72088eff967f8c98a9d05820d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_db2558614640", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "db2558614640", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790668726, "last_seen": 1790668726, "transport": "t", "ja3_hash": "6da5b4bcee91df7158d57281b957dd4c", "ja3_variant_count": 1, "ja3_variants": [ "6da5b4bcee91df7158d57281b957dd4c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_e1b709569478", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "e1b709569478", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790191743, "last_seen": 1790191743, "transport": "t", "ja3_hash": "fe3af46e65a4006327366b1162d193c8", "ja3_variant_count": 1, "ja3_variants": [ "fe3af46e65a4006327366b1162d193c8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_f51a13063a32", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "f51a13063a32", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391191, "last_seen": 1789391191, "transport": "t", "ja3_hash": "d62fd7183d2a1adfe93bb83060621e26", "ja3_variant_count": 1, "ja3_variants": [ "d62fd7183d2a1adfe93bb83060621e26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_f878c62d7583", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "f878c62d7583", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-51-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790601303, "last_seen": 1790601303, "transport": "t", "ja3_hash": "1eb5767090c7f138be312bac8490bfec", "ja3_variant_count": 1, "ja3_variants": [ "1eb5767090c7f138be312bac8490bfec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150400_8daaf6152771_fd204c4683f1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150400", "b": "8daaf6152771", "c": "fd204c4683f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789630815, "last_seen": 1789630815, "transport": "t", "ja3_hash": "9a7ebbaa5677d5767e2c1752ab287d1e", "ja3_variant_count": 1, "ja3_variants": [ "9a7ebbaa5677d5767e2c1752ab287d1e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_07db77756d52", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "07db77756d52", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-51764-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790124043, "last_seen": 1790124043, "transport": "t", "ja3_hash": "16bbffb7b0cdd49043c9ece2d82c9581", "ja3_variant_count": 1, "ja3_variants": [ "16bbffb7b0cdd49043c9ece2d82c9581" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_087ee5c6a541", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "087ee5c6a541", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-51-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789617348, "last_seen": 1789617348, "transport": "t", "ja3_hash": "662a214601731887b462cbe64b38f5fc", "ja3_variant_count": 1, "ja3_variants": [ "662a214601731887b462cbe64b38f5fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_0bcbb4cedc8b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "0bcbb4cedc8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789358143, "last_seen": 1789358143, "transport": "t", "ja3_hash": "e93a48cc8351867a77a9654c6b1dea42", "ja3_variant_count": 1, "ja3_variants": [ "e93a48cc8351867a77a9654c6b1dea42" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_11c7d1e110bf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "11c7d1e110bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-51-43-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790795797, "last_seen": 1790795797, "transport": "t", "ja3_hash": "6d285bf3e21109fb6f111babe126e26e", "ja3_variant_count": 1, "ja3_variants": [ "6d285bf3e21109fb6f111babe126e26e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_2d63de5a1252", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "2d63de5a1252", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789430508, "last_seen": 1789430508, "transport": "t", "ja3_hash": "9f02fe81f414f7be891ef7f0e5b9268c", "ja3_variant_count": 1, "ja3_variants": [ "9f02fe81f414f7be891ef7f0e5b9268c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_3f0225afebbb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "3f0225afebbb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-51764-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788454346, "last_seen": 1788454346, "transport": "t", "ja3_hash": "0cf6898f3fd23459a7ab5c1cc4e35a7e", "ja3_variant_count": 1, "ja3_variants": [ "0cf6898f3fd23459a7ab5c1cc4e35a7e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_493abac06954", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "493abac06954", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-51764-43-11-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790712875, "last_seen": 1790712875, "transport": "t", "ja3_hash": "580fd5e3fca409b7258178a6fea81c18", "ja3_variant_count": 1, "ja3_variants": [ "580fd5e3fca409b7258178a6fea81c18" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_4db7928dd17c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "4db7928dd17c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-43-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790166898, "last_seen": 1790166898, "transport": "t", "ja3_hash": "1fb1e9b712ea549999f6f474c8f3ab0f", "ja3_variant_count": 1, "ja3_variants": [ "1fb1e9b712ea549999f6f474c8f3ab0f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_4ea34850e841", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "4ea34850e841", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789337946, "last_seen": 1789337946, "transport": "t", "ja3_hash": "bacdfce0afdabac83da79eaad289fcab", "ja3_variant_count": 1, "ja3_variants": [ "bacdfce0afdabac83da79eaad289fcab" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_5b3bb041e735", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "5b3bb041e735", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-51-11-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788491110, "last_seen": 1788491110, "transport": "t", "ja3_hash": "33bca447c6dee4191f64b87d551e4939", "ja3_variant_count": 1, "ja3_variants": [ "33bca447c6dee4191f64b87d551e4939" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_5ceb895e08fa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "5ceb895e08fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-27-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788777076, "last_seen": 1791133015, "transport": "t", "ja3_hash": "5675a2acd60f57fece6ada273c3b43f5", "ja3_variant_count": 2, "ja3_variants": [ "5675a2acd60f57fece6ada273c3b43f5", "b775702457dbb180ff6212d187c26001" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_6361f48d5a57", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "6361f48d5a57", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791275412, "last_seen": 1791275412, "transport": "t", "ja3_hash": "a7d503ffd79956f34f0236d4cbac5e3c", "ja3_variant_count": 1, "ja3_variants": [ "a7d503ffd79956f34f0236d4cbac5e3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_75f1a2f3e08a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "75f1a2f3e08a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-43-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789469864, "last_seen": 1789469864, "transport": "t", "ja3_hash": "123dc9de8023019d6aad8ba32949b7d0", "ja3_variant_count": 1, "ja3_variants": [ "123dc9de8023019d6aad8ba32949b7d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_83df51dd9243", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "83df51dd9243", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-65037-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789196274, "last_seen": 1789196274, "transport": "t", "ja3_hash": "487a029be4e4741054427db465937b9b", "ja3_variant_count": 1, "ja3_variants": [ "487a029be4e4741054427db465937b9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_84b0edecdd7e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "84b0edecdd7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-51-45-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790168401, "last_seen": 1790168401, "transport": "t", "ja3_hash": "e5c206c081c3e85d28fe85f6f2b1741d", "ja3_variant_count": 1, "ja3_variants": [ "e5c206c081c3e85d28fe85f6f2b1741d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_8b994fe5f44f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "8b994fe5f44f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-43-13-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789782408, "last_seen": 1789782408, "transport": "t", "ja3_hash": "adb7dcf0c095cdad9c34791b6af8f924", "ja3_variant_count": 1, "ja3_variants": [ "adb7dcf0c095cdad9c34791b6af8f924" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_a8801ff68059", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "a8801ff68059", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-27-18-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789654451, "last_seen": 1789654451, "transport": "t", "ja3_hash": "b7c03eaf0405d175d957fc8c099bdc91", "ja3_variant_count": 1, "ja3_variants": [ "b7c03eaf0405d175d957fc8c099bdc91" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_aafbf7ad16b0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "aafbf7ad16b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789755507, "last_seen": 1790992040, "transport": "t", "ja3_hash": "0ccd0c1401841257b6719d506190c90e", "ja3_variant_count": 1, "ja3_variants": [ "0ccd0c1401841257b6719d506190c90e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13i150500_8daaf6152771_b596d8e943b0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "b596d8e943b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790921036, "last_seen": 1790921036, "transport": "t", "ja3_hash": "2c4264632f5bac753ff564cac8bbbc6b", "ja3_variant_count": 1, "ja3_variants": [ "2c4264632f5bac753ff564cac8bbbc6b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_bc4177bf7ae3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "bc4177bf7ae3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-43-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791170749, "last_seen": 1791170749, "transport": "t", "ja3_hash": "bf7fbc6dcb2fc66d78a2defb3c598946", "ja3_variant_count": 1, "ja3_variants": [ "bf7fbc6dcb2fc66d78a2defb3c598946" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_da47d95e1357", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "da47d95e1357", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-43-35-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790595262, "last_seen": 1790595262, "transport": "t", "ja3_hash": "052a2fa185cd5b5e4cf5167703a1aca6", "ja3_variant_count": 1, "ja3_variants": [ "052a2fa185cd5b5e4cf5167703a1aca6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_f24691b6ef3b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "f24691b6ef3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-5-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788496640, "last_seen": 1788496640, "transport": "t", "ja3_hash": "dbe459b96481688b695b065cea8bb7b4", "ja3_variant_count": 1, "ja3_variants": [ "dbe459b96481688b695b065cea8bb7b4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_f8ba1e92960a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "f8ba1e92960a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-35-51-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197012, "last_seen": 1790197012, "transport": "t", "ja3_hash": "df5f9d3ed44d429f013dd4e317ac81ef", "ja3_variant_count": 1, "ja3_variants": [ "df5f9d3ed44d429f013dd4e317ac81ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150500_8daaf6152771_fdf18d12642f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150500", "b": "8daaf6152771", "c": "fdf18d12642f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-65281-23-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791036336, "last_seen": 1791036336, "transport": "t", "ja3_hash": "ace8742c437d53136c236f5c6b8ae594", "ja3_variant_count": 1, "ja3_variants": [ "ace8742c437d53136c236f5c6b8ae594" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_043a820edb3b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "043a820edb3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-35-51-13-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790320649, "last_seen": 1790320649, "transport": "t", "ja3_hash": "074f6ee3a3dd5d614542ab9e041e0845", "ja3_variant_count": 1, "ja3_variants": [ "074f6ee3a3dd5d614542ab9e041e0845" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_24541ac07e51", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "24541ac07e51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-43-51-5-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789963688, "last_seen": 1789963688, "transport": "t", "ja3_hash": "b8da25f9f71a4125c6c1f3baad0407a6", "ja3_variant_count": 1, "ja3_variants": [ "b8da25f9f71a4125c6c1f3baad0407a6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_34c9eef7dff7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "34c9eef7dff7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-65281-45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790938611, "last_seen": 1790938611, "transport": "t", "ja3_hash": "7ede7cd80095f7bd407f939d5292cbec", "ja3_variant_count": 1, "ja3_variants": [ "7ede7cd80095f7bd407f939d5292cbec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_36c35cf7658c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "36c35cf7658c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-65037-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790795415, "last_seen": 1790795415, "transport": "t", "ja3_hash": "c5ece6615e65c727aea5e630c19824c0", "ja3_variant_count": 1, "ja3_variants": [ "c5ece6615e65c727aea5e630c19824c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_3f80140062d4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "3f80140062d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-27-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790029172, "last_seen": 1790029172, "transport": "t", "ja3_hash": "6bb39e3b583cb18b857337c562272463", "ja3_variant_count": 1, "ja3_variants": [ "6bb39e3b583cb18b857337c562272463" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_41a121920b5f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "41a121920b5f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-43-10-45-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790337425, "last_seen": 1790337425, "transport": "t", "ja3_hash": "48d0a0b1739e581c3730d2a1fb844c86", "ja3_variant_count": 1, "ja3_variants": [ "48d0a0b1739e581c3730d2a1fb844c86" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_46ea37f15e62", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "46ea37f15e62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-35-23-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790273613, "last_seen": 1790273613, "transport": "t", "ja3_hash": "be7fae59f0245f09a573923454500a4c", "ja3_variant_count": 1, "ja3_variants": [ "be7fae59f0245f09a573923454500a4c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_4d77e7ee1b71", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "4d77e7ee1b71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-45-43-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790083647, "last_seen": 1790083647, "transport": "t", "ja3_hash": "10a1d42942c3cf04edc5761b01883c4e", "ja3_variant_count": 1, "ja3_variants": [ "10a1d42942c3cf04edc5761b01883c4e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_55aab35ffaad", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "55aab35ffaad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-35-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790151247, "last_seen": 1790151247, "transport": "t", "ja3_hash": "727be471a46e8235ffc917aa18c6bbc1", "ja3_variant_count": 1, "ja3_variants": [ "727be471a46e8235ffc917aa18c6bbc1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_57e8aa8bf351", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "57e8aa8bf351", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-45-43-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789295548, "last_seen": 1789295548, "transport": "t", "ja3_hash": "9f67ee4e01b019dc15771780ebeab1e3", "ja3_variant_count": 1, "ja3_variants": [ "9f67ee4e01b019dc15771780ebeab1e3" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ShapBot/0.1.0": 7 }, "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_6916397c86d3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "6916397c86d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-65037-23-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788825891, "last_seen": 1788825891, "transport": "t", "ja3_hash": "ec32b4f9bb5a1d2ff609d3249370bbe4", "ja3_variant_count": 1, "ja3_variants": [ "ec32b4f9bb5a1d2ff609d3249370bbe4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_737ce93212c9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "737ce93212c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-10-45-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789665110, "last_seen": 1789665110, "transport": "t", "ja3_hash": "c29eee5aa63c5561d9c7d9c456eff4e1", "ja3_variant_count": 1, "ja3_variants": [ "c29eee5aa63c5561d9c7d9c456eff4e1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_8b513a83238d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "8b513a83238d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-17613-43-13-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789870122, "last_seen": 1789870122, "transport": "t", "ja3_hash": "ad9bcb725f144169109a003441ef79b4", "ja3_variant_count": 1, "ja3_variants": [ "ad9bcb725f144169109a003441ef79b4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_905e6ab3b110", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "905e6ab3b110", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-23-65281-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791179602, "last_seen": 1791179602, "transport": "t", "ja3_hash": "6fe881458ceb7a9eda54fe86ef714e98", "ja3_variant_count": 1, "ja3_variants": [ "6fe881458ceb7a9eda54fe86ef714e98" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_9957b7474265", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "9957b7474265", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-43-13-17613-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790307910, "last_seen": 1790307910, "transport": "t", "ja3_hash": "5b129bdae473e52b804d029c31c7e276", "ja3_variant_count": 1, "ja3_variants": [ "5b129bdae473e52b804d029c31c7e276" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_9b529e1c8c13", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "9b529e1c8c13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-27-17613-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789722657, "last_seen": 1791306516, "transport": "t", "ja3_hash": "fd4d89080b7a687ae0b071b943891eb3", "ja3_variant_count": 2, "ja3_variants": [ "fd4d89080b7a687ae0b071b943891eb3", "8c8e53baa0e9ebf849207cf8ffed4807" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_b00af32ff59a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "b00af32ff59a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-45-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790955768, "last_seen": 1790955768, "transport": "t", "ja3_hash": "22e2f7329417949a88b841a584bcd884", "ja3_variant_count": 1, "ja3_variants": [ "22e2f7329417949a88b841a584bcd884" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_eb1becb3acb5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "eb1becb3acb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-51-35-23-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789397392, "last_seen": 1789397392, "transport": "t", "ja3_hash": "8be6e5cd385df6db7b0a0e8bd71ebd79", "ja3_variant_count": 1, "ja3_variants": [ "8be6e5cd385df6db7b0a0e8bd71ebd79" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150600_8daaf6152771_ee2cc75a54c5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "ee2cc75a54c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-11-51-35-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788518217, "last_seen": 1788518217, "transport": "t", "ja3_hash": "861951bf99911c6abad09b919a7d12dd", "ja3_variant_count": 1, "ja3_variants": [ "861951bf99911c6abad09b919a7d12dd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_0262c0c5ad5e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "0262c0c5ad5e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-27-23-35-43-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790639869, "last_seen": 1790639869, "transport": "t", "ja3_hash": "fba31f809c80564b218a895f654853da", "ja3_variant_count": 1, "ja3_variants": [ "fba31f809c80564b218a895f654853da" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_06b13bfc6cdb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "06b13bfc6cdb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-18-17613-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790898791, "last_seen": 1790898791, "transport": "t", "ja3_hash": "d1fa7ece94edd33db0de9f0ef9634552", "ja3_variant_count": 1, "ja3_variants": [ "d1fa7ece94edd33db0de9f0ef9634552" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_0b916f8ced88", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "0b916f8ced88", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-10-65037-43-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788860638, "last_seen": 1788860638, "transport": "t", "ja3_hash": "bc7e61ba62df20dd94727586e81908b9", "ja3_variant_count": 1, "ja3_variants": [ "bc7e61ba62df20dd94727586e81908b9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_0d404127c680", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "0d404127c680", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-51-18-10-43-5,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015031, "last_seen": 1789015031, "transport": "t", "ja3_hash": "a2687bca3ea222b973d7e9d6574d1287", "ja3_variant_count": 1, "ja3_variants": [ "a2687bca3ea222b973d7e9d6574d1287" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_0eed6f2759ea", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "0eed6f2759ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-18-10-23-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789820707, "last_seen": 1789820707, "transport": "t", "ja3_hash": "047e816e7e516d32aca9c39d7cc4de05", "ja3_variant_count": 1, "ja3_variants": [ "047e816e7e516d32aca9c39d7cc4de05" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_234489673f32", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "234489673f32", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-27-45-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790771085, "last_seen": 1790771085, "transport": "t", "ja3_hash": "1441c2bf702a48e52af3db0a8e32c2bf", "ja3_variant_count": 1, "ja3_variants": [ "1441c2bf702a48e52af3db0a8e32c2bf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_262678d82b73", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "262678d82b73", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-43-45-23-5-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788561630, "last_seen": 1788561630, "transport": "t", "ja3_hash": "99855aface215af3dd9b333bc328fd60", "ja3_variant_count": 1, "ja3_variants": [ "99855aface215af3dd9b333bc328fd60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_2a352171d20e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "2a352171d20e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-65281-5-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790222322, "last_seen": 1790222322, "transport": "t", "ja3_hash": "dc55ff55bf10b5faeadbe8dffc450f5d", "ja3_variant_count": 1, "ja3_variants": [ "dc55ff55bf10b5faeadbe8dffc450f5d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_2ae958816c33", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "2ae958816c33", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-43-35-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790488639, "last_seen": 1790488639, "transport": "t", "ja3_hash": "072699d6d30f7f40ca078be56aaad4e8", "ja3_variant_count": 1, "ja3_variants": [ "072699d6d30f7f40ca078be56aaad4e8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_2ed28826118d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "2ed28826118d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-43-13-23-11-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790764067, "last_seen": 1790764067, "transport": "t", "ja3_hash": "f2ce6faae975cddc4807c412050c1d50", "ja3_variant_count": 1, "ja3_variants": [ "f2ce6faae975cddc4807c412050c1d50" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_44cbd6f69c05", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "44cbd6f69c05", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-5-11-51-43-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789791004, "last_seen": 1789791004, "transport": "t", "ja3_hash": "646ad90abeff11a2407e85103851cceb", "ja3_variant_count": 1, "ja3_variants": [ "646ad90abeff11a2407e85103851cceb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_6846728c3df7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "6846728c3df7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-13-27-45-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790694081, "last_seen": 1790694081, "transport": "t", "ja3_hash": "e84c6fdeba089d8f1552086b12677360", "ja3_variant_count": 1, "ja3_variants": [ "e84c6fdeba089d8f1552086b12677360" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_694e66345e58", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "694e66345e58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-17613-18-51-35-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788892605, "last_seen": 1788892605, "transport": "t", "ja3_hash": "7bcfec5267d54be7394202c3b26126d7", "ja3_variant_count": 1, "ja3_variants": [ "7bcfec5267d54be7394202c3b26126d7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_6aae1d992576", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "6aae1d992576", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-43-27-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790596043, "last_seen": 1790596043, "transport": "t", "ja3_hash": "55210bed30e03aa223f276ccbd125c3a", "ja3_variant_count": 1, "ja3_variants": [ "55210bed30e03aa223f276ccbd125c3a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_70b494b5d65d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "70b494b5d65d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-18-35-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790869317, "last_seen": 1790869317, "transport": "t", "ja3_hash": "86dd773fde9874dcdd97be6fbd46cdaf", "ja3_variant_count": 1, "ja3_variants": [ "86dd773fde9874dcdd97be6fbd46cdaf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_7470d0901b0f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "7470d0901b0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-65037-45-5-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790881633, "last_seen": 1790881633, "transport": "t", "ja3_hash": "bd3f67592d36062f994fa3a102b82721", "ja3_variant_count": 1, "ja3_variants": [ "bd3f67592d36062f994fa3a102b82721" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_779161a656ef", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "779161a656ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-13-43-51-10-23,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790104332, "last_seen": 1790104332, "transport": "t", "ja3_hash": "6a585befafeec8d17c038fcbebe88770", "ja3_variant_count": 1, "ja3_variants": [ "6a585befafeec8d17c038fcbebe88770" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_7d28713295e1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "7d28713295e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-65281-43-45-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790596081, "last_seen": 1790596081, "transport": "t", "ja3_hash": "8e01b40c9beecad11c16e2a5fc75016a", "ja3_variant_count": 1, "ja3_variants": [ "8e01b40c9beecad11c16e2a5fc75016a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_7effca3b3b78", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "7effca3b3b78", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-35-43-51-18-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790568601, "last_seen": 1790568601, "transport": "t", "ja3_hash": "44308129a4f1c65c8fea2efbc9ef9b37", "ja3_variant_count": 1, "ja3_variants": [ "44308129a4f1c65c8fea2efbc9ef9b37" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_7fb00560537a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "7fb00560537a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-51-35-11-43-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789669041, "last_seen": 1789669041, "transport": "t", "ja3_hash": "092fd43ce7b94d3d5334ba1ee3caca84", "ja3_variant_count": 1, "ja3_variants": [ "092fd43ce7b94d3d5334ba1ee3caca84" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_80eb671c450b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "80eb671c450b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-23-17613-13-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790247053, "last_seen": 1790247053, "transport": "t", "ja3_hash": "1072af511ce22122c085414a0ed6de79", "ja3_variant_count": 1, "ja3_variants": [ "1072af511ce22122c085414a0ed6de79" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_8656b4e24da7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "8656b4e24da7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-43-17613-27-51-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791213933, "last_seen": 1791213933, "transport": "t", "ja3_hash": "031976a37e65665414357e3bdc2699d0", "ja3_variant_count": 1, "ja3_variants": [ "031976a37e65665414357e3bdc2699d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_87b5066ea99a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "87b5066ea99a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-23-13-27-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791209796, "last_seen": 1791209796, "transport": "t", "ja3_hash": "ab2aa3252afb2dfd4f99cd8caf933ff5", "ja3_variant_count": 1, "ja3_variants": [ "ab2aa3252afb2dfd4f99cd8caf933ff5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_88baca3ff536", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "88baca3ff536", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-18-65037-27-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790935629, "last_seen": 1790935629, "transport": "t", "ja3_hash": "d6bcc926a8481dd31519f1501417ea11", "ja3_variant_count": 1, "ja3_variants": [ "d6bcc926a8481dd31519f1501417ea11" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_89d5919d6629", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "89d5919d6629", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-45-23-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790662723, "last_seen": 1790662723, "transport": "t", "ja3_hash": "559b9628c4765658fa65974aa898a0e8", "ja3_variant_count": 1, "ja3_variants": [ "559b9628c4765658fa65974aa898a0e8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_8a767adb52fa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "8a767adb52fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-18-17613-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790512871, "last_seen": 1790512871, "transport": "t", "ja3_hash": "271f16de2b5d82f3691d2161aaee1bcb", "ja3_variant_count": 1, "ja3_variants": [ "271f16de2b5d82f3691d2161aaee1bcb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_95dc312d0dd2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "95dc312d0dd2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-11-13-43-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790256594, "last_seen": 1790256594, "transport": "t", "ja3_hash": "b48baa4048d8ce5e66f911781711c7b7", "ja3_variant_count": 1, "ja3_variants": [ "b48baa4048d8ce5e66f911781711c7b7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_98fb85831a37", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "98fb85831a37", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-27-11-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790847795, "last_seen": 1790847795, "transport": "t", "ja3_hash": "9731d48d3c6284ac52a48161f6ca8579", "ja3_variant_count": 1, "ja3_variants": [ "9731d48d3c6284ac52a48161f6ca8579" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_9e5067994b74", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "9e5067994b74", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-43-35-45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791006659, "last_seen": 1791006659, "transport": "t", "ja3_hash": "1e27a9ae1d5ada44fd7e0e09ac38b6df", "ja3_variant_count": 1, "ja3_variants": [ "1e27a9ae1d5ada44fd7e0e09ac38b6df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_a569be63c334", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "a569be63c334", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-45-43-51764-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789579328, "last_seen": 1789579328, "transport": "t", "ja3_hash": "676c7cdc36f9b92d56bc4f20e7707014", "ja3_variant_count": 1, "ja3_variants": [ "676c7cdc36f9b92d56bc4f20e7707014" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_a688226f7e2e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "a688226f7e2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-35-43-13-51-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788810229, "last_seen": 1788810229, "transport": "t", "ja3_hash": "e696fcc57cfdcff184c50caadc42637a", "ja3_variant_count": 1, "ja3_variants": [ "e696fcc57cfdcff184c50caadc42637a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_ab63a922c650", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "ab63a922c650", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-43-35-65281-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015034, "last_seen": 1789015034, "transport": "t", "ja3_hash": "c8c7ff1b9b22a0deffa2f4c8f89eb986", "ja3_variant_count": 1, "ja3_variants": [ "c8c7ff1b9b22a0deffa2f4c8f89eb986" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_c5da962d42eb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "c5da962d42eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-43-5-27-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241857, "last_seen": 1790241857, "transport": "t", "ja3_hash": "36d7c36bfd4447a714696bfa3082a0ba", "ja3_variant_count": 1, "ja3_variants": [ "36d7c36bfd4447a714696bfa3082a0ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_cb22e3f99591", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "cb22e3f99591", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-18-13-51-10-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789515486, "last_seen": 1789515486, "transport": "t", "ja3_hash": "71e76de1d8806a4c1ba64bd905764c40", "ja3_variant_count": 1, "ja3_variants": [ "71e76de1d8806a4c1ba64bd905764c40" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_d3f8b8fba7b4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "d3f8b8fba7b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-11-35-65281-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790332853, "last_seen": 1790332853, "transport": "t", "ja3_hash": "9b226b2a83d87c45bda43e412a825b15", "ja3_variant_count": 1, "ja3_variants": [ "9b226b2a83d87c45bda43e412a825b15" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_d43f7186c19f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "d43f7186c19f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-23-13-27-51-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791204290, "last_seen": 1791204290, "transport": "t", "ja3_hash": "69acb29f19c968f14db390169192b6b5", "ja3_variant_count": 1, "ja3_variants": [ "69acb29f19c968f14db390169192b6b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_eea137bc5cb3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "eea137bc5cb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-45-35-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789662338, "last_seen": 1789662338, "transport": "t", "ja3_hash": "7cd028d9dca18da36cfaa256909096ea", "ja3_variant_count": 1, "ja3_variants": [ "7cd028d9dca18da36cfaa256909096ea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_f67b95e75049", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "f67b95e75049", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-65037-51764-13-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789493814, "last_seen": 1789493814, "transport": "t", "ja3_hash": "446ca114bd620213e8e9da792cff7f00", "ja3_variant_count": 1, "ja3_variants": [ "446ca114bd620213e8e9da792cff7f00" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150700_8daaf6152771_ff8b92ca574d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "ff8b92ca574d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-10-43-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789116945, "last_seen": 1789116945, "transport": "t", "ja3_hash": "98007378db8f7733798426757300614f", "ja3_variant_count": 1, "ja3_variants": [ "98007378db8f7733798426757300614f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_d3ee6f2dee84", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "d3ee6f2dee84", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-23-27-43-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790307254, "last_seen": 1790307254, "transport": "t", "ja3_hash": "71e8a1f83ab98a26f526e8d0a7fc426c", "ja3_variant_count": 1, "ja3_variants": [ "71e8a1f83ab98a26f526e8d0a7fc426c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_04a779117e0f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "04a779117e0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-13-43-10-27-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790921037, "last_seen": 1790921037, "transport": "t", "ja3_hash": "15f661d992a4ccabde63fc63edbc7ed5", "ja3_variant_count": 1, "ja3_variants": [ "15f661d992a4ccabde63fc63edbc7ed5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_09263d707cc2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "09263d707cc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-43-65281-11-35-45-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790545263, "last_seen": 1790545263, "transport": "t", "ja3_hash": "45e7e7b142f269c95afd51b63d3f1736", "ja3_variant_count": 1, "ja3_variants": [ "45e7e7b142f269c95afd51b63d3f1736" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_13a1f6b27a4d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "13a1f6b27a4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-27-13-5-43-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789444994, "last_seen": 1789444994, "transport": "t", "ja3_hash": "54710e5b954570663dfcf8b238c469a4", "ja3_variant_count": 1, "ja3_variants": [ "54710e5b954570663dfcf8b238c469a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_177b6afa48b5", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "177b6afa48b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-23-11-17613-27-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788552951, "last_seen": 1788552951, "transport": "t", "ja3_hash": "824b7a06ff472f9adfdc67012c8aaaf2", "ja3_variant_count": 1, "ja3_variants": [ "824b7a06ff472f9adfdc67012c8aaaf2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_28b602174068", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "28b602174068", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-18-65037-23-5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790595124, "last_seen": 1790595124, "transport": "t", "ja3_hash": "6e59b1fce95faf28bd162c5c23f6cbf0", "ja3_variant_count": 1, "ja3_variants": [ "6e59b1fce95faf28bd162c5c23f6cbf0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_2bacb20dfd6c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "2bacb20dfd6c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-11-17613-27-65037-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789455638, "last_seen": 1789455638, "transport": "t", "ja3_hash": "3935c58f63f97f80348731a90509104d", "ja3_variant_count": 1, "ja3_variants": [ "3935c58f63f97f80348731a90509104d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_3d4cad2d0b53", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "3d4cad2d0b53", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-13-10-23-43-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790002701, "last_seen": 1790002701, "transport": "t", "ja3_hash": "d5757fdee47b0099a4f3a7e13aaacf05", "ja3_variant_count": 1, "ja3_variants": [ "d5757fdee47b0099a4f3a7e13aaacf05" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_3e4234dcb35e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "3e4234dcb35e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-10-51-27-11-17613-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790207554, "last_seen": 1790207554, "transport": "t", "ja3_hash": "ff49d379a8889088c49837bb4bfa18e7", "ja3_variant_count": 1, "ja3_variants": [ "ff49d379a8889088c49837bb4bfa18e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_3eea55639866", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "3eea55639866", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-5-18-11-65037-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790219980, "last_seen": 1790219980, "transport": "t", "ja3_hash": "b488525592f214202d7af37a270bd6fc", "ja3_variant_count": 1, "ja3_variants": [ "b488525592f214202d7af37a270bd6fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_422b97e45862", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "422b97e45862", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-43-18-35-51-23-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790525756, "last_seen": 1790525756, "transport": "t", "ja3_hash": "ce8185c2f5d0fb061c15b200464f5dcd", "ja3_variant_count": 1, "ja3_variants": [ "ce8185c2f5d0fb061c15b200464f5dcd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_43d4d4b42f45", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "43d4d4b42f45", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-27-65037-17613-13-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469866, "last_seen": 1789469866, "transport": "t", "ja3_hash": "97852bc566a6a52c149dc78ff4e29a2e", "ja3_variant_count": 1, "ja3_variants": [ "97852bc566a6a52c149dc78ff4e29a2e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_4dae84085463", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "4dae84085463", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-65281-17613-23-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790717374, "last_seen": 1790717374, "transport": "t", "ja3_hash": "406f12a715e29c448e2a899857b7d2d3", "ja3_variant_count": 1, "ja3_variants": [ "406f12a715e29c448e2a899857b7d2d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_507f3bd29586", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "507f3bd29586", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-45-17613-13-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789909635, "last_seen": 1789909635, "transport": "t", "ja3_hash": "45f9fe8c03c3dccbf3d466232545fb8b", "ja3_variant_count": 1, "ja3_variants": [ "45f9fe8c03c3dccbf3d466232545fb8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_560390466015", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "560390466015", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-43-11-23-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790754174, "last_seen": 1790754174, "transport": "t", "ja3_hash": "88cfba06a8364165ea54b7fc87100d61", "ja3_variant_count": 1, "ja3_variants": [ "88cfba06a8364165ea54b7fc87100d61" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_6745f3898eba", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "6745f3898eba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-5-43-65281-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789658274, "last_seen": 1789658274, "transport": "t", "ja3_hash": "95faebf4f627c023ccc88a03b3e9b205", "ja3_variant_count": 1, "ja3_variants": [ "95faebf4f627c023ccc88a03b3e9b205" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_73b6bb3f1029", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "73b6bb3f1029", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-13-43-65037-65281-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790220359, "last_seen": 1790220359, "transport": "t", "ja3_hash": "fde98b3ada6deb6234a77fd41db6369b", "ja3_variant_count": 1, "ja3_variants": [ "fde98b3ada6deb6234a77fd41db6369b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_77354a034493", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "77354a034493", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-43-45-5-10-11-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790516971, "last_seen": 1790516971, "transport": "t", "ja3_hash": "3168e08d8ae42529c9ea7a28528684f4", "ja3_variant_count": 1, "ja3_variants": [ "3168e08d8ae42529c9ea7a28528684f4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_90d63aae0061", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "90d63aae0061", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-35-23-51764-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790079373, "last_seen": 1790079373, "transport": "t", "ja3_hash": "bc4a5bcb8a565f445f33e7c577b600cf", "ja3_variant_count": 1, "ja3_variants": [ "bc4a5bcb8a565f445f33e7c577b600cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_99cfb8b2b143", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "99cfb8b2b143", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-51764-65281-43-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791283427, "last_seen": 1791283427, "transport": "t", "ja3_hash": "5f9fc51846d5d60b06e3a7c92aa4c2d7", "ja3_variant_count": 1, "ja3_variants": [ "5f9fc51846d5d60b06e3a7c92aa4c2d7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_99d1702dd309", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "99d1702dd309", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-65281-17613-27-13-51-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790191739, "last_seen": 1790191739, "transport": "t", "ja3_hash": "e21fd744341ff0d270e7ca8d6e03d8b7", "ja3_variant_count": 1, "ja3_variants": [ "e21fd744341ff0d270e7ca8d6e03d8b7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_9bb19948da95", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "9bb19948da95", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-65037-65281-45-18-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790360805, "last_seen": 1790360805, "transport": "t", "ja3_hash": "29b6e0aeaee66213de565e63b2c32df9", "ja3_variant_count": 1, "ja3_variants": [ "29b6e0aeaee66213de565e63b2c32df9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_9e9afe1e0204", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "9e9afe1e0204", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-18-13-43-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197013, "last_seen": 1790197013, "transport": "t", "ja3_hash": "becc3a36e6da118131ffac255635eea6", "ja3_variant_count": 1, "ja3_variants": [ "becc3a36e6da118131ffac255635eea6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_b4c25dbffb3c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "b4c25dbffb3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-5-65281-18-35-10-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789770096, "last_seen": 1789770096, "transport": "t", "ja3_hash": "5b4953ed85c99366175805eb2b4fa810", "ja3_variant_count": 1, "ja3_variants": [ "5b4953ed85c99366175805eb2b4fa810" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_b5852e3b4cbd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "b5852e3b4cbd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-13-45-43-51-17613-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791198073, "last_seen": 1791198073, "transport": "t", "ja3_hash": "640b9cc42cfb1b93ad27d9ee9dabfeab", "ja3_variant_count": 1, "ja3_variants": [ "640b9cc42cfb1b93ad27d9ee9dabfeab" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_c4f1c0d75a22", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "c4f1c0d75a22", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-10-18-11-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791123134, "last_seen": 1791123134, "transport": "t", "ja3_hash": "cfddc93a5a056173d548cece5de629b7", "ja3_variant_count": 1, "ja3_variants": [ "cfddc93a5a056173d548cece5de629b7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_c78cc01db1ce", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "c78cc01db1ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-23-18-43-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788871681, "last_seen": 1788871681, "transport": "t", "ja3_hash": "b9add12e1afcb3cd708d5ef0c6e949eb", "ja3_variant_count": 1, "ja3_variants": [ "b9add12e1afcb3cd708d5ef0c6e949eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_c82448295f52", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "c82448295f52", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-18-23-13-43-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790224568, "last_seen": 1790224568, "transport": "t", "ja3_hash": "4345dc6fd8e6de7f36762a2045508c82", "ja3_variant_count": 1, "ja3_variants": [ "4345dc6fd8e6de7f36762a2045508c82" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_cca35195692c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "cca35195692c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-43-11-27-35-23-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689002, "last_seen": 1789689002, "transport": "t", "ja3_hash": "643fbc630070120ab0acf1530cf4a138", "ja3_variant_count": 1, "ja3_variants": [ "643fbc630070120ab0acf1530cf4a138" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_cce8139278ce", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "cce8139278ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-43-45-51764-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790628389, "last_seen": 1790628389, "transport": "t", "ja3_hash": "538050fcb9a4ce0ed645d937686c3124", "ja3_variant_count": 1, "ja3_variants": [ "538050fcb9a4ce0ed645d937686c3124" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_f786dc852690", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "f786dc852690", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-11-45-43-18-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949206, "last_seen": 1789949206, "transport": "t", "ja3_hash": "f98c38c2f195fa36a7a9a95bb11bdbf6", "ja3_variant_count": 1, "ja3_variants": [ "f98c38c2f195fa36a7a9a95bb11bdbf6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150800_8daaf6152771_f9d859529e45", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150800", "b": "8daaf6152771", "c": "f9d859529e45", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-23-18-45-27-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789673876, "last_seen": 1789673876, "transport": "t", "ja3_hash": "7da89be6ca7c2595f438803c92444a29", "ja3_variant_count": 1, "ja3_variants": [ "7da89be6ca7c2595f438803c92444a29" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_9f9fd1960efc", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "9f9fd1960efc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-35-16-43-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790140230, "last_seen": 1790140230, "transport": "t", "ja3_hash": "367d23607a0f3bb672b7a40b9d7e9d63", "ja3_variant_count": 1, "ja3_variants": [ "367d23607a0f3bb672b7a40b9d7e9d63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_095b7077c040", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "095b7077c040", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65281-11-27-65037-17613-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788858753, "last_seen": 1788858753, "transport": "t", "ja3_hash": "4974b180859d4d65fed9717ee85c90c0", "ja3_variant_count": 1, "ja3_variants": [ "4974b180859d4d65fed9717ee85c90c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_0d5b046a4baf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "0d5b046a4baf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-51764-5-35-27-65037-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197011, "last_seen": 1790197011, "transport": "t", "ja3_hash": "b64947e3a290e7e232f4cfc04e811ee8", "ja3_variant_count": 1, "ja3_variants": [ "b64947e3a290e7e232f4cfc04e811ee8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_2bef1ac9a94b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "2bef1ac9a94b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-43-35-5-13-45-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789214137, "last_seen": 1789214137, "transport": "t", "ja3_hash": "f4cf1212f960ac982b5ac9072a93b689", "ja3_variant_count": 1, "ja3_variants": [ "f4cf1212f960ac982b5ac9072a93b689" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_3d5f90a9f016", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "3d5f90a9f016", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-35-51-18-11-43-45-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789979302, "last_seen": 1789979302, "transport": "t", "ja3_hash": "9e3965ac66c45bd640640c11840e0322", "ja3_variant_count": 1, "ja3_variants": [ "9e3965ac66c45bd640640c11840e0322" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_4121bacae397", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "4121bacae397", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-27-10-11-13-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790055348, "last_seen": 1790055348, "transport": "t", "ja3_hash": "c2046c58289101c46de8084c47aa6512", "ja3_variant_count": 1, "ja3_variants": [ "c2046c58289101c46de8084c47aa6512" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_47bbbe33d51d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "47bbbe33d51d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-13-43-10-45-17613-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788825890, "last_seen": 1788825890, "transport": "t", "ja3_hash": "f7acd63c460a7312ad2d3d5c9e578b45", "ja3_variant_count": 1, "ja3_variants": [ "f7acd63c460a7312ad2d3d5c9e578b45" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_4d5f9a936b5b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "4d5f9a936b5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-45-10-18-5-65281-51-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789398564, "last_seen": 1789398564, "transport": "t", "ja3_hash": "35a703025486f03702f7263a6c93938a", "ja3_variant_count": 1, "ja3_variants": [ "35a703025486f03702f7263a6c93938a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_4f88bd8d0072", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "4f88bd8d0072", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-43-45-51-18-23-10-17613,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789358136, "last_seen": 1789358136, "transport": "t", "ja3_hash": "a3655de9493f62be05b7b27de68c5383", "ja3_variant_count": 1, "ja3_variants": [ "a3655de9493f62be05b7b27de68c5383" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_5289a9c24e92", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "5289a9c24e92", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65037-35-13-18-45-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789544580, "last_seen": 1789544580, "transport": "t", "ja3_hash": "30ca97c9d9e12f811624fba8770b71a5", "ja3_variant_count": 1, "ja3_variants": [ "30ca97c9d9e12f811624fba8770b71a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_5de15e908253", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "5de15e908253", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-23-65281-45-18-17613-43-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791180408, "last_seen": 1791180408, "transport": "t", "ja3_hash": "7551ed40ef28b6b9d6b6604da36340ad", "ja3_variant_count": 1, "ja3_variants": [ "7551ed40ef28b6b9d6b6604da36340ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_6add871e60e7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "6add871e60e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-35-65281-11-45-17613-43-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789543659, "last_seen": 1789543659, "transport": "t", "ja3_hash": "8c9f92c052d87f9d9bf73402a80427f6", "ja3_variant_count": 1, "ja3_variants": [ "8c9f92c052d87f9d9bf73402a80427f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_6e2bb551938a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "6e2bb551938a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-18-23-43-17513-65281-51-0,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791273583, "last_seen": 1791273583, "transport": "t", "ja3_hash": "52153ab3129eda4547c576763b44903f", "ja3_variant_count": 1, "ja3_variants": [ "52153ab3129eda4547c576763b44903f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_810fbb0645af", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "810fbb0645af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-35-17613-43-27-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790081639, "last_seen": 1790081639, "transport": "t", "ja3_hash": "991acc0342b29920851487659119f85b", "ja3_variant_count": 1, "ja3_variants": [ "991acc0342b29920851487659119f85b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_82cc11ce1da9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "82cc11ce1da9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-18-65037-65281-5-17613-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790931494, "last_seen": 1790931494, "transport": "t", "ja3_hash": "1d538f217a4f0b9ef2f85756bca28e9b", "ja3_variant_count": 1, "ja3_variants": [ "1d538f217a4f0b9ef2f85756bca28e9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_86b5c53ab338", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "86b5c53ab338", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-23-13-43-18-35-11-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790230462, "last_seen": 1790230462, "transport": "t", "ja3_hash": "1c5b42ff8f1458d57994463250d0d9ef", "ja3_variant_count": 1, "ja3_variants": [ "1c5b42ff8f1458d57994463250d0d9ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_9796d8a9404c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "9796d8a9404c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-18-43-27-65281-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789153468, "last_seen": 1789153468, "transport": "t", "ja3_hash": "d2dcd425c7ecdd85bcc083f6fdf54005", "ja3_variant_count": 1, "ja3_variants": [ "d2dcd425c7ecdd85bcc083f6fdf54005" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_991522635346", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "991522635346", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-27-10-65037-43-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790633787, "last_seen": 1790633787, "transport": "t", "ja3_hash": "e9f5b01d07645fff48220d234a731157", "ja3_variant_count": 1, "ja3_variants": [ "e9f5b01d07645fff48220d234a731157" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_a8d251cf0c2d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "a8d251cf0c2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-11-27-51-23-43-17613-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789461362, "last_seen": 1789461362, "transport": "t", "ja3_hash": "635cc3d4f4cf33d89d494848bd81063d", "ja3_variant_count": 1, "ja3_variants": [ "635cc3d4f4cf33d89d494848bd81063d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_ac2b489252dd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "ac2b489252dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,4832-65281-18-51-17613-27-43-45-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788725820, "last_seen": 1788725820, "transport": "t", "ja3_hash": "8533f0fa18fef887d93c650b696095f9", "ja3_variant_count": 1, "ja3_variants": [ "8533f0fa18fef887d93c650b696095f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_b40caa957179", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "b40caa957179", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-45-65037-51764-11-43-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791170600, "last_seen": 1791170600, "transport": "t", "ja3_hash": "234815a9c992dc4309cf3c34cce78a63", "ja3_variant_count": 1, "ja3_variants": [ "234815a9c992dc4309cf3c34cce78a63" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_b84e9c96affa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "b84e9c96affa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-27-23-43-65281-5-51-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524400, "last_seen": 1790524400, "transport": "t", "ja3_hash": "d118e050aaa50ee22459aa88ac0797dd", "ja3_variant_count": 1, "ja3_variants": [ "d118e050aaa50ee22459aa88ac0797dd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i150900_8daaf6152771_c7038b425076", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150900", "b": "8daaf6152771", "c": "c7038b425076", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-18-65037-5-17613-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791250308, "last_seen": 1791250308, "transport": "t", "ja3_hash": "90a2e1fc620889d09789185a0438d582", "ja3_variant_count": 1, "ja3_variants": [ "90a2e1fc620889d09789185a0438d582" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_4aea5e4e991b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "4aea5e4e991b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-23-45-11-5-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788924646, "last_seen": 1788924646, "transport": "t", "ja3_hash": "cd01f705c50bda6352d74922e65d6cb0", "ja3_variant_count": 1, "ja3_variants": [ "cd01f705c50bda6352d74922e65d6cb0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_7fa6f18f0afd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "7fa6f18f0afd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65037-18-43-45-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789870490, "last_seen": 1789870490, "transport": "t", "ja3_hash": "0d1e4d6d4815db1c88ae7c9467ea15a7", "ja3_variant_count": 1, "ja3_variants": [ "0d1e4d6d4815db1c88ae7c9467ea15a7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_980b585a698f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "980b585a698f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-27-45-65037-16-5-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788563590, "last_seen": 1788563590, "transport": "t", "ja3_hash": "50eded5181f9e0c054b764fe378311dd", "ja3_variant_count": 1, "ja3_variants": [ "50eded5181f9e0c054b764fe378311dd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_0fdad728a578", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "0fdad728a578", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-65281-27-10-23-5-18-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789267508, "last_seen": 1789267508, "transport": "t", "ja3_hash": "43d47ea28b077f9bf78259fe10bf7d95", "ja3_variant_count": 1, "ja3_variants": [ "43d47ea28b077f9bf78259fe10bf7d95" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_216356b62aef", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "216356b62aef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-18-17613-10-13-65281-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789040427, "last_seen": 1789040427, "transport": "t", "ja3_hash": "f47f020ed16a809aed3bb9639c25adf5", "ja3_variant_count": 1, "ja3_variants": [ "f47f020ed16a809aed3bb9639c25adf5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_296898b1edfe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "296898b1edfe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-27-17613-65281-18-51-43-35-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788934504, "last_seen": 1788934504, "transport": "t", "ja3_hash": "12ee3117598372ef254c9c591134c31e", "ja3_variant_count": 1, "ja3_variants": [ "12ee3117598372ef254c9c591134c31e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_4f3e5e7b67ba", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "4f3e5e7b67ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-45-5-11-43-27-18-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791124849, "last_seen": 1791124849, "transport": "t", "ja3_hash": "75c9e3de094d9a0a0c1091928e7ba581", "ja3_variant_count": 1, "ja3_variants": [ "75c9e3de094d9a0a0c1091928e7ba581" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_899307a7dd32", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "899307a7dd32", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-11-43-13-35-65037-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789665106, "last_seen": 1789665106, "transport": "t", "ja3_hash": "27eef50cc718a9184c9d06869f6b6bf6", "ja3_variant_count": 1, "ja3_variants": [ "27eef50cc718a9184c9d06869f6b6bf6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_8eb32d50d8bb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "8eb32d50d8bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-27-18-45-10-65037-13-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790004403, "last_seen": 1790004403, "transport": "t", "ja3_hash": "aa9396649174046b2921b40de971074c", "ja3_variant_count": 1, "ja3_variants": [ "aa9396649174046b2921b40de971074c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_9675a342c942", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "9675a342c942", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-65281-10-65037-18-43-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789990901, "last_seen": 1789990901, "transport": "t", "ja3_hash": "63a42544465755611ed98734e261cc2a", "ja3_variant_count": 1, "ja3_variants": [ "63a42544465755611ed98734e261cc2a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_9b46d9938292", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "9b46d9938292", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-18-23-11-27-51-35-43-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790104335, "last_seen": 1790104335, "transport": "t", "ja3_hash": "c8c1d9b134f9d59991d20c992b351bf9", "ja3_variant_count": 1, "ja3_variants": [ "c8c1d9b134f9d59991d20c992b351bf9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_9b5b5423d701", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "9b5b5423d701", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-27-11-5-65037-35-17613-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789439009, "last_seen": 1789439009, "transport": "t", "ja3_hash": "d8399038208f86619a435b02cdc4cc37", "ja3_variant_count": 1, "ja3_variants": [ "d8399038208f86619a435b02cdc4cc37" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_9eff1214ae36", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "9eff1214ae36", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-51-27-5-23-18-65281-17613-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790797063, "last_seen": 1790797063, "transport": "t", "ja3_hash": "c993ec60dffc70baa5b08ac273e0f2ad", "ja3_variant_count": 1, "ja3_variants": [ "c993ec60dffc70baa5b08ac273e0f2ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_a472275d7925", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "a472275d7925", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-23-27-43-13-45-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791249083, "last_seen": 1791249083, "transport": "t", "ja3_hash": "f4e6a5e7eb1a74b329ca320b64b35342", "ja3_variant_count": 1, "ja3_variants": [ "f4e6a5e7eb1a74b329ca320b64b35342" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_a5c3688805ed", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "a5c3688805ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-13-65281-5-35-27-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790778584, "last_seen": 1790778584, "transport": "t", "ja3_hash": "ab372dc742f2947d0a5dee40fb4a9800", "ja3_variant_count": 1, "ja3_variants": [ "ab372dc742f2947d0a5dee40fb4a9800" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_a78708d5500b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "a78708d5500b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-18-5-43-65281-10-45-17613-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241857, "last_seen": 1790241857, "transport": "t", "ja3_hash": "fb5ff95016f2f27d379d2b8169091e5f", "ja3_variant_count": 1, "ja3_variants": [ "fb5ff95016f2f27d379d2b8169091e5f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_bb13be964f2a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "bb13be964f2a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-45-65037-11-51764-35-43-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790776552, "last_seen": 1790776552, "transport": "t", "ja3_hash": "ac735959f8408e4cfc9f2b4a88c6ba26", "ja3_variant_count": 1, "ja3_variants": [ "ac735959f8408e4cfc9f2b4a88c6ba26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_bb2c11f9118d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "bb2c11f9118d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-51-45-65281-27-23-43-5-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789592006, "last_seen": 1789592006, "transport": "t", "ja3_hash": "8ee521eb85f1792325297cc16144a5fa", "ja3_variant_count": 1, "ja3_variants": [ "8ee521eb85f1792325297cc16144a5fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_d4e200ad9397", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "d4e200ad9397", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-5-11-27-13-45-65281-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790004084, "last_seen": 1790004084, "transport": "t", "ja3_hash": "5fcd7b08dbd9923e5f9340e676a63ef5", "ja3_variant_count": 1, "ja3_variants": [ "5fcd7b08dbd9923e5f9340e676a63ef5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_fda4ff3bc637", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "fda4ff3bc637", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-10-11-43-65281-35-27-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790869320, "last_seen": 1790869320, "transport": "t", "ja3_hash": "f6a09484702b9c4e58409ee78d792421", "ja3_variant_count": 1, "ja3_variants": [ "f6a09484702b9c4e58409ee78d792421" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_19b37005f41d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "19b37005f41d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-5-51764-65037-35-10-43-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711048, "last_seen": 1788711048, "transport": "t", "ja3_hash": "f25114760fa9fb100515fae90e6a5710", "ja3_variant_count": 1, "ja3_variants": [ "f25114760fa9fb100515fae90e6a5710" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_20785756ee03", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "20785756ee03", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-35-10-27-13-18-17613-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791250110, "last_seen": 1791250110, "transport": "t", "ja3_hash": "40cafb3aa75501b990905cb1c32ba3a9", "ja3_variant_count": 1, "ja3_variants": [ "40cafb3aa75501b990905cb1c32ba3a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_3540b8905173", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "3540b8905173", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-65037-23-18-11-43-65281-27-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791015200, "last_seen": 1791015200, "transport": "t", "ja3_hash": "9408a41df7cf5e6c475dc7ac95f2f342", "ja3_variant_count": 1, "ja3_variants": [ "9408a41df7cf5e6c475dc7ac95f2f342" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_3abbd48d23e9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "3abbd48d23e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-5-18-35-27-10-23-65281-65037-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790229987, "last_seen": 1790229987, "transport": "t", "ja3_hash": "baff631c59886cba927921e73a2be93d", "ja3_variant_count": 1, "ja3_variants": [ "baff631c59886cba927921e73a2be93d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_3bc4f1e4447f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "3bc4f1e4447f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-65281-43-13-65037-23-45-17513-5-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790946708, "last_seen": 1790946708, "transport": "t", "ja3_hash": "619246977a1daf4e50d4f212d5fb4eb2", "ja3_variant_count": 1, "ja3_variants": [ "619246977a1daf4e50d4f212d5fb4eb2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_585a6245a93a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "585a6245a93a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-45-17613-65281-5-11-13-35-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790876632, "last_seen": 1790876632, "transport": "t", "ja3_hash": "09b489cdd77fa306fcf3f2a4d2ea1f28", "ja3_variant_count": 1, "ja3_variants": [ "09b489cdd77fa306fcf3f2a4d2ea1f28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_6b41e6af3c30", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "6b41e6af3c30", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-11-5-51764-43-23-27-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791123372, "last_seen": 1791123372, "transport": "t", "ja3_hash": "0db87c9f859c41ea673b66c3a1764586", "ja3_variant_count": 1, "ja3_variants": [ "0db87c9f859c41ea673b66c3a1764586" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_6ceb7bd68e6a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "6ceb7bd68e6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-10-43-18-65281-27-11-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790168396, "last_seen": 1790168396, "transport": "t", "ja3_hash": "a5af38166f615e861c301fa2d422e529", "ja3_variant_count": 1, "ja3_variants": [ "a5af38166f615e861c301fa2d422e529" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_7ca7d55a8b4b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "7ca7d55a8b4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-10-65037-45-11-43-13-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789381767, "last_seen": 1789381767, "transport": "t", "ja3_hash": "3f2dfe09eced865e91cbc60b064badf7", "ja3_variant_count": 1, "ja3_variants": [ "3f2dfe09eced865e91cbc60b064badf7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_95ef89aa6be3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "95ef89aa6be3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-43-17613-35-27-18-10-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790253772, "last_seen": 1790253772, "transport": "t", "ja3_hash": "231a0c07210c7e9a697618ca9d2cb46c", "ja3_variant_count": 1, "ja3_variants": [ "231a0c07210c7e9a697618ca9d2cb46c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_97fa596ec9f1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "97fa596ec9f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-13-18-65281-45-65037-43-51764-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790613529, "last_seen": 1790613529, "transport": "t", "ja3_hash": "87bdc165b72ac158db724198cb7e2258", "ja3_variant_count": 1, "ja3_variants": [ "87bdc165b72ac158db724198cb7e2258" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_ad8426f9ccf3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "ad8426f9ccf3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-23-43-17613-18-27-65281-10-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790639750, "last_seen": 1790639750, "transport": "t", "ja3_hash": "743978e18a224269f2001e8791349472", "ja3_variant_count": 1, "ja3_variants": [ "743978e18a224269f2001e8791349472" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_b0f6f14d21c3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "b0f6f14d21c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-27-65281-10-18-45-23-17613-5-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788696690, "last_seen": 1788696690, "transport": "t", "ja3_hash": "e714be6fb02f8f27d1f6fe7db97dba64", "ja3_variant_count": 1, "ja3_variants": [ "e714be6fb02f8f27d1f6fe7db97dba64" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_b1299265fb1f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "b1299265fb1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-10-27-13-43-17613-11-18-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788663675, "last_seen": 1788663675, "transport": "t", "ja3_hash": "a524cd7cdf8338acd08ded50271c4c04", "ja3_variant_count": 1, "ja3_variants": [ "a524cd7cdf8338acd08ded50271c4c04" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_c03a3e1ee167", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "c03a3e1ee167", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-27-23-5-35-13-43-51764-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790242405, "last_seen": 1790242405, "transport": "t", "ja3_hash": "67243f8b917c771c71b8d5a880af5ac2", "ja3_variant_count": 1, "ja3_variants": [ "67243f8b917c771c71b8d5a880af5ac2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_d420e4aed517", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "d420e4aed517", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-27-35-43-17613-13-18-23-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788656431, "last_seen": 1788656431, "transport": "t", "ja3_hash": "6efc09cd362c5ac184a1db1e4705e691", "ja3_variant_count": 1, "ja3_variants": [ "6efc09cd362c5ac184a1db1e4705e691" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151100_8daaf6152771_e1b9f57180f0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151100", "b": "8daaf6152771", "c": "e1b9f57180f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-10-43-27-23-35-5-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791224746, "last_seen": 1791224746, "transport": "t", "ja3_hash": "b005602dc7eb0b6b7b9ca9787ba0a4b5", "ja3_variant_count": 1, "ja3_variants": [ "b005602dc7eb0b6b7b9ca9787ba0a4b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_5af545bf8381", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "5af545bf8381", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-17613-45-35-13-16-5-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790655397, "last_seen": 1790655397, "transport": "t", "ja3_hash": "955f8f4993d0c5811201eabeed4f56d9", "ja3_variant_count": 1, "ja3_variants": [ "955f8f4993d0c5811201eabeed4f56d9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_16fcb5c37e5a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "16fcb5c37e5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-10-5-23-65281-18-43-17613-45-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788515275, "last_seen": 1788515275, "transport": "t", "ja3_hash": "aa24b1d78660b959160ee6c17f652ed3", "ja3_variant_count": 1, "ja3_variants": [ "aa24b1d78660b959160ee6c17f652ed3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_193dc55611d3", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "193dc55611d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-35-51764-5-45-65281-43-11-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711046, "last_seen": 1788711046, "transport": "t", "ja3_hash": "0306d439d8444becc3646761ad8f3eae", "ja3_variant_count": 1, "ja3_variants": [ "0306d439d8444becc3646761ad8f3eae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_1e42e07f4f9a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "1e42e07f4f9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-43-18-27-13-17613-10-35-23-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789463336, "last_seen": 1789463336, "transport": "t", "ja3_hash": "f88cb8dc21dd76d12747b1b61e9d02c5", "ja3_variant_count": 1, "ja3_variants": [ "f88cb8dc21dd76d12747b1b61e9d02c5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_20f4ea61072b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "20f4ea61072b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-65281-10-43-5-51764-45-18-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788900180, "last_seen": 1788900180, "transport": "t", "ja3_hash": "2cd5c849bc1ede5043b63864c5e65688", "ja3_variant_count": 1, "ja3_variants": [ "2cd5c849bc1ede5043b63864c5e65688" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_329403cb162f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "329403cb162f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-43-23-13-17613-65037-51764-5-45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789728394, "last_seen": 1789728394, "transport": "t", "ja3_hash": "63d1b30410f289e6be6a83d7c4d643b8", "ja3_variant_count": 1, "ja3_variants": [ "63d1b30410f289e6be6a83d7c4d643b8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_39932c608578", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "39932c608578", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-23-51764-18-45-65037-17613-27-43-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790885122, "last_seen": 1790885122, "transport": "t", "ja3_hash": "9580d688b61dfdf9fc468ef2c31eaee6", "ja3_variant_count": 1, "ja3_variants": [ "9580d688b61dfdf9fc468ef2c31eaee6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_3aa542035edf", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "3aa542035edf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-23-35-18-43-51764-65037-17613-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788903840, "last_seen": 1788903840, "transport": "t", "ja3_hash": "d6f6172e4dde4e7a3aa5562018f821f6", "ja3_variant_count": 1, "ja3_variants": [ "d6f6172e4dde4e7a3aa5562018f821f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_53b6007cfcd6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "53b6007cfcd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-65037-43-45-65281-13-18-10-17613-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789658268, "last_seen": 1789658268, "transport": "t", "ja3_hash": "ce0bd5397de06ce65728363f0f3530ac", "ja3_variant_count": 1, "ja3_variants": [ "ce0bd5397de06ce65728363f0f3530ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_544c9e3cb54f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "544c9e3cb54f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-5-13-65281-43-27-65037-10-45-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790083140, "last_seen": 1790083140, "transport": "t", "ja3_hash": "60ddffd3f4b5b05af02bebe45b80202b", "ja3_variant_count": 1, "ja3_variants": [ "60ddffd3f4b5b05af02bebe45b80202b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_66038f602303", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "66038f602303", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-65281-27-17613-43-45-10-18-5-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789430923, "last_seen": 1789430923, "transport": "t", "ja3_hash": "c2012d6379a28fd64a888bc4a3671532", "ja3_variant_count": 1, "ja3_variants": [ "c2012d6379a28fd64a888bc4a3671532" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_6e2566727f66", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "6e2566727f66", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-13-17613-45-27-43-5-23-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790520860, "last_seen": 1790520860, "transport": "t", "ja3_hash": "0ccb90cabbbd41e0ca538fa29d26ef7f", "ja3_variant_count": 1, "ja3_variants": [ "0ccb90cabbbd41e0ca538fa29d26ef7f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_9a295a759c09", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "9a295a759c09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-65037-43-35-11-10-27-13-5-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790681108, "last_seen": 1790681108, "transport": "t", "ja3_hash": "04df980ece9e86db185112e2338a0a67", "ja3_variant_count": 1, "ja3_variants": [ "04df980ece9e86db185112e2338a0a67" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_b17293c4b46f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "b17293c4b46f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-43-18-35-65037-65281-51764-27-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789736892, "last_seen": 1789736892, "transport": "t", "ja3_hash": "042d0c6f46e0aef985205d25d99733ba", "ja3_variant_count": 1, "ja3_variants": [ "042d0c6f46e0aef985205d25d99733ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_bf72d5d417c0", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "bf72d5d417c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-5-17613-35-45-23-18-13-27-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790588093, "last_seen": 1790588093, "transport": "t", "ja3_hash": "b362d31f2c622292893df966dea0963b", "ja3_variant_count": 1, "ja3_variants": [ "b362d31f2c622292893df966dea0963b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151200_8daaf6152771_e23df001e3ea", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151200", "b": "8daaf6152771", "c": "e23df001e3ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-18-11-23-43-65281-51764-5-45-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790984598, "last_seen": 1790984598, "transport": "t", "ja3_hash": "3f6a4ce18834ae541dc6bb96e5483d9d", "ja3_variant_count": 1, "ja3_variants": [ "3f6a4ce18834ae541dc6bb96e5483d9d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_ec6b4befa3cd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "ec6b4befa3cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-65037-16-43-13-5-45-27-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789755489, "last_seen": 1789755489, "transport": "t", "ja3_hash": "44ec144ecc8f99f37a8db176e85036e9", "ja3_variant_count": 1, "ja3_variants": [ "44ec144ecc8f99f37a8db176e85036e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_24d9a185522e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "24d9a185522e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-27-35-17613-65037-11-18-43-45-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790820192, "last_seen": 1790820192, "transport": "t", "ja3_hash": "fc521d9b8a4078c865f36b374e99688c", "ja3_variant_count": 1, "ja3_variants": [ "fc521d9b8a4078c865f36b374e99688c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_556db6a3b758", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "556db6a3b758", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-18-65281-43-10-11-35-65037-45-27-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788934404, "last_seen": 1788934404, "transport": "t", "ja3_hash": "6a29c94302f366d179b092cabeef7f8e", "ja3_variant_count": 1, "ja3_variants": [ "6a29c94302f366d179b092cabeef7f8e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_5f3eb19eed3a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "5f3eb19eed3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-43-10-35-13-45-65281-23-27-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790192509, "last_seen": 1790192509, "transport": "t", "ja3_hash": "e554e270b3b0cac1833a844fd6f8dfec", "ja3_variant_count": 1, "ja3_variants": [ "e554e270b3b0cac1833a844fd6f8dfec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151300_8daaf6152771_b93ce70e6b67", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151300", "b": "8daaf6152771", "c": "b93ce70e6b67", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-45-5-35-23-17613-11-18-65281-65037-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788866545, "last_seen": 1788866545, "transport": "t", "ja3_hash": "1b834f288b74eee87f138813d15d3caa", "ja3_variant_count": 1, "ja3_variants": [ "1b834f288b74eee87f138813d15d3caa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_20058ac78caa", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "20058ac78caa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-13-65281-16-17613-11-65037-10-45-18-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789949153, "last_seen": 1789949153, "transport": "t", "ja3_hash": "982891af18f700d5bee1a1edeaa4ca20", "ja3_variant_count": 1, "ja3_variants": [ "982891af18f700d5bee1a1edeaa4ca20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i151400_8daaf6152771_12517a9a6ccc", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151400", "b": "8daaf6152771", "c": "12517a9a6ccc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-23-65281-11-65037-35-5-17613-43-10-45-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789569082, "last_seen": 1789569082, "transport": "t", "ja3_hash": "d6720a4fcff395c1faabce69e5a87130", "ja3_variant_count": 1, "ja3_variants": [ "d6720a4fcff395c1faabce69e5a87130" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i151500_8daaf6152771_33f857a189cb", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i151500", "b": "8daaf6152771", "c": "33f857a189cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-43-11-45-65037-10-13-5-17613-65281-23-27-35-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789736891, "last_seen": 1789736891, "transport": "t", "ja3_hash": "3b326687bef3a78f90a532c89fa7e1c2", "ja3_variant_count": 1, "ja3_variants": [ "3b326687bef3a78f90a532c89fa7e1c2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i170900_5b57614c22b0_78e6aca7449b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i170900", "b": "5b57614c22b0", "c": "78e6aca7449b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,23-65281-10-11-35-13-51-45-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 71, "first_seen": 1787468370, "last_seen": 1791349715, "transport": "t", "ja3_hash": "052a5e65c3a64e860e1706b1de3c46a9", "ja3_variant_count": 3, "ja3_variants": [ "052a5e65c3a64e860e1706b1de3c46a9", "7041540a5e44ce9a1d4200c4214355aa", "10a627ad22b67741a3319a1d42cbf0a6" ], "user_agents": { "libredtail-http": 999 }, "ua_disagreement": false } }, { "hash": "t13i171100_ab0a1bf427ad_ecd0401ec68b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i171100", "b": "ab0a1bf427ad", "c": "ecd0401ec68b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825500, "last_seen": 1790703163, "transport": "t", "ja3_hash": "1987606153939a4c0ccc1465ecf8e431", "ja3_variant_count": 1, "ja3_variants": [ "1987606153939a4c0ccc1465ecf8e431" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i180900_85036bcba153_1f22a2ca17c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i180900", "b": "85036bcba153", "c": "1f22a2ca17c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 10, "first_seen": 1787560226, "last_seen": 1791189127, "transport": "t", "ja3_hash": "bf88702d3fed3795dbe0118835cc4229", "ja3_variant_count": 1, "ja3_variants": [ "bf88702d3fed3795dbe0118835cc4229" ], "user_agents": { "Mozilla/5.0": 3 }, "ua_disagreement": false } }, { "hash": "t13i190500_9c2f387b437f_05020bd715f8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i190500", "b": "9c2f387b437f", "c": "05020bd715f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4871-4870-4869-4868-4865-4866-4867-49332-49333-199-198-49330-49328-49331-49329-49411-49413-49412-49414,11-10-43-13-51,23-24-25-29-256-4588-41,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4871, "name": "4871 (0x1307)", "known": false }, { "value": 4870, "name": "4870 (0x1306)", "known": false }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787820559, "last_seen": 1789485421, "transport": "t", "ja3_hash": "c797a5d216f09ffb7f293a413929012a", "ja3_variant_count": 1, "ja3_variants": [ "c797a5d216f09ffb7f293a413929012a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i190800_9dc949149365_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Censys \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i190800", "b": "9dc949149365", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 8, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1112, "first_seen": 1787451879, "last_seen": 1791359353, "transport": "t", "ja3_hash": "35fa0a83e466acbec1cfbb9016d550ab", "ja3_variant_count": 7, "ja3_variants": [ "35fa0a83e466acbec1cfbb9016d550ab", "19e29534fd49dd27d09234e639c4057e", "f72589e607f9b36992b6b437ce399f26", "e873803ab6f54f1316b295ee4fbea1d2", "f6b1f1a5591b53aa4d6b4a8de8e50ce6", "89be98bbd4f065fe510fca4893cf8d9b", "cdcd3b10ffd65fac11ce29e16f5eb298" ], "user_agents": { "Mozilla/5.0 (Linux; U; Android 8.1.0; es-us; Redmi Note 5 Build/OPM1.171019.011) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/71.0.3578.141 Mobile Safari/537.36 XiaoMi": 1, "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36": 1, "l9explore/1.2.2": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:32.0) Gecko/20100101 Firefox/32.0": 12, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.36": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36": 3, "Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)": 11, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 127, "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)": 353 }, "ua_disagreement": true } }, { "hash": "t13i191100_9dc949149365_9249cab70c77", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i191100", "b": "9dc949149365", "c": "9249cab70c77", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-35-13-65281-23-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788585568, "last_seen": 1789653027, "transport": "t", "ja3_hash": "30ae8660657b7198d6f11ae92ef04b28", "ja3_variant_count": 1, "ja3_variants": [ "30ae8660657b7198d6f11ae92ef04b28" ], "user_agents": { "CGrab/v8.12.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i220900_231e334592e8_29829a46703f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i220900", "b": "231e334592e8", "c": "29829a46703f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 22, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,43-13-35-10-51-49-23-65281-45,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788840785, "last_seen": 1790116378, "transport": "t", "ja3_hash": "622a7fd6adbafa3736c1a3468db8a8e0", "ja3_variant_count": 1, "ja3_variants": [ "622a7fd6adbafa3736c1a3468db8a8e0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t13i260800_3309cf098094_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i260800", "b": "3309cf098094", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 26, "extension_count": 8, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49161-158-52392-52394-51-61-22-49162-57-49171-10-49172-156-157-47-53-49170-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787846999, "last_seen": 1791331104, "transport": "t", "ja3_hash": "3429560be8f9b1b5aa346694eb419bad", "ja3_variant_count": 1, "ja3_variants": [ "3429560be8f9b1b5aa346694eb419bad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i270800_fa4239e4ca25_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i270800", "b": "fa4239e4ca25", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 27, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49199-49200-49195-49196-52392-52393-49171-49161-49172-49162-156-157-47-53-49170-10-50-19-56-64-102-106-162-163-4865-4867-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789267527, "last_seen": 1789267527, "transport": "t", "ja3_hash": "c0098facaec57f7a5692a6130526a733", "ja3_variant_count": 1, "ja3_variants": [ "c0098facaec57f7a5692a6130526a733" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i291200_723694b0fccc_899037bd0b8c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i291200", "b": "723694b0fccc", "c": "899037bd0b8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 29, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,5-10-11-13-35-51-43-49-65281-45-28-21,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790258068, "last_seen": 1790258068, "transport": "t", "ja3_hash": "b1eb3ca3daaf03d365753f0a321e1601", "ja3_variant_count": 1, "ja3_variants": [ "b1eb3ca3daaf03d365753f0a321e1601" ], "user_agents": { "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)": 1 }, "ua_disagreement": false } }, { "hash": "t13i300900_3c43a67630b3_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Internet Measurement \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i300900", "b": "3c43a67630b3", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49160-49170-10-49188-49192-49187-49191-60-61-49159-49169-5-4-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 152, "first_seen": 1787497496, "last_seen": 1791344323, "transport": "t", "ja3_hash": "7024ed8c0d80542d17159473f564b551", "ja3_variant_count": 1, "ja3_variants": [ "7024ed8c0d80542d17159473f564b551" ], "user_agents": { "Mozilla/5.0 (compatible; InternetMeasurement/1.0; +https://internet-measurement.com/)": 59 }, "ua_disagreement": false } }, { "hash": "t13i301000_1d37bd780c83_8e6e362c5eac", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i301000", "b": "1d37bd780c83", "c": "8e6e362c5eac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790247093, "last_seen": 1790247093, "transport": "t", "ja3_hash": "afff01903e7daf79afab4226ff5bf67f", "ja3_variant_count": 1, "ja3_variants": [ "afff01903e7daf79afab4226ff5bf67f" ], "user_agents": { "Mozilla/5.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i301100_1d37bd780c83_0717325a49fe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i301100", "b": "1d37bd780c83", "c": "0717325a49fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-35-5-22-23-13-43-45-51,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790461759, "last_seen": 1790461759, "transport": "t", "ja3_hash": "f64255f709dc47feb4e51343d9ac2e08", "ja3_variant_count": 1, "ja3_variants": [ "f64255f709dc47feb4e51343d9ac2e08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i301100_1d37bd780c83_ecd0401ec68b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i301100", "b": "1d37bd780c83", "c": "ecd0401ec68b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 14, "first_seen": 1788976818, "last_seen": 1791160525, "transport": "t", "ja3_hash": "2617ff3a2d7f879546f0aac7afc5f15c", "ja3_variant_count": 1, "ja3_variants": [ "2617ff3a2d7f879546f0aac7afc5f15c" ], "user_agents": { "Mozilla/5.0": 12, "zern-scanner (+https://zern.io)": 2 }, "ua_disagreement": false } }, { "hash": "t13i310900_e8f1e7e78f70_1f22a2ca17c4", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i310900", "b": "e8f1e7e78f70", "c": "1f22a2ca17c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 9, "first_seen": 1788459244, "last_seen": 1790879385, "transport": "t", "ja3_hash": "c216e752cae6f8755fd27f561d031636", "ja3_variant_count": 1, "ja3_variants": [ "c216e752cae6f8755fd27f561d031636" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i310900_e8f1e7e78f70_5ac7197df9d2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i310900", "b": "e8f1e7e78f70", "c": "5ac7197df9d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787697743, "last_seen": 1790717115, "transport": "t", "ja3_hash": "c34a54599a1fbaf1786aa6d633545a60", "ja3_variant_count": 1, "ja3_variants": [ "c34a54599a1fbaf1786aa6d633545a60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i311100_1d947a95fc68_7e1102d2036b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i311100", "b": "1d947a95fc68", "c": "7e1102d2036b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788771236, "last_seen": 1788782094, "transport": "t", "ja3_hash": "ea0154154790b24e85b5cc9676622c9c", "ja3_variant_count": 1, "ja3_variants": [ "ea0154154790b24e85b5cc9676622c9c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i311100_e8f1e7e78f70_0d7ed806c34c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i311100", "b": "e8f1e7e78f70", "c": "0d7ed806c34c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-157-156-61-60-53-47-255,5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789290637, "last_seen": 1790820851, "transport": "t", "ja3_hash": "65ce4cb3186abc297a488bacf38b8d6a", "ja3_variant_count": 1, "ja3_variants": [ "65ce4cb3186abc297a488bacf38b8d6a" ], "user_agents": { "Mozilla/5.0 (compatible; ips-agent)": 14 }, "ua_disagreement": false } }, { "hash": "t13i311100_e8f1e7e78f70_8d4036f0cf4a", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i311100", "b": "e8f1e7e78f70", "c": "8d4036f0cf4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 16, "first_seen": 1791051262, "last_seen": 1791051270, "transport": "t", "ja3_hash": "fa861b6644c6efb762bce8c9f442910a", "ja3_variant_count": 1, "ja3_variants": [ "fa861b6644c6efb762bce8c9f442910a" ], "user_agents": { "Mozilla/5.0": 15 }, "ua_disagreement": false } }, { "hash": "t13i360900_bcee18a5b459_3550537cd59b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i360900", "b": "bcee18a5b459", "c": "3550537cd59b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 36, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49188-49192-49162-49172-49311-107-57-49324-49187-49191-49161-49171-49310-103-51-157-156-49309-49308-61-60-53-47,65281-11-10-22-23-13-43-45-51,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788718230, "last_seen": 1788718230, "transport": "t", "ja3_hash": "16ad1af652b89865590482c2db861013", "ja3_variant_count": 1, "ja3_variants": [ "16ad1af652b89865590482c2db861013" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2)": 1 }, "ua_disagreement": false } }, { "hash": "t13i361100_018971650b2c_144321f44052", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i361100", "b": "018971650b2c", "c": "144321f44052", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 36, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790733501, "last_seen": 1790733501, "transport": "t", "ja3_hash": "a6ee554cd1ddcec689c395b2f6337b05", "ja3_variant_count": 1, "ja3_variants": [ "a6ee554cd1ddcec689c395b2f6337b05" ], "user_agents": { "Mozilla/5.0": 1 }, "ua_disagreement": false } }, { "hash": "t13i491100_bd868743f55c_7c76daad20ec", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i491100", "b": "bd868743f55c", "c": "7c76daad20ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 49, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 10, "first_seen": 1788710033, "last_seen": 1789027733, "transport": "t", "ja3_hash": "57900674e6344e6daca60641dfd512dd", "ja3_variant_count": 1, "ja3_variants": [ "57900674e6344e6daca60641dfd512dd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i681000_13e0e9e1c501_8e6e362c5eac", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "nmap \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i681000", "b": "13e0e9e1c501", "c": "8e6e362c5eac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 68, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-69-68-157-49309-49233-156-49308-49232-61-192-60-186-132-65,65281-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1141, "first_seen": 1787813790, "last_seen": 1790842724, "transport": "t", "ja3_hash": "f37fb2137dc72687f85fa3bdcfd9ebdf", "ja3_variant_count": 1, "ja3_variants": [ "f37fb2137dc72687f85fa3bdcfd9ebdf" ], "user_agents": { "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)": 112, "iPhoto/9.1.1 (Macintosh; N; PPC)": 1 }, "ua_disagreement": false } }, { "hash": "t13i711000_8f28d1f76561_8e6e362c5eac", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "nmap \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i711000", "b": "8f28d1f76561", "c": "8e6e362c5eac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 71, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-157-49309-49233-156-49308-49232-61-192-60-186-132-150-65,65281-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1790392759, "last_seen": 1791232200, "transport": "t", "ja3_hash": "27883ef8db6a554b664dcbb145ab7558", "ja3_variant_count": 1, "ja3_variants": [ "27883ef8db6a554b664dcbb145ab7558" ], "user_agents": { "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)": 1 }, "ua_disagreement": false } }, { "hash": "t13i711100_8f28d1f76561_ecd0401ec68b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "nmap \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i711100", "b": "8f28d1f76561", "c": "ecd0401ec68b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 71, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-49195-49199-162-158-49324-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-157-49309-49233-156-49308-49232-61-192-60-186-132-150-65,65281-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 287, "first_seen": 1788920365, "last_seen": 1791342392, "transport": "t", "ja3_hash": "745c078278cdc062a615392c6bdf086c", "ja3_variant_count": 1, "ja3_variants": [ "745c078278cdc062a615392c6bdf086c" ], "user_agents": { "Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)": 32 }, "ua_disagreement": false } }, { "hash": "t13i751000_479067518aa3_d41ae481755e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i751000", "b": "479067518aa3", "c": "d41ae481755e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 75, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-65-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 315, "first_seen": 1788459218, "last_seen": 1790879382, "transport": "t", "ja3_hash": "327efd8a5e8ed9fa2b145f126b748661", "ja3_variant_count": 1, "ja3_variants": [ "327efd8a5e8ed9fa2b145f126b748661" ], "user_agents": { "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)": 36 }, "ua_disagreement": false } }, { "hash": "t13i781000_ab95583b6d39_d41ae481755e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "nmap \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i781000", "b": "ab95583b6d39", "c": "d41ae481755e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 78, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-150-65-255,11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 53, "first_seen": 1789150603, "last_seen": 1791351569, "transport": "t", "ja3_hash": "b3e88a126e6e0179ae465227a52f60ad", "ja3_variant_count": 1, "ja3_variants": [ "b3e88a126e6e0179ae465227a52f60ad" ], "user_agents": { "Mozilla/5.0 (compatible)": 31, "Mozilla/5.0 (compatible; nmap-http-info)": 3 }, "ua_disagreement": false } }, { "hash": "t13i781100_ab95583b6d39_ccd0985badbe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i781100", "b": "ab95583b6d39", "c": "ccd0985badbe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 78, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-51-57-53-47-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-56-136-135-49161-49171-50-154-153-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-132-150-65-255,11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 435, "first_seen": 1787940127, "last_seen": 1790934385, "transport": "t", "ja3_hash": "414440b3366abba75e5380623974d98d", "ja3_variant_count": 1, "ja3_variants": [ "414440b3366abba75e5380623974d98d" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML": 17, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_2) AppleWebKit/605.1.15 (KHTML": 4 }, "ua_disagreement": false } }, { "hash": "t13i911100_0d5420ba6086_87b33ccefea8", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i911100", "b": "0d5420ba6086", "c": "87b33ccefea8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 91, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65-255,11-10-35-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788648417, "last_seen": 1788648417, "transport": "t", "ja3_hash": "da472575d3ad6f060581fbbad76c09d6", "ja3_variant_count": 1, "ja3_variants": [ "da472575d3ad6f060581fbbad76c09d6" ], "user_agents": { "Python-urllib/3.13": 1 }, "ua_disagreement": false } }, { "hash": "t13i920900_1a0666d6c920_71f3a2441023", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i920900", "b": "1a0666d6c920", "c": "71f3a2441023", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 92, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-150-65-7-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788120496, "last_seen": 1789305696, "transport": "t", "ja3_hash": "2b78e6fc15e004a7c23166a124473e83", "ja3_variant_count": 1, "ja3_variants": [ "2b78e6fc15e004a7c23166a124473e83" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i970900_21fe6ccd8ec5_5fb67df6121e", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i970900", "b": "21fe6ccd8ec5", "c": "5fb67df6121e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 97, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-49196-49200-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49235-167-49195-49199-158-49326-49324-49314-49310-49244-49248-49234-166-49188-49192-107-49267-49271-196-109-197-49187-49191-103-49266-49270-190-108-191-49162-49172-57-136-49177-58-137-49161-49171-51-154-69-49176-52-155-70-49159-49169-49174-49160-49170-22-49175-27-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-7-5-10-49158-49168-49173-59-2-1-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788756954, "last_seen": 1790063182, "transport": "t", "ja3_hash": "a943bbc58359ce7d3dc5b42f209aaa5b", "ja3_variant_count": 1, "ja3_variants": [ "a943bbc58359ce7d3dc5b42f209aaa5b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t13i990900_760e5dff8384_5ac7197df9d2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i990900", "b": "760e5dff8384", "c": "5ac7197df9d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 99, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-167-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-166-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-154-153-69-68-49176-52-155-70-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-7-49158-49168-49173-59-2-1-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 46, "first_seen": 1787614664, "last_seen": 1791300733, "transport": "t", "ja3_hash": "effe96911320528dfdfdba040c9e915b", "ja3_variant_count": 1, "ja3_variants": [ "effe96911320528dfdfdba040c9e915b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 20, "xfa1": 4 }, "ua_disagreement": false } }, { "hash": "q13d0115h3_0f2cb44170f4_e9b4b416271b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0115h3", "b": "0f2cb44170f4", "c": "e9b4b416271b", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865,11-16-13-57-45-23-0-10-18-43-5-65281-35-51-41,24-23-25-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789480529, "last_seen": 1789480529, "transport": "q", "ja3_hash": "ed94997f17c737b4bdb7745213143169", "ja3_variant_count": 1, "ja3_variants": [ "ed94997f17c737b4bdb7745213143169" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0115h3_0f2cb44170f4_fb190d169104", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0115h3", "b": "0f2cb44170f4", "c": "fb190d169104", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865,11-45-16-50-23-10-57-65281-5-51-18-0-13-43-35,25-24-23-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789323990, "last_seen": 1789710029, "transport": "q", "ja3_hash": "207fbd2687764bb2e2aeb5040c3eea42", "ja3_variant_count": 2, "ja3_variants": [ "207fbd2687764bb2e2aeb5040c3eea42", "c7b1082b9ce4dfbb4b13928a059239df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0116h3_0f2cb44170f4_df815552bcbf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0116h3", "b": "0f2cb44170f4", "c": "df815552bcbf", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4865,65281-13-11-45-10-57-16-50-35-0-18-51-23-43-5-41,23-24-29-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788631465, "last_seen": 1790620135, "transport": "q", "ja3_hash": "6ae2ccb40fa29cf04e4b48a2fb9b5716", "ja3_variant_count": 2, "ja3_variants": [ "6ae2ccb40fa29cf04e4b48a2fb9b5716", "9c921f26f6cb20b1ab2c2a705153b940" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0116h3_ee47968ec53b_df815552bcbf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0116h3", "b": "ee47968ec53b", "c": "df815552bcbf", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4866,16-18-50-65281-11-5-13-57-35-10-43-51-23-45-0-41,25-23-24-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 25, "name": "secp521r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790356580, "last_seen": 1790356580, "transport": "q", "ja3_hash": "c0b29702bae05169bc0e74ff856d92cc", "ja3_variant_count": 1, "ja3_variants": [ "c0b29702bae05169bc0e74ff856d92cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0215h3_62ed6f6ca7ad_fb190d169104", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0215h3", "b": "62ed6f6ca7ad", "c": "fb190d169104", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4866,18-10-43-51-57-13-45-16-0-65281-5-23-50-11-35,24-29-25-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788735247, "last_seen": 1788735247, "transport": "q", "ja3_hash": "34021e3c39c4224580b6a3b544dbbecf", "ja3_variant_count": 1, "ja3_variants": [ "34021e3c39c4224580b6a3b544dbbecf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0215h3_fffbd61365f3_fb190d169104", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0215h3", "b": "fffbd61365f3", "c": "fb190d169104", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4866-4867,13-50-35-11-43-45-57-23-10-65281-18-51-5-0-16,23-25-29-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788796615, "last_seen": 1788796615, "transport": "q", "ja3_hash": "4fa9ff5071fb8ec417b649ad526e6e95", "ja3_variant_count": 1, "ja3_variants": [ "4fa9ff5071fb8ec417b649ad526e6e95" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0307h3_55b375c5d22e_945b2dc88d6b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0307h3", "b": "55b375c5d22e", "c": "945b2dc88d6b", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 7, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,51-43-13-10-0-16-57,23-24-29-30,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true } ], "point_formats": [] }, "observed": { "count": 14, "first_seen": 1789268955, "last_seen": 1789411008, "transport": "q", "ja3_hash": "121f6e4f22ee3205214b0676ed64b9e2", "ja3_variant_count": 1, "ja3_variants": [ "121f6e4f22ee3205214b0676ed64b9e2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0308h3_55b375c5d22e_10107d85556e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0308h3", "b": "55b375c5d22e", "c": "10107d85556e", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 8, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,51-43-13-10-45-0-16-57,23-24-29-30,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789313882, "last_seen": 1789411009, "transport": "q", "ja3_hash": "273162b4249b4a9e8e66cf971794f989", "ja3_variant_count": 1, "ja3_variants": [ "273162b4249b4a9e8e66cf971794f989" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0308h3_55b375c5d22e_9a370787d3dd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "q13d0308h3", "b": "55b375c5d22e", "c": "9a370787d3dd", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 8, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-10-16-13-51-45-43-57,4588-65074-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 65074, "name": "65074 (0xfe32)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789673241, "last_seen": 1789673241, "transport": "q", "ja3_hash": "b6b6dae0a68dd7441a579b3ea9d8465e", "ja3_variant_count": 1, "ja3_variants": [ "b6b6dae0a68dd7441a579b3ea9d8465e" ], "user_agents": { "quiche": 1 }, "ua_disagreement": false } }, { "hash": "q13d0308h3_55b375c5d22e_d2b5c8c7ba45", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0308h3", "b": "55b375c5d22e", "c": "d2b5c8c7ba45", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 8, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-10-16-13-51-45-43-57,29-23-4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789386540, "last_seen": 1789630814, "transport": "q", "ja3_hash": "376aa2c82d54a586fb5b3aee27996152", "ja3_variant_count": 1, "ja3_variants": [ "376aa2c82d54a586fb5b3aee27996152" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0310h3_55b375c5d22e_8732cbce638c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0310h3", "b": "55b375c5d22e", "c": "8732cbce638c", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,57-0-5-51-45-10-43-16-13-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 37, "first_seen": 1791316720, "last_seen": 1791363210, "transport": "q", "ja3_hash": "e5f23adff548b28a1b10aef046c719a4", "ja3_variant_count": 37, "ja3_variants": [ "e5f23adff548b28a1b10aef046c719a4", "2ec0ccfb7b9bbf3c7b770a3d9673f8ae", "e8a350a11c233c1fbe9199d1fac9512b", "03e9660c65da6ed2acb50699c8380ed7", "8b6a557c2a894057857f71e45d8f0dfb", "aa5766c779a710f014e2d7bb1c586dbf", "4d51eada61a263796edb6bab89384f60", "cca2031437410ec390e722ee15758ba6", "fcba845601677d37527895d11b7cb5d9", "6d5da6b3789012e9b95862be42066ce8", "29f5ff6e17abd32742ee6727c554fd55", "342e7c0997fa1d6afcf567872f30594c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_35002cbdedc5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "35002cbdedc5", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,10-5-23-51-0-43-57-11-45-13-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5666, "first_seen": 1787458755, "last_seen": 1791363085, "transport": "q", "ja3_hash": "3a1446c1ae7a746e042c1aef8a32f9db", "ja3_variant_count": 5343, "ja3_variants": [ "3a1446c1ae7a746e042c1aef8a32f9db", "6b92be722c5d65ba1746d0c7408a7c57", "c6621e6bc205703968acdf8b0cd125a4", "41ad7e2b758c22ba5804e2778ba62ca2", "d7cf9f33073f166f87012703a08e4b29", "ec0f78778e5dc7153f3bca95bc626117", "cea24a9ecf25363dcb78e974f8cd0daf", "1d65c0c61ef0b291ccb987fad4ee94bc", "1bf919c8e7b9b90450520b212c691278", "5068653c3390d5b2f0a392204ad1c664", "88c2747d9e87e9d232ed3a68044cec8d", "e907d4711835bffe019fb6d289cc1dcf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_4a886e84af51", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "4a886e84af51", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,10-51-5-57-16-13-43-0-23-11-45,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1788717951, "last_seen": 1789044907, "transport": "q", "ja3_hash": "068bd8fb8c3e080bf5f6a7caabf0efbe", "ja3_variant_count": 6, "ja3_variants": [ "068bd8fb8c3e080bf5f6a7caabf0efbe", "225310debf2ca53d4f23af55e60f2951", "46723ed1dcb15e7fbc8e6acc7fb1d5c8", "54007567f06b17fb14fba6134dee9705", "3aa56531f857632c86af3152a972833c", "857ad827e3433b7ea28167e0974b8f2f" ], "user_agents": { "h3-get/1.0 (quinn+h3)": 6 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_03c564151835", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "03c564151835", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,5-43-65281-45-28-10-23-13-51-0-16-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789674070, "last_seen": 1790300064, "transport": "q", "ja3_hash": "1197de2e72441bf7ec908d8f42c466aa", "ja3_variant_count": 2, "ja3_variants": [ "1197de2e72441bf7ec908d8f42c466aa", "aff0224d4ace77b6c5c1993fcb890bc9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_0fd97f318465", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "0fd97f318465", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,28-65281-16-10-51-5-0-13-45-43-23-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789674049, "last_seen": 1790349834, "transport": "q", "ja3_hash": "93207077c783dfdfbe153963170e6d79", "ja3_variant_count": 3, "ja3_variants": [ "93207077c783dfdfbe153963170e6d79", "e579eb11278b4894a1394ba782312fe8", "d6a4ed24d31cba773ca817911a518405" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_21ef1e544c18", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "21ef1e544c18", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,13-43-10-51-16-23-5-45-28-0-65281-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789674027, "last_seen": 1789674027, "transport": "q", "ja3_hash": "5e134a8abae98b9ed57ae35c0c90b51b", "ja3_variant_count": 1, "ja3_variants": [ "5e134a8abae98b9ed57ae35c0c90b51b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_27837c2d4944", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "27837c2d4944", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65281-28-43-51-45-23-13-10-0-16-5-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790288663, "last_seen": 1790294653, "transport": "q", "ja3_hash": "ea866d3d4e1e889a29e5ea5cbb08b8d6", "ja3_variant_count": 2, "ja3_variants": [ "ea866d3d4e1e889a29e5ea5cbb08b8d6", "5c9a493d3b11fce55406be3eb5cdbe6e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_2d951b6ea5f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "2d951b6ea5f3", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,0-23-28-43-13-5-65281-45-51-10-16-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790349824, "last_seen": 1790367158, "transport": "q", "ja3_hash": "648cadd4a202b03ec3049b4b05000941", "ja3_variant_count": 2, "ja3_variants": [ "648cadd4a202b03ec3049b4b05000941", "d0be6a312afef2934fe14b8082ac8a74" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_2fbbe4786686", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "2fbbe4786686", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,13-16-43-28-10-23-0-45-51-65281-5-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789674064, "last_seen": 1789674064, "transport": "q", "ja3_hash": "b105e3296f6e7058ad7da27e483dcfea", "ja3_variant_count": 1, "ja3_variants": [ "b105e3296f6e7058ad7da27e483dcfea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_5063bf5cc8ea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "5063bf5cc8ea", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,28-65281-23-51-16-10-43-45-5-13-0-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789674039, "last_seen": 1790349872, "transport": "q", "ja3_hash": "e9c165be96586d1f3c2e5bc7f5a9fd79", "ja3_variant_count": 2, "ja3_variants": [ "e9c165be96586d1f3c2e5bc7f5a9fd79", "99ad4ef59c107ae280836671e22b652e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_5c0a0aff5045", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "5c0a0aff5045", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,10-28-0-43-13-65281-45-51-23-5-16-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789674038, "last_seen": 1789674038, "transport": "q", "ja3_hash": "239ab21396136149bbef6b24763f8beb", "ja3_variant_count": 1, "ja3_variants": [ "239ab21396136149bbef6b24763f8beb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_8b6db2415206", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "8b6db2415206", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,45-13-5-23-43-16-28-51-0-65281-10-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790288647, "last_seen": 1790288663, "transport": "q", "ja3_hash": "c6d11673f4009e894cf76ba04859af38", "ja3_variant_count": 2, "ja3_variants": [ "c6d11673f4009e894cf76ba04859af38", "e2d60caad926fa2c7d2c5fe2e293fd8d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_90e3597f60ba", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "90e3597f60ba", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65281-13-43-51-45-5-28-0-16-23-10-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790349902, "last_seen": 1790349902, "transport": "q", "ja3_hash": "a0483e25bac70248acef1efaf9c7b1a8", "ja3_variant_count": 1, "ja3_variants": [ "a0483e25bac70248acef1efaf9c7b1a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_a38b4de7fff3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "a38b4de7fff3", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65281-13-5-0-16-43-51-45-23-10-28-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790349857, "last_seen": 1790349857, "transport": "q", "ja3_hash": "485edd46a1ca592e4c16c87a24fb3b61", "ja3_variant_count": 1, "ja3_variants": [ "485edd46a1ca592e4c16c87a24fb3b61" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_d3a2dad44cbf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "d3a2dad44cbf", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,10-11-27-13-43-16-23-51-57-5-0-45,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 32, "first_seen": 1789951993, "last_seen": 1790385505, "transport": "q", "ja3_hash": "6a81215e1959c32e336ae6b7a8281046", "ja3_variant_count": 32, "ja3_variants": [ "6a81215e1959c32e336ae6b7a8281046", "9936a9bc663c474f4e5ebd22e7b43099", "277020967b8543e08aaf2fff920edc7a", "110143432547bffb3b094bc2a8c10fc9", "ae82dda5e5ad9de58590f1f2ee1c68bb", "45759514b3ce742a1aaad34b063d3012", "91f334d9149a1e9c87f218bd57e17f44", "0dee565974ecaec9b0ed696db30831fc", "61c46097cadcf49d7fd5dd4632132325", "36302c8b0236d269471d29a28d5aea8c", "fd98edba197108c5c0b2e4f684431cbd", "1c52241243970c01b2fef7c2a5ba8390" ], "user_agents": { "h3-get/1.0 (quinn+h3)": 32 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_05ac6ee4b39d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "05ac6ee4b39d", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,23-45-51-10-0-28-65281-16-5-43-13-57-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790294653, "last_seen": 1790294653, "transport": "q", "ja3_hash": "4bb3653536d00a5dad4906e75a00af35", "ja3_variant_count": 1, "ja3_variants": [ "4bb3653536d00a5dad4906e75a00af35" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_15858df9eda6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "15858df9eda6", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65281-5-51-10-43-13-23-45-0-16-28-57-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790349833, "last_seen": 1790349833, "transport": "q", "ja3_hash": "55c2f4da1db2149e4eac17597f93cf3c", "ja3_variant_count": 1, "ja3_variants": [ "55c2f4da1db2149e4eac17597f93cf3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_1ee649ece617", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "1ee649ece617", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,10-16-23-28-5-65281-43-13-0-45-51-57-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790349854, "last_seen": 1790349854, "transport": "q", "ja3_hash": "a97ca6f6f0a8c272880071a03b090c01", "ja3_variant_count": 1, "ja3_variants": [ "a97ca6f6f0a8c272880071a03b090c01" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_2866647f30db", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "2866647f30db", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,13-28-16-45-23-65281-51-10-0-5-43-57-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790349824, "last_seen": 1790349824, "transport": "q", "ja3_hash": "b98158b26d985e663930de488833b115", "ja3_variant_count": 1, "ja3_variants": [ "b98158b26d985e663930de488833b115" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_e696ffb75528", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "e696ffb75528", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65281-0-10-43-16-5-28-23-45-13-51-57-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790300065, "last_seen": 1790300065, "transport": "q", "ja3_hash": "8beeda5971fcecab3bbe3cb68407990d", "ja3_variant_count": 1, "ja3_variants": [ "8beeda5971fcecab3bbe3cb68407990d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_f1114453dc22", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "f1114453dc22", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,16-0-10-28-45-43-65281-23-13-5-51-57-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790367157, "last_seen": 1790367157, "transport": "q", "ja3_hash": "09aeef0d88de18c77154c12f2c6ef4c0", "ja3_variant_count": 1, "ja3_variants": [ "09aeef0d88de18c77154c12f2c6ef4c0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_52fae87ca051", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "52fae87ca051", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4867-4865-4866,0-11-35-65281-23-18-57-5-10-13-16-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789471619, "last_seen": 1789471619, "transport": "q", "ja3_hash": "9dae6088474d3b70e1c2f8eb6f036ba7", "ja3_variant_count": 1, "ja3_variants": [ "9dae6088474d3b70e1c2f8eb6f036ba7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_badd17c5ef14", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "badd17c5ef14", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,0-23-65281-10-16-5-34-51-43-13-45-28-57-41,29-23-24-25-256-257-258-259-260,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790583421, "last_seen": 1790583421, "transport": "q", "ja3_hash": "7faeb639939181044663114099ee6e23", "ja3_variant_count": 1, "ja3_variants": [ "7faeb639939181044663114099ee6e23" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_fb190d169104", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "fb190d169104", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-11-35-65281-23-18-57-5-10-13-50-16-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789074984, "last_seen": 1791198271, "transport": "q", "ja3_hash": "ab76c5da7688915188a5547503fae3a4", "ja3_variant_count": 4, "ja3_variants": [ "ab76c5da7688915188a5547503fae3a4", "2026c5ee1b361ad2ae5536798534fe38", "07b61405e69e6fe08ae2722d1eaa7c43", "8cb56fbe608a7f5a9f6907c97e703460" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0316h3_55b375c5d22e_df815552bcbf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0316h3", "b": "55b375c5d22e", "c": "df815552bcbf", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-11-35-65281-23-18-57-5-10-13-50-16-43-51-45-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789428277, "last_seen": 1791125743, "transport": "q", "ja3_hash": "fbfbd525a91f9623491c8705a730cc3a", "ja3_variant_count": 2, "ja3_variants": [ "fbfbd525a91f9623491c8705a730cc3a", "4f2d1d0345558f14b8f7af32f1fbc0aa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0412h3_16476d049b0b_a05e41356250", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0412h3", "b": "16476d049b0b", "c": "a05e41356250", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-35-16-22-23-13-43-45-51-57,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 22, "first_seen": 1787848418, "last_seen": 1791202888, "transport": "q", "ja3_hash": "f16c52428297f68b25d61e4736136bfd", "ja3_variant_count": 1, "ja3_variants": [ "f16c52428297f68b25d61e4736136bfd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "q13d0412h3_16476d049b0b_c8eb0bfd45bb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "q13d0412h3", "b": "16476d049b0b", "c": "c8eb0bfd45bb", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-16-22-23-49-13-43-45-51-57,4588-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791303682, "last_seen": 1791303682, "transport": "q", "ja3_hash": "41814eaf713dc2164d71c89482828115", "ja3_variant_count": 1, "ja3_variants": [ "41814eaf713dc2164d71c89482828115" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t00d1410h2_45de795eb070_4a1f08c76dc1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t00d1410h2", "b": "45de795eb070", "c": "4a1f08c76dc1", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "server name sent", "cipher_count": 14, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-47-53-10,65281-0-5-10-11-13-35-16-43-51,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509866, "last_seen": 1791290845, "transport": "t", "ja3_hash": "67396c305af5e84832bb07769a12f207", "ja3_variant_count": 1, "ja3_variants": [ "67396c305af5e84832bb07769a12f207" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t00d1610h2_46e7e9700bed_34c01d0633e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t00d1610h2", "b": "46e7e9700bed", "c": "34c01d0633e5", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-5-10-11-13-35-16-43-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 168, "first_seen": 1787509864, "last_seen": 1791290844, "transport": "t", "ja3_hash": "83e21bd49603155f1719db1dea0c5b08", "ja3_variant_count": 1, "ja3_variants": [ "83e21bd49603155f1719db1dea0c5b08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t00d310700_e8f1e7e78f70_285959464749", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t00d310700", "b": "e8f1e7e78f70", "c": "285959464749", "properties": { "transport": "TCP", "tls_version": "unknown (00)", "sni": "server name sent", "cipher_count": 31, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-4866-4867-4865-61-60-53-47-255,0-10-11-13-35-43-51,29-23-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509858, "last_seen": 1791290846, "transport": "t", "ja3_hash": "d6c8d13a0de5ede7a96e587c0b79f76e", "ja3_variant_count": 1, "ja3_variants": [ "d6c8d13a0de5ede7a96e587c0b79f76e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_0c65036c8509_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "0c65036c8509", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,58-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703176, "transport": "t", "ja3_hash": "dbb5e49d5f0b4ec420015c0b929ddf55", "ja3_variant_count": 1, "ja3_variants": [ "dbb5e49d5f0b4ec420015c0b929ddf55" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_0f5bc959ae24_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "0f5bc959ae24", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,108-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703174, "transport": "t", "ja3_hash": "88fd03a54ca4b67d36544818782c71a0", "ja3_variant_count": 1, "ja3_variants": [ "88fd03a54ca4b67d36544818782c71a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_0fb537d8e144_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "0fb537d8e144", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,103-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703173, "transport": "t", "ja3_hash": "c024761f33cab17b6029cbb4dbf3d4b6", "ja3_variant_count": 1, "ja3_variants": [ "c024761f33cab17b6029cbb4dbf3d4b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_1275cc1ca538_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "1275cc1ca538", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,3-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703174, "transport": "t", "ja3_hash": "7052beb8f24998e7d758fbc84cd8bdec", "ja3_variant_count": 1, "ja3_variants": [ "7052beb8f24998e7d758fbc84cd8bdec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_14422b46a244_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "14422b46a244", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,9-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703174, "transport": "t", "ja3_hash": "f83fabb33790db4723420f62f6639704", "ja3_variant_count": 1, "ja3_variants": [ "f83fabb33790db4723420f62f6639704" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_185cab9fea21_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "185cab9fea21", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,1-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703175, "transport": "t", "ja3_hash": "9798429e1639e73604c908855db75538", "ja3_variant_count": 1, "ja3_variants": [ "9798429e1639e73604c908855db75538" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_1c0a52334b2c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "1c0a52334b2c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,48-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703174, "transport": "t", "ja3_hash": "689cf81f981f31f440fd4a25b42f4759", "ja3_variant_count": 1, "ja3_variants": [ "689cf81f981f31f440fd4a25b42f4759" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_1c131e13d449_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "1c131e13d449", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,15-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703178, "transport": "t", "ja3_hash": "bad50a2359e4908f9334d9925b612b52", "ja3_variant_count": 1, "ja3_variants": [ "bad50a2359e4908f9334d9925b612b52" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_1f3ccb6b5971_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "1f3ccb6b5971", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,62-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703172, "transport": "t", "ja3_hash": "2d5f0882658b0390c5d96df92e5cac5e", "ja3_variant_count": 1, "ja3_variants": [ "2d5f0882658b0390c5d96df92e5cac5e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_224f5cbaaa26_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "224f5cbaaa26", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,61-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703174, "transport": "t", "ja3_hash": "88c546be8f00dd9d881d4abcf88b518a", "ja3_variant_count": 1, "ja3_variants": [ "88c546be8f00dd9d881d4abcf88b518a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_23061ef215d6_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "23061ef215d6", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,137-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825517, "last_seen": 1790703172, "transport": "t", "ja3_hash": "5f52ecd43bf0cc9d5fccfc16819f8cc0", "ja3_variant_count": 1, "ja3_variants": [ "5f52ecd43bf0cc9d5fccfc16819f8cc0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_23358192d48b_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "23358192d48b", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,106-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703175, "transport": "t", "ja3_hash": "850e42ecb25c6856d92f0a30a82231ba", "ja3_variant_count": 1, "ja3_variants": [ "850e42ecb25c6856d92f0a30a82231ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_2858a708d91c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "2858a708d91c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703175, "transport": "t", "ja3_hash": "d45db1e555e664b28c3a3900fd04aed9", "ja3_variant_count": 1, "ja3_variants": [ "d45db1e555e664b28c3a3900fd04aed9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_2c202acb5b0d_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "2c202acb5b0d", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,154-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703174, "transport": "t", "ja3_hash": "efbca12efb0f5826516e44c42de90a8d", "ja3_variant_count": 1, "ja3_variants": [ "efbca12efb0f5826516e44c42de90a8d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_2de5af831e68_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "2de5af831e68", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,65-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703176, "transport": "t", "ja3_hash": "60eb856690358aa6f94938cf8995adf2", "ja3_variant_count": 1, "ja3_variants": [ "60eb856690358aa6f94938cf8995adf2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_30605b3abcde_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "30605b3abcde", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,17-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703173, "transport": "t", "ja3_hash": "8b266a965ae92265903bdfa8c3f29944", "ja3_variant_count": 1, "ja3_variants": [ "8b266a965ae92265903bdfa8c3f29944" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_35db378cb09f_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "35db378cb09f", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,51-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703173, "transport": "t", "ja3_hash": "d28a8101c4338a36818026d638344da9", "ja3_variant_count": 1, "ja3_variants": [ "d28a8101c4338a36818026d638344da9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_375aaf1d63fe_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "375aaf1d63fe", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,162-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703178, "transport": "t", "ja3_hash": "b16d1a41250b90b3be2eb25bf69ac0e7", "ja3_variant_count": 1, "ja3_variants": [ "b16d1a41250b90b3be2eb25bf69ac0e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_3c8714487106_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "3c8714487106", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,16-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703173, "transport": "t", "ja3_hash": "ef1dfc23e0b62a95ddf39f9f35295aa2", "ja3_variant_count": 1, "ja3_variants": [ "ef1dfc23e0b62a95ddf39f9f35295aa2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_3f56bb683bdc_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "3f56bb683bdc", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,20-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703177, "transport": "t", "ja3_hash": "86f3e36086e48a193f9bf6d8b11c2a3e", "ja3_variant_count": 1, "ja3_variants": [ "86f3e36086e48a193f9bf6d8b11c2a3e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_3fede5d533e3_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "3fede5d533e3", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,167-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703174, "transport": "t", "ja3_hash": "b753971a60e3c979a7f44af444f7a5bf", "ja3_variant_count": 1, "ja3_variants": [ "b753971a60e3c979a7f44af444f7a5bf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_437c38fb20d7_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "437c38fb20d7", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,55-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703176, "transport": "t", "ja3_hash": "fdd28255cc4bd40aad30f3a62366b325", "ja3_variant_count": 1, "ja3_variants": [ "fdd28255cc4bd40aad30f3a62366b325" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_462ecd6708d4_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "462ecd6708d4", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,27-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703172, "transport": "t", "ja3_hash": "d1be6a741fe45a95e51cd6b5607a9107", "ja3_variant_count": 1, "ja3_variants": [ "d1be6a741fe45a95e51cd6b5607a9107" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_484ebc7627f0_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "484ebc7627f0", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,56-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703175, "transport": "t", "ja3_hash": "1879512bf003517b407e1989a620490d", "ja3_variant_count": 1, "ja3_variants": [ "1879512bf003517b407e1989a620490d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_4a513bce9f12_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "4a513bce9f12", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,68-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703176, "transport": "t", "ja3_hash": "3c385bd605eb8e2bb8ffe22dddb88353", "ja3_variant_count": 1, "ja3_variants": [ "3c385bd605eb8e2bb8ffe22dddb88353" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_515ebe86e7c3_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "515ebe86e7c3", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703172, "transport": "t", "ja3_hash": "5287a67572f32f7bd389d2afb13ecd1d", "ja3_variant_count": 1, "ja3_variants": [ "5287a67572f32f7bd389d2afb13ecd1d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_5470a87bf7fc_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "5470a87bf7fc", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,164-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703175, "transport": "t", "ja3_hash": "fbf678f3b3e2f383f7478481e12d8439", "ja3_variant_count": 1, "ja3_variants": [ "fbf678f3b3e2f383f7478481e12d8439" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_57c1461cef57_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "57c1461cef57", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,161-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703175, "transport": "t", "ja3_hash": "38d90b1af937f98a23fdc4c066274210", "ja3_variant_count": 1, "ja3_variants": [ "38d90b1af937f98a23fdc4c066274210" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_593aba79ccba_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "593aba79ccba", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,18-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703174, "transport": "t", "ja3_hash": "e622cd02200f7eca34d42d20dfbfae98", "ja3_variant_count": 1, "ja3_variants": [ "e622cd02200f7eca34d42d20dfbfae98" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_5bb0eb0ba27c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "5bb0eb0ba27c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,159-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703175, "transport": "t", "ja3_hash": "4b0b89161f20552ab7ddb64c5bb64656", "ja3_variant_count": 1, "ja3_variants": [ "4b0b89161f20552ab7ddb64c5bb64656" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_6376cb8fadaa_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "6376cb8fadaa", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,57-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703177, "transport": "t", "ja3_hash": "4dd7882fe610d6272493ea3c1e0a97b5", "ja3_variant_count": 1, "ja3_variants": [ "4dd7882fe610d6272493ea3c1e0a97b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_671e0306a5cb_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "671e0306a5cb", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,19-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1787825508, "last_seen": 1788877098, "transport": "t", "ja3_hash": "f7e6ecbf3a2de96d1f1efffa0e71a5ac", "ja3_variant_count": 1, "ja3_variants": [ "f7e6ecbf3a2de96d1f1efffa0e71a5ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_69d181a99895_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "69d181a99895", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,152-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703177, "transport": "t", "ja3_hash": "287fdff6400f043c055048c289c3b8f7", "ja3_variant_count": 1, "ja3_variants": [ "287fdff6400f043c055048c289c3b8f7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_69d68bc28b42_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "69d68bc28b42", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,59-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703174, "transport": "t", "ja3_hash": "f7dbf74e48adeb303bd3987bd3a7b513", "ja3_variant_count": 1, "ja3_variants": [ "f7dbf74e48adeb303bd3987bd3a7b513" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_6d6b3751bd69_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "6d6b3751bd69", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,153-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703177, "transport": "t", "ja3_hash": "6b98eb99d5371121061a2e2bbd47ce4d", "ja3_variant_count": 1, "ja3_variants": [ "6b98eb99d5371121061a2e2bbd47ce4d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_72fe80e83b5d_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "72fe80e83b5d", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,13-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703171, "transport": "t", "ja3_hash": "9e3b1ffb36b835ba2898427a71484fab", "ja3_variant_count": 1, "ja3_variants": [ "9e3b1ffb36b835ba2898427a71484fab" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_798dd72d0aaa_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "798dd72d0aaa", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,156-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703174, "transport": "t", "ja3_hash": "43da1875ea8f38b926478566262bf2f8", "ja3_variant_count": 1, "ja3_variants": [ "43da1875ea8f38b926478566262bf2f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_7ba938555a01_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "7ba938555a01", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,25-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703174, "transport": "t", "ja3_hash": "4f370bd8182a102bb610bce201c278f3", "ja3_variant_count": 1, "ja3_variants": [ "4f370bd8182a102bb610bce201c278f3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_85064055552b_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "85064055552b", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,151-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703173, "transport": "t", "ja3_hash": "b4966046a927978e5759d0a49c9df4d8", "ja3_variant_count": 1, "ja3_variants": [ "b4966046a927978e5759d0a49c9df4d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_86ae22adfd52_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "86ae22adfd52", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,52-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703175, "transport": "t", "ja3_hash": "a27310ee12a0b9be693acaa32679bcc8", "ja3_variant_count": 1, "ja3_variants": [ "a27310ee12a0b9be693acaa32679bcc8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_8764e5090277_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "8764e5090277", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,135-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703175, "transport": "t", "ja3_hash": "c75bc38ad8b853d36d382665b5c416ce", "ja3_variant_count": 1, "ja3_variants": [ "c75bc38ad8b853d36d382665b5c416ce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_8cde4933ab6b_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "8cde4933ab6b", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,26-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703171, "transport": "t", "ja3_hash": "d80826d3b55b8202d9216d9fdf6f51ce", "ja3_variant_count": 1, "ja3_variants": [ "d80826d3b55b8202d9216d9fdf6f51ce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_8d2fb8454607_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "8d2fb8454607", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,70-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703174, "transport": "t", "ja3_hash": "b03cf1a5e6d1382d85c3970d5461830f", "ja3_variant_count": 1, "ja3_variants": [ "b03cf1a5e6d1382d85c3970d5461830f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_9cb11800989c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "9cb11800989c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,155-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703176, "transport": "t", "ja3_hash": "4fe7ade1aca7106b5210602afb27fb05", "ja3_variant_count": 1, "ja3_variants": [ "4fe7ade1aca7106b5210602afb27fb05" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_9d31ef4cc8d3_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "9d31ef4cc8d3", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,63-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703175, "transport": "t", "ja3_hash": "aa45772c2fb13a67c3df862f655b0e06", "ja3_variant_count": 1, "ja3_variants": [ "aa45772c2fb13a67c3df862f655b0e06" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a047181052cf_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a047181052cf", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,157-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703174, "transport": "t", "ja3_hash": "18ecbeac768a2d9b81f14430ece82f66", "ja3_variant_count": 1, "ja3_variants": [ "18ecbeac768a2d9b81f14430ece82f66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a0f473027383_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a0f473027383", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,2-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703172, "transport": "t", "ja3_hash": "b2fe92249ad5e66e89a0209e559da621", "ja3_variant_count": 1, "ja3_variants": [ "b2fe92249ad5e66e89a0209e559da621" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a146388b8b2c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a146388b8b2c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,64-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703175, "transport": "t", "ja3_hash": "d2e5be33b50a592bdb71ddf365e281f5", "ja3_variant_count": 1, "ja3_variants": [ "d2e5be33b50a592bdb71ddf365e281f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a25efb179806_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a25efb179806", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,158-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703172, "transport": "t", "ja3_hash": "502e6ebf9a83f2271ab1d4091062f6fd", "ja3_variant_count": 1, "ja3_variants": [ "502e6ebf9a83f2271ab1d4091062f6fd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a5878986a7c9_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a5878986a7c9", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,47-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703175, "transport": "t", "ja3_hash": "4d94c8ba390c333eddcaf438b4db10f4", "ja3_variant_count": 1, "ja3_variants": [ "4d94c8ba390c333eddcaf438b4db10f4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_a8d286a27066_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "a8d286a27066", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,23-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703174, "transport": "t", "ja3_hash": "a8feae49ee6281b9c2580502f948d9e2", "ja3_variant_count": 1, "ja3_variants": [ "a8feae49ee6281b9c2580502f948d9e2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_af3458fd17af_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "af3458fd17af", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,160-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703175, "transport": "t", "ja3_hash": "e3937fc47bd5b5a21850e3214775c7f9", "ja3_variant_count": 1, "ja3_variants": [ "e3937fc47bd5b5a21850e3214775c7f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_b0ed54973b0f_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "b0ed54973b0f", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,50-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703172, "transport": "t", "ja3_hash": "b96e79496d80fd04c55dfa3ec20e9969", "ja3_variant_count": 1, "ja3_variants": [ "b96e79496d80fd04c55dfa3ec20e9969" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_bae431c474f8_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "bae431c474f8", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,66-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703175, "transport": "t", "ja3_hash": "63609c6be82c6a50ce90312af834dd2c", "ja3_variant_count": 1, "ja3_variants": [ "63609c6be82c6a50ce90312af834dd2c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_c259c416e32c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "c259c416e32c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,12-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703176, "transport": "t", "ja3_hash": "c02eff9dd2e6e6d8aaaa120ac9e9d55c", "ja3_variant_count": 1, "ja3_variants": [ "c02eff9dd2e6e6d8aaaa120ac9e9d55c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_c3df0a865ad8_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "c3df0a865ad8", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,150-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703178, "transport": "t", "ja3_hash": "168eb90a848dc57608565ed62b0c704b", "ja3_variant_count": 1, "ja3_variants": [ "168eb90a848dc57608565ed62b0c704b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_c6933f2ed6ed_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "c6933f2ed6ed", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,107-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825516, "last_seen": 1790703172, "transport": "t", "ja3_hash": "5151d22d3333d48bcb204f8775bed4fd", "ja3_variant_count": 1, "ja3_variants": [ "5151d22d3333d48bcb204f8775bed4fd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_c9fe23a5d87c_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "c9fe23a5d87c", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,67-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703175, "transport": "t", "ja3_hash": "1f576eca6e82ff7dfc542e00367e74d8", "ja3_variant_count": 1, "ja3_variants": [ "1f576eca6e82ff7dfc542e00367e74d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_cfa6b5cae2b1_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "cfa6b5cae2b1", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,105-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703177, "transport": "t", "ja3_hash": "ae33eda3e0a3d80c9f30dcc6e862b287", "ja3_variant_count": 1, "ja3_variants": [ "ae33eda3e0a3d80c9f30dcc6e862b287" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_d25758f9cc88_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "d25758f9cc88", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,24-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703171, "transport": "t", "ja3_hash": "841435cc9e9f75ff9eef5b18f8da2253", "ja3_variant_count": 1, "ja3_variants": [ "841435cc9e9f75ff9eef5b18f8da2253" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_d30dd38cd76f_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "d30dd38cd76f", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,60-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703174, "transport": "t", "ja3_hash": "b106a5f2af0b7063305f94908cc38d73", "ja3_variant_count": 1, "ja3_variants": [ "b106a5f2af0b7063305f94908cc38d73" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_d83d06a7b5eb_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "d83d06a7b5eb", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,134-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703174, "transport": "t", "ja3_hash": "7aece20cd7373396270ee8f994de9053", "ja3_variant_count": 1, "ja3_variants": [ "7aece20cd7373396270ee8f994de9053" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_d99cf322fdea_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "d99cf322fdea", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,133-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703172, "transport": "t", "ja3_hash": "712d80a66eec8ceed7ccbe7d34bbd998", "ja3_variant_count": 1, "ja3_variants": [ "712d80a66eec8ceed7ccbe7d34bbd998" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_da5e85b893fc_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "da5e85b893fc", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,10-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703176, "transport": "t", "ja3_hash": "a10c9f69df03cc1ddf32eecbf859cafd", "ja3_variant_count": 1, "ja3_variants": [ "a10c9f69df03cc1ddf32eecbf859cafd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_e03107c9d76e_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "e03107c9d76e", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,5-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703177, "transport": "t", "ja3_hash": "6c4102c083d186ffae0aa91e5a5cb84a", "ja3_variant_count": 1, "ja3_variants": [ "6c4102c083d186ffae0aa91e5a5cb84a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_e530588400b6_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "e530588400b6", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,132-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703175, "transport": "t", "ja3_hash": "2135383dc01528c4206edd5ae908141a", "ja3_variant_count": 1, "ja3_variants": [ "2135383dc01528c4206edd5ae908141a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_e93a3df64476_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "e93a3df64476", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,165-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703174, "transport": "t", "ja3_hash": "a0491407cdb6d4377aa724fd8a0073bb", "ja3_variant_count": 1, "ja3_variants": [ "a0491407cdb6d4377aa724fd8a0073bb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_ea1f27bcdcc2_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "ea1f27bcdcc2", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,136-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703175, "transport": "t", "ja3_hash": "789d8f82ee375bfcf064e2d3e4501e29", "ja3_variant_count": 1, "ja3_variants": [ "789d8f82ee375bfcf064e2d3e4501e29" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_ed19d00bad77_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "ed19d00bad77", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,21-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703176, "transport": "t", "ja3_hash": "11294effe7c5c53ab09d829fdfa420e8", "ja3_variant_count": 1, "ja3_variants": [ "11294effe7c5c53ab09d829fdfa420e8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_ee2968deacb9_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "ee2968deacb9", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,109-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703176, "transport": "t", "ja3_hash": "7ad55b8beb1ddd0fca8b689ac29f3ab1", "ja3_variant_count": 1, "ja3_variants": [ "7ad55b8beb1ddd0fca8b689ac29f3ab1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_eea8af79bad9_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "eea8af79bad9", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,69-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703176, "transport": "t", "ja3_hash": "8079dce8093e68028004ea8e9496e575", "ja3_variant_count": 1, "ja3_variants": [ "8079dce8093e68028004ea8e9496e575" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_f2d8273d9564_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "f2d8273d9564", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,53-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703174, "transport": "t", "ja3_hash": "762b4d00c25395bfd6a2c28f91895201", "ja3_variant_count": 1, "ja3_variants": [ "762b4d00c25395bfd6a2c28f91895201" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_f37a1d878fe1_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "f37a1d878fe1", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,163-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703176, "transport": "t", "ja3_hash": "7c60c7d4909345fdd0c116463fae09a4", "ja3_variant_count": 1, "ja3_variants": [ "7c60c7d4909345fdd0c116463fae09a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_f4b95c39a23e_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "f4b95c39a23e", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,6-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703174, "transport": "t", "ja3_hash": "74317fd8b68f306c581dfbdb67381dfc", "ja3_variant_count": 1, "ja3_variants": [ "74317fd8b68f306c581dfbdb67381dfc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_fa20206d2144_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "fa20206d2144", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,7-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703175, "transport": "t", "ja3_hash": "e9b073ec3a2cd8edf25a2d27cf2adc47", "ja3_variant_count": 1, "ja3_variants": [ "e9b073ec3a2cd8edf25a2d27cf2adc47" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_fb1e6c9f8d32_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "fb1e6c9f8d32", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,104-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703174, "transport": "t", "ja3_hash": "6a856656b0a825504d48120ecc51d565", "ja3_variant_count": 1, "ja3_variants": [ "6a856656b0a825504d48120ecc51d565" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_fb765c19c5ff_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "fb765c19c5ff", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,166-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703177, "transport": "t", "ja3_hash": "6169d31cbf720d41b5cd5b51e733aa3c", "ja3_variant_count": 1, "ja3_variants": [ "6169d31cbf720d41b5cd5b51e733aa3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_fbc32bd69299_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "fbc32bd69299", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,8-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703172, "transport": "t", "ja3_hash": "7863a4b7e53f72a3cb1c2c04c0eb8da0", "ja3_variant_count": 1, "ja3_variants": [ "7863a4b7e53f72a3cb1c2c04c0eb8da0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020400_fd2d85721aa5_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020400", "b": "fd2d85721aa5", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 4, "alpn": null } }, "ja3_string": "771,54-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703174, "transport": "t", "ja3_hash": "94755c3e6b7309af2623107f01e97047", "ja3_variant_count": 1, "ja3_variants": [ "94755c3e6b7309af2623107f01e97047" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_017f96aa3752_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "017f96aa3752", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,190-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703177, "transport": "t", "ja3_hash": "06e3b5be4842e2b32e52b9897ce3dabb", "ja3_variant_count": 1, "ja3_variants": [ "06e3b5be4842e2b32e52b9897ce3dabb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_1846c2936b89_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "1846c2936b89", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49238-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703172, "transport": "t", "ja3_hash": "0c513d31f77685e28648f01ab4f0fee0", "ja3_variant_count": 1, "ja3_variants": [ "0c513d31f77685e28648f01ab4f0fee0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_20953c10fd1e_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "20953c10fd1e", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49308-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703176, "transport": "t", "ja3_hash": "0e77fd66725eb9942fd4cf0dfb997afd", "ja3_variant_count": 1, "ja3_variants": [ "0e77fd66725eb9942fd4cf0dfb997afd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_257973278e6d_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "257973278e6d", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,195-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703173, "transport": "t", "ja3_hash": "60222250ac0a849c745bfd24d56ad246", "ja3_variant_count": 1, "ja3_variants": [ "60222250ac0a849c745bfd24d56ad246" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_2901e63b1132_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "2901e63b1132", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49234-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703174, "transport": "t", "ja3_hash": "e44f47710ef14fad994a5131ab2cbd7d", "ja3_variant_count": 1, "ja3_variants": [ "e44f47710ef14fad994a5131ab2cbd7d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_311fb8e5b694_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "311fb8e5b694", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49239-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703176, "transport": "t", "ja3_hash": "a3a1228246b0e4623d78b3ea12ebc084", "ja3_variant_count": 1, "ja3_variants": [ "a3a1228246b0e4623d78b3ea12ebc084" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_3d40e48a2282_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "3d40e48a2282", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,52394-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703174, "transport": "t", "ja3_hash": "3698e747925284c16566276949837449", "ja3_variant_count": 1, "ja3_variants": [ "3698e747925284c16566276949837449" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_3f35d2254949_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "3f35d2254949", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,186-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703176, "transport": "t", "ja3_hash": "eaa812c4822096b7be4717f668f74f27", "ja3_variant_count": 1, "ja3_variants": [ "eaa812c4822096b7be4717f668f74f27" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_40046a45f286_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "40046a45f286", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49232-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703177, "transport": "t", "ja3_hash": "e8174c448ea3017edc171bc6b69e5522", "ja3_variant_count": 1, "ja3_variants": [ "e8174c448ea3017edc171bc6b69e5522" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_532f5318fa2e_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "532f5318fa2e", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,192-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703172, "transport": "t", "ja3_hash": "8dc48039b62da5baa61e1c647776730c", "ja3_variant_count": 1, "ja3_variants": [ "8dc48039b62da5baa61e1c647776730c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_5550d68fda30_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "5550d68fda30", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49312-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703174, "transport": "t", "ja3_hash": "914f0d9aa871bdbac9a7ddef780059d8", "ja3_variant_count": 1, "ja3_variants": [ "914f0d9aa871bdbac9a7ddef780059d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_5e7453b33de5_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "5e7453b33de5", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49235-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703173, "transport": "t", "ja3_hash": "ba5df0763cea3b05862dc45b1c3da77c", "ja3_variant_count": 1, "ja3_variants": [ "ba5df0763cea3b05862dc45b1c3da77c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_671e0306a5cb_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "671e0306a5cb", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,19-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789615164, "last_seen": 1790703172, "transport": "t", "ja3_hash": "fe66b478e7814483fd0129c7b08024af", "ja3_variant_count": 1, "ja3_variants": [ "fe66b478e7814483fd0129c7b08024af" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_69403f293a54_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "69403f293a54", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49233-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703173, "transport": "t", "ja3_hash": "451de572098740e5fc35b2048527d926", "ja3_variant_count": 1, "ja3_variants": [ "451de572098740e5fc35b2048527d926" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_8c8995b733ef_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "8c8995b733ef", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,196-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703172, "transport": "t", "ja3_hash": "a00a2beb3bcff07667f12b00083d38c7", "ja3_variant_count": 1, "ja3_variants": [ "a00a2beb3bcff07667f12b00083d38c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_9757046a497d_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "9757046a497d", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49313-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703174, "transport": "t", "ja3_hash": "4b894279286bf5b41b3161dc42636a4a", "ja3_variant_count": 1, "ja3_variants": [ "4b894279286bf5b41b3161dc42636a4a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_a7802ed2ba9f_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "a7802ed2ba9f", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49310-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703174, "transport": "t", "ja3_hash": "41a392d845b2c693ab438b7e0c15b9cc", "ja3_variant_count": 1, "ja3_variants": [ "41a392d845b2c693ab438b7e0c15b9cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_aaba3a77cce3_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "aaba3a77cce3", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49309-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703172, "transport": "t", "ja3_hash": "95fe83a19f2469a57aab48fc19c642a3", "ja3_variant_count": 1, "ja3_variants": [ "95fe83a19f2469a57aab48fc19c642a3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_c38774e7e0a0_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "c38774e7e0a0", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,22-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703177, "transport": "t", "ja3_hash": "6877dad7222e89abed8053346b4cd66b", "ja3_variant_count": 1, "ja3_variants": [ "6877dad7222e89abed8053346b4cd66b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_c94d2e240461_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "c94d2e240461", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,189-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703173, "transport": "t", "ja3_hash": "e657fea248dc7da78b812a5066f180c5", "ja3_variant_count": 1, "ja3_variants": [ "e657fea248dc7da78b812a5066f180c5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_dab6fbdff9f8_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "dab6fbdff9f8", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49314-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703172, "transport": "t", "ja3_hash": "91e46b8cf9bbfda5dfaf09bcd6881e8b", "ja3_variant_count": 1, "ja3_variants": [ "91e46b8cf9bbfda5dfaf09bcd6881e8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_efbfc930fd96_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "efbfc930fd96", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49315-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703172, "transport": "t", "ja3_hash": "43650aeef15076a3794caf47f963d130", "ja3_variant_count": 1, "ja3_variants": [ "43650aeef15076a3794caf47f963d130" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020500_f290bf0ab7b3_fb388e60c1a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020500", "b": "f290bf0ab7b3", "c": "fb388e60c1a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49311-255,0-35-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703173, "transport": "t", "ja3_hash": "a9f3223d1a7fe25b59d3bcbb50ac39b3", "ja3_variant_count": 1, "ja3_variants": [ "a9f3223d1a7fe25b59d3bcbb50ac39b3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_049d0968ef63_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "049d0968ef63", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49174-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703176, "transport": "t", "ja3_hash": "bc1d05488e0e311cb40a9cf17ffa0442", "ja3_variant_count": 1, "ja3_variants": [ "bc1d05488e0e311cb40a9cf17ffa0442" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_04f72be57293_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "04f72be57293", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49192-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703173, "transport": "t", "ja3_hash": "fc8edd01a759d91828b7fd7aee89e8c2", "ja3_variant_count": 1, "ja3_variants": [ "fc8edd01a759d91828b7fd7aee89e8c2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_0c0b01a5a80b_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "0c0b01a5a80b", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49193-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703173, "transport": "t", "ja3_hash": "c5dfe1ba06264ac2c19ecbfeb92420c9", "ja3_variant_count": 1, "ja3_variants": [ "c5dfe1ba06264ac2c19ecbfeb92420c9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_0d62a58dd912_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "0d62a58dd912", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49169-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703175, "transport": "t", "ja3_hash": "2a68e0edfb75449f012a41c40ab5a0f8", "ja3_variant_count": 1, "ja3_variants": [ "2a68e0edfb75449f012a41c40ab5a0f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_104943d1f64b_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "104943d1f64b", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49201-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703175, "transport": "t", "ja3_hash": "658111e6d488c28d0b0b571ba4a837fa", "ja3_variant_count": 1, "ja3_variants": [ "658111e6d488c28d0b0b571ba4a837fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_184f2be1a0c6_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "184f2be1a0c6", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49188-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703178, "transport": "t", "ja3_hash": "e5a8bc6555251d6c49ce7fc016bc8eb4", "ja3_variant_count": 1, "ja3_variants": [ "e5a8bc6555251d6c49ce7fc016bc8eb4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_24f557f1cbee_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "24f557f1cbee", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49191-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825504, "last_seen": 1790703171, "transport": "t", "ja3_hash": "b6b5e59e7cd6ddf7c6fece0dd8f24354", "ja3_variant_count": 1, "ja3_variants": [ "b6b5e59e7cd6ddf7c6fece0dd8f24354" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_2ac205266896_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "2ac205266896", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49173-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703171, "transport": "t", "ja3_hash": "280b33911384875094d7977f8382c88b", "ja3_variant_count": 1, "ja3_variants": [ "280b33911384875094d7977f8382c88b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_46916985df61_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "46916985df61", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49197-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703173, "transport": "t", "ja3_hash": "e7bad90c173a5eb0c656e487d20baa59", "ja3_variant_count": 1, "ja3_variants": [ "e7bad90c173a5eb0c656e487d20baa59" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_48762405b09c_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "48762405b09c", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49157-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703177, "transport": "t", "ja3_hash": "99bfe5bfcb1a6d096c438dcd5b250c32", "ja3_variant_count": 1, "ja3_variants": [ "99bfe5bfcb1a6d096c438dcd5b250c32" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_4eff32302ec7_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "4eff32302ec7", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49160-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703176, "transport": "t", "ja3_hash": "d061301761f8a73208570003415db861", "ja3_variant_count": 1, "ja3_variants": [ "d061301761f8a73208570003415db861" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_4f4bd29a6b59_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "4f4bd29a6b59", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49175-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703174, "transport": "t", "ja3_hash": "bc42f70d4193dbb72cf9d42887bd3fd5", "ja3_variant_count": 1, "ja3_variants": [ "bc42f70d4193dbb72cf9d42887bd3fd5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_53d483789bba_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "53d483789bba", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49198-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703174, "transport": "t", "ja3_hash": "9f4571c40c5de259206a3ebf63609ee2", "ja3_variant_count": 1, "ja3_variants": [ "9f4571c40c5de259206a3ebf63609ee2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_55a2bbf9cbd7_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "55a2bbf9cbd7", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49164-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703175, "transport": "t", "ja3_hash": "2e9854b292ced40a48b86ada2916d674", "ja3_variant_count": 1, "ja3_variants": [ "2e9854b292ced40a48b86ada2916d674" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_57ba72230e7a_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "57ba72230e7a", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49167-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703174, "transport": "t", "ja3_hash": "31c0236f152885b35de23a2ac087d39c", "ja3_variant_count": 1, "ja3_variants": [ "31c0236f152885b35de23a2ac087d39c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_59980b593f60_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "59980b593f60", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49176-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825507, "last_seen": 1790703173, "transport": "t", "ja3_hash": "a81b28d46213657f541046d58df5c5ec", "ja3_variant_count": 1, "ja3_variants": [ "a81b28d46213657f541046d58df5c5ec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_5b44afd80a2d_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "5b44afd80a2d", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49156-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703176, "transport": "t", "ja3_hash": "e3a1d08c5043ab4f583bb149b18c724b", "ja3_variant_count": 1, "ja3_variants": [ "e3a1d08c5043ab4f583bb149b18c724b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_5cd2152a341f_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "5cd2152a341f", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49194-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703176, "transport": "t", "ja3_hash": "4dcc5bffc8fe8bd59da602b0714ecddd", "ja3_variant_count": 1, "ja3_variants": [ "4dcc5bffc8fe8bd59da602b0714ecddd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_68cd44b4e773_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "68cd44b4e773", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49162-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703172, "transport": "t", "ja3_hash": "648c409cd9540d169e844c83cd06d549", "ja3_variant_count": 1, "ja3_variants": [ "648c409cd9540d169e844c83cd06d549" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_6a7d5ebe9983_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "6a7d5ebe9983", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49196-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703175, "transport": "t", "ja3_hash": "7003aedf501808019e07ba2938dff85e", "ja3_variant_count": 1, "ja3_variants": [ "7003aedf501808019e07ba2938dff85e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_6d4732649639_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "6d4732649639", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703177, "transport": "t", "ja3_hash": "abf5878120f4851ef3043565a618edd7", "ja3_variant_count": 1, "ja3_variants": [ "abf5878120f4851ef3043565a618edd7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_7368e9b57fb4_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "7368e9b57fb4", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49202-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703177, "transport": "t", "ja3_hash": "579a8e1fbc38ad41c9229fabb90fbe2f", "ja3_variant_count": 1, "ja3_variants": [ "579a8e1fbc38ad41c9229fabb90fbe2f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_89e01831f9a8_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "89e01831f9a8", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49153-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703175, "transport": "t", "ja3_hash": "7f8c883245e34484e5d8c134a3a2df94", "ja3_variant_count": 1, "ja3_variants": [ "7f8c883245e34484e5d8c134a3a2df94" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_8fc24edd70fe_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "8fc24edd70fe", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49163-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703173, "transport": "t", "ja3_hash": "527a4069ee07fd8a707bcee2392cf3cb", "ja3_variant_count": 1, "ja3_variants": [ "527a4069ee07fd8a707bcee2392cf3cb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_9b38dd297dfe_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "9b38dd297dfe", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49168-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703172, "transport": "t", "ja3_hash": "b5bfca2da44394d6f0398610821763a0", "ja3_variant_count": 1, "ja3_variants": [ "b5bfca2da44394d6f0398610821763a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_a0546e0689fc_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "a0546e0689fc", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49171-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703178, "transport": "t", "ja3_hash": "64e502ecc82eb9bc8b59d3723e2b9a81", "ja3_variant_count": 1, "ja3_variants": [ "64e502ecc82eb9bc8b59d3723e2b9a81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_a89416eb2da9_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "a89416eb2da9", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49177-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703175, "transport": "t", "ja3_hash": "74cdc182738d658059b5090b0b5ea03f", "ja3_variant_count": 1, "ja3_variants": [ "74cdc182738d658059b5090b0b5ea03f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_adebd50f2b51_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "adebd50f2b51", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49187-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703175, "transport": "t", "ja3_hash": "4be6dfd372a51d69dc2e2b86bbc35704", "ja3_variant_count": 1, "ja3_variants": [ "4be6dfd372a51d69dc2e2b86bbc35704" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_b06afd972a5c_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "b06afd972a5c", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49199-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703174, "transport": "t", "ja3_hash": "b7fa245d9cc1c34c7e4eb8876cf2d109", "ja3_variant_count": 1, "ja3_variants": [ "b7fa245d9cc1c34c7e4eb8876cf2d109" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_b2ba452b8222_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "b2ba452b8222", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49189-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703173, "transport": "t", "ja3_hash": "5824fddbf3cdbdc6d3d38cbce524181b", "ja3_variant_count": 1, "ja3_variants": [ "5824fddbf3cdbdc6d3d38cbce524181b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_bad2b1bd13d4_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "bad2b1bd13d4", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49155-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703171, "transport": "t", "ja3_hash": "e24abfecac94f4b14f0790a369c84b28", "ja3_variant_count": 1, "ja3_variants": [ "e24abfecac94f4b14f0790a369c84b28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_c4610a930072_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "c4610a930072", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49159-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825505, "last_seen": 1790703175, "transport": "t", "ja3_hash": "629d38d0a40fb23ec8176402cec1d54d", "ja3_variant_count": 1, "ja3_variants": [ "629d38d0a40fb23ec8176402cec1d54d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_c66b7cee1896_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "c66b7cee1896", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49161-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703172, "transport": "t", "ja3_hash": "eca22c485bf110db00b4d6e9c94451a8", "ja3_variant_count": 1, "ja3_variants": [ "eca22c485bf110db00b4d6e9c94451a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_cc27769a2ea2_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "cc27769a2ea2", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49165-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703176, "transport": "t", "ja3_hash": "4a7e04bcb48c30e0e56e955e0f1ab90c", "ja3_variant_count": 1, "ja3_variants": [ "4a7e04bcb48c30e0e56e955e0f1ab90c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_d0ac5cb1209a_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "d0ac5cb1209a", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49172-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825501, "last_seen": 1790703174, "transport": "t", "ja3_hash": "3aa22bcfc3bd391bba712d23d3ea3ffb", "ja3_variant_count": 1, "ja3_variants": [ "3aa22bcfc3bd391bba712d23d3ea3ffb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_d576ba9a1b51_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "d576ba9a1b51", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49154-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703174, "transport": "t", "ja3_hash": "373b1b207221cd58786dd4f223905523", "ja3_variant_count": 1, "ja3_variants": [ "373b1b207221cd58786dd4f223905523" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_efa2d734833b_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "efa2d734833b", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49158-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703173, "transport": "t", "ja3_hash": "b2a958e09a297ae5760c7daa1ee556ed", "ja3_variant_count": 1, "ja3_variants": [ "b2a958e09a297ae5760c7daa1ee556ed" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_f09d9ff7e6fc_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "f09d9ff7e6fc", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703179, "transport": "t", "ja3_hash": "2cc209247d593ad936b66e1ff41b8e13", "ja3_variant_count": 1, "ja3_variants": [ "2cc209247d593ad936b66e1ff41b8e13" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_f17337cd55b5_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "f17337cd55b5", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49166-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703177, "transport": "t", "ja3_hash": "ed5f71cbb4145c737a6bdc65da52c663", "ja3_variant_count": 1, "ja3_variants": [ "ed5f71cbb4145c737a6bdc65da52c663" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_f3042cbcf579_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "f3042cbcf579", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49170-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703175, "transport": "t", "ja3_hash": "daf9db206b0c68e3ba990c40b9e9d046", "ja3_variant_count": 1, "ja3_variants": [ "daf9db206b0c68e3ba990c40b9e9d046" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020600_f3e6ef936ef8_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020600", "b": "f3e6ef936ef8", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49190-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703178, "transport": "t", "ja3_hash": "3e1a06b6f5784e25c66f4fec6778c712", "ja3_variant_count": 1, "ja3_variants": [ "3e1a06b6f5784e25c66f4fec6778c712" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_0b689b8022c5_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "0b689b8022c5", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49326-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825514, "last_seen": 1790703173, "transport": "t", "ja3_hash": "97de585a249e5196ae21c9b21c88de6a", "ja3_variant_count": 1, "ja3_variants": [ "97de585a249e5196ae21c9b21c88de6a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_14e71d778212_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "14e71d778212", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52393-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703176, "transport": "t", "ja3_hash": "6762d8c6c8f77c03634b4c1751c40c49", "ja3_variant_count": 1, "ja3_variants": [ "6762d8c6c8f77c03634b4c1751c40c49" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_1b38a54e016e_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "1b38a54e016e", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49248-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703175, "transport": "t", "ja3_hash": "04dc7a0bab909d568de9b015bdb1efc9", "ja3_variant_count": 1, "ja3_variants": [ "04dc7a0bab909d568de9b015bdb1efc9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_24d3b308d37f_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "24d3b308d37f", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49324-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825511, "last_seen": 1790703173, "transport": "t", "ja3_hash": "b001d24be2dd3dc341844a84424615fb", "ja3_variant_count": 1, "ja3_variants": [ "b001d24be2dd3dc341844a84424615fb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_294548954193_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "294548954193", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49325-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703171, "transport": "t", "ja3_hash": "60c081642c73ff130008cb049b8149dd", "ja3_variant_count": 1, "ja3_variants": [ "60c081642c73ff130008cb049b8149dd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_3933a476d3a7_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "3933a476d3a7", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49270-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825513, "last_seen": 1790703172, "transport": "t", "ja3_hash": "a28f1fe9b2df7106115aa4a98231098e", "ja3_variant_count": 1, "ja3_variants": [ "a28f1fe9b2df7106115aa4a98231098e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_423123446bcc_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "423123446bcc", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49327-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825503, "last_seen": 1790703175, "transport": "t", "ja3_hash": "f45ef16e4c8385df0c4d7f1292c9028f", "ja3_variant_count": 1, "ja3_variants": [ "f45ef16e4c8385df0c4d7f1292c9028f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_5c56dbb0f40e_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "5c56dbb0f40e", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49266-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703174, "transport": "t", "ja3_hash": "532b12915485e8e936eaff33e3200951", "ja3_variant_count": 1, "ja3_variants": [ "532b12915485e8e936eaff33e3200951" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_91989754f31d_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "91989754f31d", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49245-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825506, "last_seen": 1790703175, "transport": "t", "ja3_hash": "c8382e5b50e2ac631b52cd7c675a2124", "ja3_variant_count": 1, "ja3_variants": [ "c8382e5b50e2ac631b52cd7c675a2124" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_9c88c65f283c_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "9c88c65f283c", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49267-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825510, "last_seen": 1790703173, "transport": "t", "ja3_hash": "565f976384b2817bbf305bd05a1fd8f1", "ja3_variant_count": 1, "ja3_variants": [ "565f976384b2817bbf305bd05a1fd8f1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_a7d9af6b7eec_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "a7d9af6b7eec", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49271-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825508, "last_seen": 1790703175, "transport": "t", "ja3_hash": "97e3d54dd8ae88d3a2443bec11090e08", "ja3_variant_count": 1, "ja3_variants": [ "97e3d54dd8ae88d3a2443bec11090e08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_c09a7b327a76_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "c09a7b327a76", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49244-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825515, "last_seen": 1790703174, "transport": "t", "ja3_hash": "caf6487fac473b52271460f9fd1c5db3", "ja3_variant_count": 1, "ja3_variants": [ "caf6487fac473b52271460f9fd1c5db3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_c5d8418a506e_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "c5d8418a506e", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52392-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825512, "last_seen": 1790703174, "transport": "t", "ja3_hash": "4b183d3cace15e361ee45cd3800d4e4f", "ja3_variant_count": 1, "ja3_variants": [ "4b183d3cace15e361ee45cd3800d4e4f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d020700_f705af3945da_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d020700", "b": "f705af3945da", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49249-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825509, "last_seen": 1790703179, "transport": "t", "ja3_hash": "df3e1a630f19dc379b67c48589ed7f9b", "ja3_variant_count": 1, "ja3_variants": [ "df3e1a630f19dc379b67c48589ed7f9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d030400_0f1f2c08f352_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d030400", "b": "0f1f2c08f352", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 3, "extension_count": 4, "alpn": null } }, "ja3_string": "771,156-157-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 18, "first_seen": 1787825498, "last_seen": 1791319589, "transport": "t", "ja3_hash": "0b776582cec922c90a7c5f38b21273f9", "ja3_variant_count": 1, "ja3_variants": [ "0b776582cec922c90a7c5f38b21273f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d040400_058957366436_326c0be892b4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d040400", "b": "058957366436", "c": "326c0be892b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 4, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49185-49178-49181-49184,10-0-11-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "0b0efd0be0a3f3b6cba99e044d308b3e", "ja3_variant_count": 1, "ja3_variants": [ "0b0efd0be0a3f3b6cba99e044d308b3e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d050700_fe8b0b18143e_bddf2a23d4a4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d050700", "b": "fe8b0b18143e", "c": "bddf2a23d4a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 5, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869,0-11-35-13-10-25497-19090,23-25-24-29-30-256-257-258-259-260-4588,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 25497, "name": "25497 (0x6399)", "known": false }, { "value": 19090, "name": "19090 (0x4a92)", "known": false } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791319683, "last_seen": 1791319683, "transport": "t", "ja3_hash": "912200efd8f8073562b9c8542de24a4b", "ja3_variant_count": 1, "ja3_variants": [ "912200efd8f8073562b9c8542de24a4b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d060800_915bc7144b37_5d316f34096e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d060800", "b": "915bc7144b37", "c": "5d316f34096e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 6, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49200-49195-49199-157-156,65281-0-11-10-35-22-23-13,23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791319586, "last_seen": 1791319586, "transport": "t", "ja3_hash": "bb221014f4cf4f7998899c3af958614a", "ja3_variant_count": 1, "ja3_variants": [ "bb221014f4cf4f7998899c3af958614a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d061000_2be37fd24b6f_890e50abd467", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d061000", "b": "2be37fd24b6f", "c": "890e50abd467", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 6, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49196-49195-49199-49200-49171-49172,0-5-10-11-13-50-17-23-43-65281,29-23-24-25-30,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789536932, "last_seen": 1789536932, "transport": "t", "ja3_hash": "d5ddcc36f8ccea1430a723dd25625545", "ja3_variant_count": 1, "ja3_variants": [ "d5ddcc36f8ccea1430a723dd25625545" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d080800_723ebca51f63_0f3f62c4224e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d080800", "b": "723ebca51f63", "c": "0f3f62c4224e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 8, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49199-49171-49172-156-47-53,10-11-13-23-0-17-5-65281,23-24-25-9-10-11-12-13-14-22,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789584323, "last_seen": 1791086199, "transport": "t", "ja3_hash": "fa78522a23d5fbac925a0fee11d910f5", "ja3_variant_count": 1, "ja3_variants": [ "fa78522a23d5fbac925a0fee11d910f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d080800_723ebca51f63_cc8988690cb2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d080800", "b": "723ebca51f63", "c": "cc8988690cb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 8, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49199-49171-49172-156-47-53,0-10-11-13-50-23-43-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1789158801, "last_seen": 1790385523, "transport": "t", "ja3_hash": "b9b8af52a3f8069592aca97c9e835986", "ja3_variant_count": 1, "ja3_variants": [ "b9b8af52a3f8069592aca97c9e835986" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d100300_61a7ad8aa9b6_88308138e70a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t12d100300", "b": "61a7ad8aa9b6", "c": "88308138e70a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 10, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-0-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791311245, "last_seen": 1791311245, "transport": "t", "ja3_hash": "e20b9364cf7a75b1fd6f745ee8c9cb7a", "ja3_variant_count": 1, "ja3_variants": [ "e20b9364cf7a75b1fd6f745ee8c9cb7a" ], "user_agents": { "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)": 1 }, "ua_disagreement": false } }, { "hash": "t12d100600_75366a718a82_e4ef29032766", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d100600", "b": "75366a718a82", "c": "e4ef29032766", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 10, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49172-53-49171-47-49196-49195-49200-157-49199-156,10-11-13-23-0-65281,23-24-25-9-10-11-12-13-14-22,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 18, "first_seen": 1788084397, "last_seen": 1788982904, "transport": "t", "ja3_hash": "0fc515c691d7ad55a8ff39986a921cdd", "ja3_variant_count": 1, "ja3_variants": [ "0fc515c691d7ad55a8ff39986a921cdd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1009h2_75366a718a82_65535e0805f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1009h2", "b": "75366a718a82", "c": "65535e0805f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 10, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-49171-49172-156-157-47-53,65281-23-11-13-10-35-0-45-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 18, "first_seen": 1789381769, "last_seen": 1791359978, "transport": "t", "ja3_hash": "44ee4ef56a0b6e183abe5e77ab07d78e", "ja3_variant_count": 18, "ja3_variants": [ "44ee4ef56a0b6e183abe5e77ab07d78e", "f26f4cad574cb94b961864a236a779bb", "52c5652817966baf1b17ae37c0a63207", "b8bfeee7ec2ac2205b1d65b76f262455", "38de560d275ceaa36dc0df05dff350c0", "b999ea531326cb3dce2ff9741c29026b", "a3bb2c38633823dc38dbebf71357bd45", "49bebf11761959c7ad68016790908f35", "7acac286674466135bc7b5b23e9d3f11", "e6435fec2ee4c39c6862b6f1b753843c", "b34e43a0a6ca2067637caa5b437af379", "0daea89f75fff465eb3f3949a6a243bc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1106h2_8256d93fd366_0f6eec4388ad", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1106h2", "b": "8256d93fd366", "c": "0f6eec4388ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 11, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,49196-49200-49195-49199-157-156-49172-49171-53-47-255,13-0-23-11-10-16,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1789036520, "last_seen": 1790074304, "transport": "t", "ja3_hash": "a145c034e636923ac2fa80573b83e435", "ja3_variant_count": 1, "ja3_variants": [ "a145c034e636923ac2fa80573b83e435" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1108h2_8256d93fd366_6eeb6b90ab14", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1108h2", "b": "8256d93fd366", "c": "6eeb6b90ab14", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 11, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-49171-49172-156-157-47-53-255,0-11-10-35-13-5-15-16,23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 80, "first_seen": 1790789300, "last_seen": 1791051176, "transport": "t", "ja3_hash": "34bf21728119e53dece1f991e301a918", "ja3_variant_count": 1, "ja3_variants": [ "34bf21728119e53dece1f991e301a918" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d120700_d34a8e72043a_5411ff8955b2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d120700", "b": "d34a8e72043a", "c": "5411ff8955b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 12, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49195-49196-52393-49199-49200-52392-49171-49172-156-157-47-53,0-23-65281-10-11-5-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788900554, "last_seen": 1790643513, "transport": "t", "ja3_hash": "6c0f0a346dcd84cb4b97a0d9382c53fd", "ja3_variant_count": 1, "ja3_variants": [ "6c0f0a346dcd84cb4b97a0d9382c53fd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1208h2_d34a8e72043a_19593551d184", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1208h2", "b": "d34a8e72043a", "c": "19593551d184", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 12, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,49195-49196-52393-49199-49200-52392-49171-49172-156-157-47-53,65281-0-23-35-13-16-11-10,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788981162, "last_seen": 1788981162, "transport": "t", "ja3_hash": "f6a0bfafe2bf7d9c79ffb3f269b64b46", "ja3_variant_count": 1, "ja3_variants": [ "f6a0bfafe2bf7d9c79ffb3f269b64b46" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1211h2_d34a8e72043a_3e116bb064ef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1211h2", "b": "d34a8e72043a", "c": "3e116bb064ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 12, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-18-13-28,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789315998, "last_seen": 1790771187, "transport": "t", "ja3_hash": "4e9725a4a78a23a30c381b0e4169508c", "ja3_variant_count": 1, "ja3_variants": [ "4e9725a4a78a23a30c381b0e4169508c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d130600_2d7513195f68_334f0aaed909", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d130600", "b": "2d7513195f68", "c": "334f0aaed909", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,0-5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 482, "first_seen": 1787459358, "last_seen": 1791339512, "transport": "t", "ja3_hash": "20c9baf81bfe96ff89722899e75d0190", "ja3_variant_count": 1, "ja3_variants": [ "20c9baf81bfe96ff89722899e75d0190" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d130800_2d7513195f68_984a83a01545", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d130800", "b": "2d7513195f68", "c": "984a83a01545", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,0-5-10-11-13-65281-15-18,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 61, "first_seen": 1787609610, "last_seen": 1791352160, "transport": "t", "ja3_hash": "bfa64571e2d6cadd2708d867ae17eab7", "ja3_variant_count": 1, "ja3_variants": [ "bfa64571e2d6cadd2708d867ae17eab7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1312h2_8b80da21ef18_a392402a32f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1312h2", "b": "8b80da21ef18", "c": "a392402a32f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-10-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 30032, "name": "30032 (0x7550)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790958393, "last_seen": 1790958393, "transport": "t", "ja3_hash": "3d0e94714ddaa4c6e9eb690f529c55ce", "ja3_variant_count": 1, "ja3_variants": [ "3d0e94714ddaa4c6e9eb690f529c55ce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d140800_d1637c2d00c3_465a47a21f65", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d140800", "b": "d1637c2d00c3", "c": "465a47a21f65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 14, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-157-156-61-60,0-5-10-11-13-35-23-65281,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790076866, "last_seen": 1790076866, "transport": "t", "ja3_hash": "3f6b2c6b0afa66c7f514d10b5376e7a5", "ja3_variant_count": 1, "ja3_variants": [ "3f6b2c6b0afa66c7f514d10b5376e7a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_3ec6000827fa", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "3ec6000827fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730570, "last_seen": 1789730570, "transport": "t", "ja3_hash": "64fc1c5420e04d7c595e19f036aa2ac1", "ja3_variant_count": 1, "ja3_variants": [ "64fc1c5420e04d7c595e19f036aa2ac1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_c6743957b624", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "c6743957b624", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791171298, "last_seen": 1791171298, "transport": "t", "ja3_hash": "d6ed8c36920c8571f3873f8ec132d40e", "ja3_variant_count": 1, "ja3_variants": [ "d6ed8c36920c8571f3873f8ec132d40e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_ce8a6bf78de9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "ce8a6bf78de9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788496632, "last_seen": 1788496632, "transport": "t", "ja3_hash": "0074ba9fc16dde5c17ebd25771972fc6", "ja3_variant_count": 1, "ja3_variants": [ "0074ba9fc16dde5c17ebd25771972fc6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_04f7bb853c22", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "04f7bb853c22", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790778988, "last_seen": 1790778988, "transport": "t", "ja3_hash": "ddbee20418aba6d11ec2812affae7c81", "ja3_variant_count": 1, "ja3_variants": [ "ddbee20418aba6d11ec2812affae7c81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_1d95f6a4b2a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "1d95f6a4b2a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790538511, "last_seen": 1790538511, "transport": "t", "ja3_hash": "97a17916ad0a93f181fe62d7e8483202", "ja3_variant_count": 1, "ja3_variants": [ "97a17916ad0a93f181fe62d7e8483202" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_1dca5b180002", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "1dca5b180002", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791090480, "last_seen": 1791090480, "transport": "t", "ja3_hash": "6656988f23ead4495f09be119aaea39e", "ja3_variant_count": 1, "ja3_variants": [ "6656988f23ead4495f09be119aaea39e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_1e2385c56a69", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "1e2385c56a69", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790593305, "last_seen": 1790593305, "transport": "t", "ja3_hash": "5e93c7ad8aa3d5955035d9d38c03fbab", "ja3_variant_count": 1, "ja3_variants": [ "5e93c7ad8aa3d5955035d9d38c03fbab" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_611ca9e2b485", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "611ca9e2b485", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790321142, "last_seen": 1790321142, "transport": "t", "ja3_hash": "560263d91bce4e22a8be6aa418170307", "ja3_variant_count": 1, "ja3_variants": [ "560263d91bce4e22a8be6aa418170307" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_9c860fdeb099", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "9c860fdeb099", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790775636, "last_seen": 1790775636, "transport": "t", "ja3_hash": "3576f228ef03605de269cb4d43c66e68", "ja3_variant_count": 1, "ja3_variants": [ "3576f228ef03605de269cb4d43c66e68" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_a02b09871be3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "a02b09871be3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788390775, "last_seen": 1789591736, "transport": "t", "ja3_hash": "15f16b03fedd62e30eae2efe6780b90c", "ja3_variant_count": 1, "ja3_variants": [ "15f16b03fedd62e30eae2efe6780b90c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_eaa1bd1d26e4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "eaa1bd1d26e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791017457, "last_seen": 1791017457, "transport": "t", "ja3_hash": "1261695a25cf343a7fc243b8b4ae09ff", "ja3_variant_count": 1, "ja3_variants": [ "1261695a25cf343a7fc243b8b4ae09ff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_00b078b985da", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "00b078b985da", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790517364, "last_seen": 1790517364, "transport": "t", "ja3_hash": "6ed5f792ac04c896d63ccca31971c70f", "ja3_variant_count": 1, "ja3_variants": [ "6ed5f792ac04c896d63ccca31971c70f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_09da93290c1b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "09da93290c1b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-51-10-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197011, "last_seen": 1790197011, "transport": "t", "ja3_hash": "703d106c736e0ea127cd518f4f075d94", "ja3_variant_count": 1, "ja3_variants": [ "703d106c736e0ea127cd518f4f075d94" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_1a19b05c17e6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "1a19b05c17e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-27-0-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790006999, "last_seen": 1790006999, "transport": "t", "ja3_hash": "b482631bcf78022e3c4e59f2e253dd8b", "ja3_variant_count": 1, "ja3_variants": [ "b482631bcf78022e3c4e59f2e253dd8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_1a462c9789dd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "1a462c9789dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-35-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789678494, "last_seen": 1789678494, "transport": "t", "ja3_hash": "1fb3cb5765e1cec89d9c215c44ed716e", "ja3_variant_count": 1, "ja3_variants": [ "1fb3cb5765e1cec89d9c215c44ed716e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_224fe18d8d7a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "224fe18d8d7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791242108, "last_seen": 1791242108, "transport": "t", "ja3_hash": "136b57e8de052d26bac519aad1821b78", "ja3_variant_count": 1, "ja3_variants": [ "136b57e8de052d26bac519aad1821b78" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_280d0f629de3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "280d0f629de3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-65281-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791089159, "last_seen": 1791089159, "transport": "t", "ja3_hash": "bac336d824103bbb2d344c7776cde547", "ja3_variant_count": 1, "ja3_variants": [ "bac336d824103bbb2d344c7776cde547" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_2d8270690cc1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "2d8270690cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-13-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791151808, "last_seen": 1791151808, "transport": "t", "ja3_hash": "a0ba96eae8a3c7010e235da3a95d5d26", "ja3_variant_count": 1, "ja3_variants": [ "a0ba96eae8a3c7010e235da3a95d5d26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_67d02bdb6baf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "67d02bdb6baf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790202579, "last_seen": 1790202579, "transport": "t", "ja3_hash": "6b41906fd04240d006e93ed1d58b6b2e", "ja3_variant_count": 1, "ja3_variants": [ "6b41906fd04240d006e93ed1d58b6b2e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_7cba944e5a8c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "7cba944e5a8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788457902, "last_seen": 1788457902, "transport": "t", "ja3_hash": "8d9f68c9c5c6068704b76dd35828fa10", "ja3_variant_count": 1, "ja3_variants": [ "8d9f68c9c5c6068704b76dd35828fa10" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_8c5587d0948a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "8c5587d0948a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-17613-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788931106, "last_seen": 1788931106, "transport": "t", "ja3_hash": "f8d0beadea30069dbd30a976a2f28801", "ja3_variant_count": 1, "ja3_variants": [ "f8d0beadea30069dbd30a976a2f28801" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_9175954a19d4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "9175954a19d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-51-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790820116, "last_seen": 1790820116, "transport": "t", "ja3_hash": "ca32003b3430d0a120a2ae698ef8327e", "ja3_variant_count": 1, "ja3_variants": [ "ca32003b3430d0a120a2ae698ef8327e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_a1adf078a989", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "a1adf078a989", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-51-0-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790322718, "last_seen": 1790322718, "transport": "t", "ja3_hash": "cb5095f4034adbc0ec7a63ed4c70ac30", "ja3_variant_count": 1, "ja3_variants": [ "cb5095f4034adbc0ec7a63ed4c70ac30" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_a4a34ba9c9c5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "a4a34ba9c9c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-65281-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790947614, "last_seen": 1791215867, "transport": "t", "ja3_hash": "828fb971f1b0978b8750d5683d348229", "ja3_variant_count": 2, "ja3_variants": [ "828fb971f1b0978b8750d5683d348229", "4cee81e72dcbebb64daa414db37f6fcb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_abd28e2180f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "abd28e2180f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-13-0-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788901268, "last_seen": 1788901268, "transport": "t", "ja3_hash": "3e1742083f824236919d713777f6f245", "ja3_variant_count": 1, "ja3_variants": [ "3e1742083f824236919d713777f6f245" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_b6ed92a92e7e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "b6ed92a92e7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-18-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789545186, "last_seen": 1789545186, "transport": "t", "ja3_hash": "fdc41e5f66738ca2d0d4070988bfbe62", "ja3_variant_count": 1, "ja3_variants": [ "fdc41e5f66738ca2d0d4070988bfbe62" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_bbd76f0f44ff", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "bbd76f0f44ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-51-13-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789138900, "last_seen": 1789138900, "transport": "t", "ja3_hash": "e327ebd0def60ff8792a76a3bf2d1ebf", "ja3_variant_count": 1, "ja3_variants": [ "e327ebd0def60ff8792a76a3bf2d1ebf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_c4d1f8cababe", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "c4d1f8cababe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-0-65281-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791246182, "last_seen": 1791246182, "transport": "t", "ja3_hash": "56b278984792e551a913108e303a3f81", "ja3_variant_count": 1, "ja3_variants": [ "56b278984792e551a913108e303a3f81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_c9d0f7dfb209", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "c9d0f7dfb209", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-51764-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788777901, "last_seen": 1788777901, "transport": "t", "ja3_hash": "91c84b807bc1c0810e13067e8d2d76a1", "ja3_variant_count": 1, "ja3_variants": [ "91c84b807bc1c0810e13067e8d2d76a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_d55415de9ed8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "d55415de9ed8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51764-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788967487, "last_seen": 1788967487, "transport": "t", "ja3_hash": "7400ea1df7adfed2a8161097c145348a", "ja3_variant_count": 1, "ja3_variants": [ "7400ea1df7adfed2a8161097c145348a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_dc9aa6595c3f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "dc9aa6595c3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-0-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790815189, "last_seen": 1790815189, "transport": "t", "ja3_hash": "7d05027f53ebb2fb8eed408d8ba12a21", "ja3_variant_count": 1, "ja3_variants": [ "7d05027f53ebb2fb8eed408d8ba12a21" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_ff164787302e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "ff164787302e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791174611, "last_seen": 1791174611, "transport": "t", "ja3_hash": "70565f96212a851ba5d1fc78a072c482", "ja3_variant_count": 1, "ja3_variants": [ "70565f96212a851ba5d1fc78a072c482" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_76495e6af5f8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "76495e6af5f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789673905, "last_seen": 1789673905, "transport": "t", "ja3_hash": "4f94fddbddae09c2ed25e8131a18d281", "ja3_variant_count": 1, "ja3_variants": [ "4f94fddbddae09c2ed25e8131a18d281" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_9c9d09fdf6fc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "9c9d09fdf6fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789273166, "last_seen": 1789273166, "transport": "t", "ja3_hash": "b99ddb44497e16724f99fa2b2f9ee5f2", "ja3_variant_count": 1, "ja3_variants": [ "b99ddb44497e16724f99fa2b2f9ee5f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_b3623b5151a0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "b3623b5151a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791211808, "last_seen": 1791211808, "transport": "t", "ja3_hash": "429bf0cf3b63f98d01d2a2800000311b", "ja3_variant_count": 1, "ja3_variants": [ "429bf0cf3b63f98d01d2a2800000311b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_f069c3871497", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "f069c3871497", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790004402, "last_seen": 1790004402, "transport": "t", "ja3_hash": "da1c70efd4087e625969229797bb81ce", "ja3_variant_count": 1, "ja3_variants": [ "da1c70efd4087e625969229797bb81ce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_13bd6874d7d9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "13bd6874d7d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-45-17613-27-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789820707, "last_seen": 1789820707, "transport": "t", "ja3_hash": "0783ae2d4ea266c58c2c306dd4a5f96f", "ja3_variant_count": 1, "ja3_variants": [ "0783ae2d4ea266c58c2c306dd4a5f96f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_264b839556d9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "264b839556d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-0-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790728503, "last_seen": 1790728503, "transport": "t", "ja3_hash": "a22811e0916e2e6624f29c30394f94ba", "ja3_variant_count": 1, "ja3_variants": [ "a22811e0916e2e6624f29c30394f94ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_2b4f572fd7b9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "2b4f572fd7b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-0-65281-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790320711, "last_seen": 1790320711, "transport": "t", "ja3_hash": "2e611c737630090baf39c607c55043c9", "ja3_variant_count": 1, "ja3_variants": [ "2e611c737630090baf39c607c55043c9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_2e3ee6b415c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "2e3ee6b415c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-35-0-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790708627, "last_seen": 1790708627, "transport": "t", "ja3_hash": "668a010d904aad5320d8d8af36aecbd4", "ja3_variant_count": 1, "ja3_variants": [ "668a010d904aad5320d8d8af36aecbd4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_37ee51ddf088", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "37ee51ddf088", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-11-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789796842, "last_seen": 1789796842, "transport": "t", "ja3_hash": "ad84bdb4f426196e53e46e8184fd1485", "ja3_variant_count": 1, "ja3_variants": [ "ad84bdb4f426196e53e46e8184fd1485" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_3d5f77db73c4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "3d5f77db73c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-11-65281-45-18,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789567931, "last_seen": 1789567931, "transport": "t", "ja3_hash": "71c9771f0fcd3311bd6b886849d94f8c", "ja3_variant_count": 1, "ja3_variants": [ "71c9771f0fcd3311bd6b886849d94f8c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_53300ca987c4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "53300ca987c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-13-45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790188075, "last_seen": 1790188075, "transport": "t", "ja3_hash": "ee84a28932f30cdb943f93318e1b2597", "ja3_variant_count": 1, "ja3_variants": [ "ee84a28932f30cdb943f93318e1b2597" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_5c4623b73de1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "5c4623b73de1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-18-51-5-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789936900, "last_seen": 1789936900, "transport": "t", "ja3_hash": "fa60626b8f94e13622376f7f0b641a6a", "ja3_variant_count": 1, "ja3_variants": [ "fa60626b8f94e13622376f7f0b641a6a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_639f5b23ea83", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "639f5b23ea83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-51-5-27-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723898, "last_seen": 1788723898, "transport": "t", "ja3_hash": "3045169a71fd23fd3546936dfc942c33", "ja3_variant_count": 1, "ja3_variants": [ "3045169a71fd23fd3546936dfc942c33" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_63fa15bef6e0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "63fa15bef6e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-13-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788741896, "last_seen": 1788741896, "transport": "t", "ja3_hash": "dcb31ab7f26c8dfa527abf2e436035d1", "ja3_variant_count": 1, "ja3_variants": [ "dcb31ab7f26c8dfa527abf2e436035d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_7a8e165126df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "7a8e165126df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-0-65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790244504, "last_seen": 1790244504, "transport": "t", "ja3_hash": "9b16f5646e1ef694662f714b01612269", "ja3_variant_count": 1, "ja3_variants": [ "9b16f5646e1ef694662f714b01612269" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_835d5558378f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "835d5558378f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-0-51-35-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790728488, "last_seen": 1790728488, "transport": "t", "ja3_hash": "fd412dd7664a391e8d04d386fcc99434", "ja3_variant_count": 1, "ja3_variants": [ "fd412dd7664a391e8d04d386fcc99434" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_96f980745fc2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "96f980745fc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-18-27-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790994650, "last_seen": 1790994650, "transport": "t", "ja3_hash": "ce3a2cd652bf107f1055bde2f6ed990d", "ja3_variant_count": 1, "ja3_variants": [ "ce3a2cd652bf107f1055bde2f6ed990d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_9d671508c8df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "9d671508c8df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-10-23-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791131134, "last_seen": 1791131134, "transport": "t", "ja3_hash": "0f2f64d9d46eea784472207f47946f16", "ja3_variant_count": 1, "ja3_variants": [ "0f2f64d9d46eea784472207f47946f16" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_a298fd5e6174", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "a298fd5e6174", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-5-11-51-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790859698, "last_seen": 1790859698, "transport": "t", "ja3_hash": "027f6a74eb46ca0d5816f04edcad65bd", "ja3_variant_count": 1, "ja3_variants": [ "027f6a74eb46ca0d5816f04edcad65bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_eb088a94bb80", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "eb088a94bb80", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-51-35-17613-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790211130, "last_seen": 1790211130, "transport": "t", "ja3_hash": "3e5c20dad89e6d84b1b5724a8cdad336", "ja3_variant_count": 1, "ja3_variants": [ "3e5c20dad89e6d84b1b5724a8cdad336" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_f7b5333b789d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "f7b5333b789d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-13-65281-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791013674, "last_seen": 1791013674, "transport": "t", "ja3_hash": "9bf53f7612cd50cb89092b2313c4f880", "ja3_variant_count": 1, "ja3_variants": [ "9bf53f7612cd50cb89092b2313c4f880" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_ff74461ef9c0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "ff74461ef9c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-51-45-35-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788931416, "last_seen": 1788931416, "transport": "t", "ja3_hash": "86eed009831a65f50bba9cac61e7a493", "ja3_variant_count": 1, "ja3_variants": [ "86eed009831a65f50bba9cac61e7a493" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_0cce2b9ea82c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "0cce2b9ea82c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-0-45-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788881847, "last_seen": 1788881847, "transport": "t", "ja3_hash": "b531bee516626bb244c5f3b79ae8e418", "ja3_variant_count": 1, "ja3_variants": [ "b531bee516626bb244c5f3b79ae8e418" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_176020b02836", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "176020b02836", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-0-16-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788950141, "last_seen": 1788950141, "transport": "t", "ja3_hash": "6c86ed27a3709e978fb704fd306f44d3", "ja3_variant_count": 1, "ja3_variants": [ "6c86ed27a3709e978fb704fd306f44d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_6111dc6a1cfd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "6111dc6a1cfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-65037-0-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790994617, "last_seen": 1790994617, "transport": "t", "ja3_hash": "19da8e5cd38a46a16541a9986328806c", "ja3_variant_count": 1, "ja3_variants": [ "19da8e5cd38a46a16541a9986328806c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_673f55a6b7cc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "673f55a6b7cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-23-16-45-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789931634, "last_seen": 1789931634, "transport": "t", "ja3_hash": "1dafbc83ae5634a68a4d6a7fb7f58692", "ja3_variant_count": 1, "ja3_variants": [ "1dafbc83ae5634a68a4d6a7fb7f58692" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_70240d89763e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "70240d89763e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-65037-16-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790264778, "last_seen": 1790264778, "transport": "t", "ja3_hash": "76dde4303f39e63f73fede6f66e814ef", "ja3_variant_count": 1, "ja3_variants": [ "76dde4303f39e63f73fede6f66e814ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_a6d4ab6fe03f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "a6d4ab6fe03f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-16-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790611107, "last_seen": 1790611107, "transport": "t", "ja3_hash": "711d407f7fa4aac9aef501109e5b297c", "ja3_variant_count": 1, "ja3_variants": [ "711d407f7fa4aac9aef501109e5b297c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_a9172a2673a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "a9172a2673a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-45-13-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391189, "last_seen": 1789391189, "transport": "t", "ja3_hash": "cd3a698a6ad229edd3abe5dde4776ede", "ja3_variant_count": 1, "ja3_variants": [ "cd3a698a6ad229edd3abe5dde4776ede" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_a98328b8727b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "a98328b8727b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-51-35-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790311383, "last_seen": 1790311383, "transport": "t", "ja3_hash": "8eb4a9c199be9cfd78ace75951f7db29", "ja3_variant_count": 1, "ja3_variants": [ "8eb4a9c199be9cfd78ace75951f7db29" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_db24bf97f5a0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "db24bf97f5a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-65281-17613-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788522728, "last_seen": 1788522728, "transport": "t", "ja3_hash": "b70a0a9308565dc14418eef36a3b000a", "ja3_variant_count": 1, "ja3_variants": [ "b70a0a9308565dc14418eef36a3b000a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_fd822ef56a30", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "fd822ef56a30", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-0-27-16-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788840247, "last_seen": 1788840247, "transport": "t", "ja3_hash": "4be498a28b7ff7994338b8d3572c05eb", "ja3_variant_count": 1, "ja3_variants": [ "4be498a28b7ff7994338b8d3572c05eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_0057df142f55", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "0057df142f55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-0-27-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839541, "last_seen": 1788839541, "transport": "t", "ja3_hash": "0d3945c7cb1f5e29e7a3989d02622c4b", "ja3_variant_count": 1, "ja3_variants": [ "0d3945c7cb1f5e29e7a3989d02622c4b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_00bd5b2e997b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "00bd5b2e997b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-45-13-27-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790708534, "last_seen": 1790708534, "transport": "t", "ja3_hash": "e88c0b93aca63d301a4bd06bccb4d39c", "ja3_variant_count": 1, "ja3_variants": [ "e88c0b93aca63d301a4bd06bccb4d39c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_1c8110d0f74b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "1c8110d0f74b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-51-27-11-10-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790885816, "last_seen": 1790885816, "transport": "t", "ja3_hash": "8b0781f032f477a5275db016e7bec12d", "ja3_variant_count": 1, "ja3_variants": [ "8b0781f032f477a5275db016e7bec12d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_20d746af89fb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "20d746af89fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-51764-65281-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197058, "last_seen": 1790197058, "transport": "t", "ja3_hash": "b019c5cd802fcca285d4d4ec1a0c164a", "ja3_variant_count": 1, "ja3_variants": [ "b019c5cd802fcca285d4d4ec1a0c164a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_2512969999fc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "2512969999fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-18-0-17613-11-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791027434, "last_seen": 1791027434, "transport": "t", "ja3_hash": "5eb686f7d0bd78fabf87c7f705c15468", "ja3_variant_count": 1, "ja3_variants": [ "5eb686f7d0bd78fabf87c7f705c15468" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_2e7de8bfc081", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "2e7de8bfc081", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-18-0-13-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791118822, "last_seen": 1791118822, "transport": "t", "ja3_hash": "eb9776ad5e73d50b3625c5c718401fba", "ja3_variant_count": 1, "ja3_variants": [ "eb9776ad5e73d50b3625c5c718401fba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4e0f3193f891", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4e0f3193f891", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-13-65281-5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790740712, "last_seen": 1790740712, "transport": "t", "ja3_hash": "7f125ca4b1de7d1b99060b85cdddb504", "ja3_variant_count": 1, "ja3_variants": [ "7f125ca4b1de7d1b99060b85cdddb504" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4e31eef87a7f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4e31eef87a7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65281-13-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789024344, "last_seen": 1789024344, "transport": "t", "ja3_hash": "eca48267e726c70f75357905345bd9f2", "ja3_variant_count": 1, "ja3_variants": [ "eca48267e726c70f75357905345bd9f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_54eba23e8458", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "54eba23e8458", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-5-10-0-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789689004, "last_seen": 1789689004, "transport": "t", "ja3_hash": "5cbbd3b17190cca0028cc42c64dc896c", "ja3_variant_count": 1, "ja3_variants": [ "5cbbd3b17190cca0028cc42c64dc896c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_567205dcfb5c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "567205dcfb5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-0-65037-51764-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790999183, "last_seen": 1790999183, "transport": "t", "ja3_hash": "c90fe45f126fbcf13143d6be8980fbc2", "ja3_variant_count": 1, "ja3_variants": [ "c90fe45f126fbcf13143d6be8980fbc2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_5f3a2ed9fb1f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "5f3a2ed9fb1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-0-27-65281-5-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791195820, "last_seen": 1791195820, "transport": "t", "ja3_hash": "98652640ab9890d1a8c8c98062199c25", "ja3_variant_count": 1, "ja3_variants": [ "98652640ab9890d1a8c8c98062199c25" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_6484d4fa796d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "6484d4fa796d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-5-23-0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790106275, "last_seen": 1790106275, "transport": "t", "ja3_hash": "d22cca2822c0af576e11092cdcb0f938", "ja3_variant_count": 1, "ja3_variants": [ "d22cca2822c0af576e11092cdcb0f938" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_68233b518dd8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "68233b518dd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-0-65037-18-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790904659, "last_seen": 1790904659, "transport": "t", "ja3_hash": "e6c85a5deb09813be8f7bfd20a647f86", "ja3_variant_count": 1, "ja3_variants": [ "e6c85a5deb09813be8f7bfd20a647f86" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_79f13ed3d2a1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "79f13ed3d2a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-45-27-18-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788508342, "last_seen": 1788508342, "transport": "t", "ja3_hash": "3998f22553163699fc8519a52c4eaed5", "ja3_variant_count": 1, "ja3_variants": [ "3998f22553163699fc8519a52c4eaed5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_92cec7595ef5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "92cec7595ef5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-18-13-17613-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790736869, "last_seen": 1790736869, "transport": "t", "ja3_hash": "e5d7896652409f574efd82242325610b", "ja3_variant_count": 1, "ja3_variants": [ "e5d7896652409f574efd82242325610b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_984cd0b419de", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "984cd0b419de", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-13-0-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790360808, "last_seen": 1790360808, "transport": "t", "ja3_hash": "65bd003bd5bf46c44986c9ef212b0e19", "ja3_variant_count": 1, "ja3_variants": [ "65bd003bd5bf46c44986c9ef212b0e19" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_a223af722a44", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "a223af722a44", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-65037-10-0-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791169811, "last_seen": 1791169811, "transport": "t", "ja3_hash": "daeae0445c9da689816d2da2ac9678a2", "ja3_variant_count": 1, "ja3_variants": [ "daeae0445c9da689816d2da2ac9678a2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_ac98a9632a26", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "ac98a9632a26", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-5-35-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791254600, "last_seen": 1791254600, "transport": "t", "ja3_hash": "31da5db36a42a6bd9aa6d69c835180c7", "ja3_variant_count": 1, "ja3_variants": [ "31da5db36a42a6bd9aa6d69c835180c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_cbe09c249487", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "cbe09c249487", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-27-17613-0-10-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790498814, "last_seen": 1790498814, "transport": "t", "ja3_hash": "3ac5737e54e631a112d1da387569e632", "ja3_variant_count": 1, "ja3_variants": [ "3ac5737e54e631a112d1da387569e632" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d095039daad6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d095039daad6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-65037-0-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788931103, "last_seen": 1788931103, "transport": "t", "ja3_hash": "b8e75be57706451a30dae8429b5f5b28", "ja3_variant_count": 1, "ja3_variants": [ "b8e75be57706451a30dae8429b5f5b28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d66c666b3bb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d66c666b3bb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-0-18-27-65281-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790681978, "last_seen": 1790681978, "transport": "t", "ja3_hash": "44ed7102febb955a3bddedc487787625", "ja3_variant_count": 1, "ja3_variants": [ "44ed7102febb955a3bddedc487787625" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d83a331042bd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d83a331042bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-17613-51-18-0-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015031, "last_seen": 1789015031, "transport": "t", "ja3_hash": "7e436368f76c54f342d5afa68dbf5802", "ja3_variant_count": 1, "ja3_variants": [ "7e436368f76c54f342d5afa68dbf5802" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d863a184b2bf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d863a184b2bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-0-51-45-17613-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789430569, "last_seen": 1789430569, "transport": "t", "ja3_hash": "11de1f8787e89df704b0dc0b7f738b21", "ja3_variant_count": 1, "ja3_variants": [ "11de1f8787e89df704b0dc0b7f738b21" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_f391692fba34", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "f391692fba34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-35-51-51764-65281-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791077835, "last_seen": 1791077835, "transport": "t", "ja3_hash": "3c458bf7c00deb4fddf750132e7a34d2", "ja3_variant_count": 1, "ja3_variants": [ "3c458bf7c00deb4fddf750132e7a34d2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_fae9a2cfd2c2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "fae9a2cfd2c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-0-13-10-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788455079, "last_seen": 1788455079, "transport": "t", "ja3_hash": "971fb9c1e45c1739f7eb13bb12c203e6", "ja3_variant_count": 1, "ja3_variants": [ "971fb9c1e45c1739f7eb13bb12c203e6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_fb6281b10ecc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "fb6281b10ecc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-11-35-0-45-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197014, "last_seen": 1790197014, "transport": "t", "ja3_hash": "b3df1b85f202ff73ee238e594ba551a9", "ja3_variant_count": 1, "ja3_variants": [ "b3df1b85f202ff73ee238e594ba551a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h1_8daaf6152771_958337f0c742", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h1", "b": "8daaf6152771", "c": "958337f0c742", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-23-51-0-16-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790651484, "last_seen": 1790651484, "transport": "t", "ja3_hash": "ffe13d3c799100ba953a95653947b266", "ja3_variant_count": 1, "ja3_variants": [ "ffe13d3c799100ba953a95653947b266" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_0cd6dc2f3776", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "0cd6dc2f3776", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-0-5-17613-16-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790640232, "last_seen": 1790640232, "transport": "t", "ja3_hash": "da6f140b9e8fb1391733ee00ae02ec5c", "ja3_variant_count": 1, "ja3_variants": [ "da6f140b9e8fb1391733ee00ae02ec5c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_19749150f3ea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "19749150f3ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-16-45-51-18-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789782404, "last_seen": 1789782404, "transport": "t", "ja3_hash": "b832809ae2118ee10773c97f5d2a592a", "ja3_variant_count": 1, "ja3_variants": [ "b832809ae2118ee10773c97f5d2a592a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_36a4a6358d5c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "36a4a6358d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-5-51-65281-0-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790694286, "last_seen": 1790694286, "transport": "t", "ja3_hash": "c6400296b38c81309bdffb9c3a0c7204", "ja3_variant_count": 1, "ja3_variants": [ "c6400296b38c81309bdffb9c3a0c7204" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_ab002bd4ad1f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "ab002bd4ad1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-35-18-23-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790002699, "last_seen": 1790002699, "transport": "t", "ja3_hash": "a24a3f3ca741afe6a45929a1fd719b31", "ja3_variant_count": 1, "ja3_variants": [ "a24a3f3ca741afe6a45929a1fd719b31" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_b568e1ffdd05", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "b568e1ffdd05", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-0-16-51-35-5,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790751698, "last_seen": 1790751698, "transport": "t", "ja3_hash": "94f910a29aa8a36b16d26bd3f59faf80", "ja3_variant_count": 1, "ja3_variants": [ "94f910a29aa8a36b16d26bd3f59faf80" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_bb65c85c2fdf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "bb65c85c2fdf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-0-23-16-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790269589, "last_seen": 1790269589, "transport": "t", "ja3_hash": "f2a4abb10439ed7b4ccae316ab713f57", "ja3_variant_count": 1, "ja3_variants": [ "f2a4abb10439ed7b4ccae316ab713f57" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_c4d072818549", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "c4d072818549", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-35-23-0-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790605456, "last_seen": 1790605456, "transport": "t", "ja3_hash": "7de77fed202f07d8e2abfd58f8cd3d92", "ja3_variant_count": 1, "ja3_variants": [ "7de77fed202f07d8e2abfd58f8cd3d92" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_c98123189cb1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "c98123189cb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-65281-10-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791018548, "last_seen": 1791018548, "transport": "t", "ja3_hash": "55b6fa76ee784a5bc6ea60efdad90c55", "ja3_variant_count": 1, "ja3_variants": [ "55b6fa76ee784a5bc6ea60efdad90c55" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_cd5821de8d69", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "cd5821de8d69", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-65281-16-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790219904, "last_seen": 1790219904, "transport": "t", "ja3_hash": "6a7ee29fbc6cbcf74614d67d07c0ce07", "ja3_variant_count": 1, "ja3_variants": [ "6a7ee29fbc6cbcf74614d67d07c0ce07" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_f795958b1e9e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "f795958b1e9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-65281-0-35-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789523576, "last_seen": 1789523576, "transport": "t", "ja3_hash": "dc35f56547f0d062dadfeff0e6da39f8", "ja3_variant_count": 1, "ja3_variants": [ "dc35f56547f0d062dadfeff0e6da39f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_26c8a492c88d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "26c8a492c88d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-27-5-45-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791022073, "last_seen": 1791022073, "transport": "t", "ja3_hash": "d6efbb1c2903de49b5b4bd47d7d15e3f", "ja3_variant_count": 1, "ja3_variants": [ "d6efbb1c2903de49b5b4bd47d7d15e3f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_284114d9122a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "284114d9122a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-35-11-65281-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791018548, "last_seen": 1791018548, "transport": "t", "ja3_hash": "1169deca3d479aab8765a48b517ce2a4", "ja3_variant_count": 1, "ja3_variants": [ "1169deca3d479aab8765a48b517ce2a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_3a822f11d718", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "3a822f11d718", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-0-10-65281-5-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790229008, "last_seen": 1790229008, "transport": "t", "ja3_hash": "8f8c9ade186af0207c9152a542211fcf", "ja3_variant_count": 1, "ja3_variants": [ "8f8c9ade186af0207c9152a542211fcf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_3e6fbfdd693e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "3e6fbfdd693e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-13-51764-0-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790780268, "last_seen": 1790780268, "transport": "t", "ja3_hash": "6206919e4bd7fd9d4da79348fbc6f172", "ja3_variant_count": 1, "ja3_variants": [ "6206919e4bd7fd9d4da79348fbc6f172" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_43c9b42acb9b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "43c9b42acb9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-65037-0-11-45-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790329700, "last_seen": 1790329700, "transport": "t", "ja3_hash": "eb2bed17ab74c27f70a820700b75a18e", "ja3_variant_count": 1, "ja3_variants": [ "eb2bed17ab74c27f70a820700b75a18e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_4ed854ad7ca7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "4ed854ad7ca7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-27-18-0-5-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197944, "last_seen": 1790197944, "transport": "t", "ja3_hash": "50e0c9a90b0d9330ee826c14cdb366cd", "ja3_variant_count": 1, "ja3_variants": [ "50e0c9a90b0d9330ee826c14cdb366cd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_5191e0f59afb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "5191e0f59afb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-13-5-18-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788454689, "last_seen": 1788454689, "transport": "t", "ja3_hash": "892c1dbe9f29bb01fcaa0c8acdb80d8f", "ja3_variant_count": 1, "ja3_variants": [ "892c1dbe9f29bb01fcaa0c8acdb80d8f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_5ba2b3898663", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "5ba2b3898663", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-0-13-27-65037-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790998772, "last_seen": 1790998772, "transport": "t", "ja3_hash": "69921552f1e85f8e5707552ec67fb84d", "ja3_variant_count": 1, "ja3_variants": [ "69921552f1e85f8e5707552ec67fb84d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_627085196049", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "627085196049", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-0-11-45-35-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788514977, "last_seen": 1788514977, "transport": "t", "ja3_hash": "5f41765b02173eff709f54545da8d186", "ja3_variant_count": 1, "ja3_variants": [ "5f41765b02173eff709f54545da8d186" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_67c397dc571a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "67c397dc571a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-65037-27-5-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790237744, "last_seen": 1790237744, "transport": "t", "ja3_hash": "2594c211a77df31bd33cc5186c606c78", "ja3_variant_count": 1, "ja3_variants": [ "2594c211a77df31bd33cc5186c606c78" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_6bc0c5f98f17", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "6bc0c5f98f17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-5-0-51-35-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789710061, "last_seen": 1789710061, "transport": "t", "ja3_hash": "51e1059582852677c6c13fad537a1b5e", "ja3_variant_count": 1, "ja3_variants": [ "51e1059582852677c6c13fad537a1b5e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_6f5b6dbeb8b7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "6f5b6dbeb8b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-51764-35-5-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789403156, "last_seen": 1789403156, "transport": "t", "ja3_hash": "fee824a631185cadafbe3adb71a6cf96", "ja3_variant_count": 1, "ja3_variants": [ "fee824a631185cadafbe3adb71a6cf96" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_77023c56d71e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "77023c56d71e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-18-11-10-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790218767, "last_seen": 1790218767, "transport": "t", "ja3_hash": "3d0b3ade017f348f87ec61792cad3cf8", "ja3_variant_count": 1, "ja3_variants": [ "3d0b3ade017f348f87ec61792cad3cf8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_8bc775336eba", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "8bc775336eba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-45-0-17613-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789235869, "last_seen": 1789235869, "transport": "t", "ja3_hash": "66001bd59a0d5b8e96923e2e298b2086", "ja3_variant_count": 1, "ja3_variants": [ "66001bd59a0d5b8e96923e2e298b2086" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_9a51be28706b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "9a51be28706b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-35-51-18-23-65281-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789441219, "last_seen": 1789441219, "transport": "t", "ja3_hash": "ab07f41cb35980a55446ada04e463602", "ja3_variant_count": 1, "ja3_variants": [ "ab07f41cb35980a55446ada04e463602" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a138679e0173", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a138679e0173", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-65281-45-17613-0-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790800490, "last_seen": 1790800490, "transport": "t", "ja3_hash": "13a564a33494b736ff342d70d95890cc", "ja3_variant_count": 1, "ja3_variants": [ "13a564a33494b736ff342d70d95890cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a44cb64a16a7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a44cb64a16a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-5-45-65037-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789414874, "last_seen": 1789414874, "transport": "t", "ja3_hash": "b3c12071292e3643e090735ff1299937", "ja3_variant_count": 1, "ja3_variants": [ "b3c12071292e3643e090735ff1299937" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a74d40297a66", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a74d40297a66", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-17613-45-0-5-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789476158, "last_seen": 1789476158, "transport": "t", "ja3_hash": "12e5ff67f919dfaa62f89ed137b1926f", "ja3_variant_count": 1, "ja3_variants": [ "12e5ff67f919dfaa62f89ed137b1926f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_add12feb5136", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "add12feb5136", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-0-51-5-23-17613-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788824572, "last_seen": 1788824572, "transport": "t", "ja3_hash": "aaa45fe8ff3fd78eee3a43f66a947319", "ja3_variant_count": 1, "ja3_variants": [ "aaa45fe8ff3fd78eee3a43f66a947319" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_afc2e7fb1051", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "afc2e7fb1051", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-23-27-0-10-35-18-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790540098, "last_seen": 1790540098, "transport": "t", "ja3_hash": "481c4b3b41d26470f71d7a240ebb5208", "ja3_variant_count": 1, "ja3_variants": [ "481c4b3b41d26470f71d7a240ebb5208" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_c10129dc9c58", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "c10129dc9c58", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-23-0-13-18-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791073746, "last_seen": 1791073746, "transport": "t", "ja3_hash": "69a33a8e04b8e73df74277144a00a15f", "ja3_variant_count": 1, "ja3_variants": [ "69a33a8e04b8e73df74277144a00a15f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_cf5ca6e25a51", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "cf5ca6e25a51", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-65281-17613-5-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790607293, "last_seen": 1790607293, "transport": "t", "ja3_hash": "d284fd92debae02bd93b802602544b30", "ja3_variant_count": 1, "ja3_variants": [ "d284fd92debae02bd93b802602544b30" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_d371e35c1464", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "d371e35c1464", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-45-18-17613-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788876066, "last_seen": 1788876066, "transport": "t", "ja3_hash": "d4a3497d8124ad6405e167e963f36f66", "ja3_variant_count": 1, "ja3_variants": [ "d4a3497d8124ad6405e167e963f36f66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_e2ee2454ee9f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "e2ee2454ee9f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-5-0-18-27-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790106273, "last_seen": 1790106273, "transport": "t", "ja3_hash": "6df1d56f2d69d327de21ef75f58f23d2", "ja3_variant_count": 1, "ja3_variants": [ "6df1d56f2d69d327de21ef75f58f23d2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_ebfbce334769", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "ebfbce334769", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-35-11-17613-0-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791018187, "last_seen": 1791018187, "transport": "t", "ja3_hash": "24d53ff7f6862fdadd33436952c14a51", "ja3_variant_count": 1, "ja3_variants": [ "24d53ff7f6862fdadd33436952c14a51" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_f0372e1b54d3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "f0372e1b54d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-11-0-51-17613-27-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789438950, "last_seen": 1789438950, "transport": "t", "ja3_hash": "d1a7c0890dd59831ffcac9356e172bc0", "ja3_variant_count": 1, "ja3_variants": [ "d1a7c0890dd59831ffcac9356e172bc0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_f3c84d715a58", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "f3c84d715a58", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-10-13-11-5-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790609735, "last_seen": 1790609735, "transport": "t", "ja3_hash": "cde9c299ee119d1b2a830a21d949372d", "ja3_variant_count": 1, "ja3_variants": [ "cde9c299ee119d1b2a830a21d949372d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_f77c81d758e4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "f77c81d758e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-18-35-5-65037-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788865982, "last_seen": 1788865982, "transport": "t", "ja3_hash": "4267c09904b940b36ed563fa9b9378af", "ja3_variant_count": 1, "ja3_variants": [ "4267c09904b940b36ed563fa9b9378af" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_faa7bb6c7b82", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "faa7bb6c7b82", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-45-17613-27-11-4832-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788640776, "last_seen": 1788640776, "transport": "t", "ja3_hash": "d66a0c0f0a19095c9c1720f83fec7e09", "ja3_variant_count": 1, "ja3_variants": [ "d66a0c0f0a19095c9c1720f83fec7e09" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h1_8daaf6152771_ef9d6ae3ff59", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h1", "b": "8daaf6152771", "c": "ef9d6ae3ff59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-11-0-27-65281-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790977593, "last_seen": 1790977593, "transport": "t", "ja3_hash": "73140d2a0894f7b3e8526155347b4714", "ja3_variant_count": 1, "ja3_variants": [ "73140d2a0894f7b3e8526155347b4714" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_28ace02db7f8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "28ace02db7f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-23-11-16-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790219902, "last_seen": 1790219902, "transport": "t", "ja3_hash": "96db52cdde59ea8f2eec74e7f27557e0", "ja3_variant_count": 1, "ja3_variants": [ "96db52cdde59ea8f2eec74e7f27557e0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_37bcf9cb6cb7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "37bcf9cb6cb7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-5-23-65281-0-17613-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790685016, "last_seen": 1790685016, "transport": "t", "ja3_hash": "2f8c8b9e04bec2dcced1ed84c7515116", "ja3_variant_count": 1, "ja3_variants": [ "2f8c8b9e04bec2dcced1ed84c7515116" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_3bfade727e0f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "3bfade727e0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-16-65281-51764-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789653251, "last_seen": 1789653251, "transport": "t", "ja3_hash": "064f87b9ab601f05e1472b45d0684350", "ja3_variant_count": 1, "ja3_variants": [ "064f87b9ab601f05e1472b45d0684350" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_42759104df6a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "42759104df6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51764-0-5-45-11-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791301527, "last_seen": 1791301527, "transport": "t", "ja3_hash": "65091bcf728223b8beec7b3e80037bf7", "ja3_variant_count": 1, "ja3_variants": [ "65091bcf728223b8beec7b3e80037bf7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_4576aa6445cc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "4576aa6445cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-16-17613-0-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790436979, "last_seen": 1790436979, "transport": "t", "ja3_hash": "26b29021e9a6465ffb0f51ee9dc2cd88", "ja3_variant_count": 1, "ja3_variants": [ "26b29021e9a6465ffb0f51ee9dc2cd88" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_606d9f05f18c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "606d9f05f18c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-0-18-13-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791215864, "last_seen": 1791215864, "transport": "t", "ja3_hash": "ed222bb7020be1a3d262670bccb2d55e", "ja3_variant_count": 1, "ja3_variants": [ "ed222bb7020be1a3d262670bccb2d55e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_799b367a537e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "799b367a537e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-0-18-17613-51764-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791169811, "last_seen": 1791169811, "transport": "t", "ja3_hash": "119061d5fd428843fc471e3439984621", "ja3_variant_count": 1, "ja3_variants": [ "119061d5fd428843fc471e3439984621" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_7b7e27166e59", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "7b7e27166e59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-65037-0-5-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790779010, "last_seen": 1790779010, "transport": "t", "ja3_hash": "f3924a05be886879f0dd9797fc8d7456", "ja3_variant_count": 1, "ja3_variants": [ "f3924a05be886879f0dd9797fc8d7456" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_7bff97c8bb80", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "7bff97c8bb80", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-16-65037-45-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790728488, "last_seen": 1790728488, "transport": "t", "ja3_hash": "6a04b7c507afaab1e88aefd6da4a8bdf", "ja3_variant_count": 1, "ja3_variants": [ "6a04b7c507afaab1e88aefd6da4a8bdf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_813dfe679edd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "813dfe679edd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-65037-16-5-65281-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789552169, "last_seen": 1789552169, "transport": "t", "ja3_hash": "dc902b3e2ea9779459e4aaa1f4982194", "ja3_variant_count": 1, "ja3_variants": [ "dc902b3e2ea9779459e4aaa1f4982194" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_9369beeae83e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "9369beeae83e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-51-0-65281-27-5-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788738599, "last_seen": 1788738599, "transport": "t", "ja3_hash": "a0ad6a085e1f179ceed039ed418eca0d", "ja3_variant_count": 1, "ja3_variants": [ "a0ad6a085e1f179ceed039ed418eca0d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_9971daf87bd6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "9971daf87bd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-17613-16-0-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790938610, "last_seen": 1790938610, "transport": "t", "ja3_hash": "918e8320dc5877d703335f1c8ea50841", "ja3_variant_count": 1, "ja3_variants": [ "918e8320dc5877d703335f1c8ea50841" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_a6b0c87175ef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "a6b0c87175ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-45-11-5-16-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469870, "last_seen": 1789469870, "transport": "t", "ja3_hash": "3396752e844fde3f7552be0a450836ad", "ja3_variant_count": 1, "ja3_variants": [ "3396752e844fde3f7552be0a450836ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_b196177a1b99", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "b196177a1b99", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-5-65281-16-0-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791257610, "last_seen": 1791257610, "transport": "t", "ja3_hash": "e609e63fdf56ba2ab66c47104aeca2b0", "ja3_variant_count": 1, "ja3_variants": [ "e609e63fdf56ba2ab66c47104aeca2b0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_b306110b8424", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "b306110b8424", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-18-0-35-45-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790266471, "last_seen": 1790266471, "transport": "t", "ja3_hash": "c6e0a9e720e696e01916db70a7e50923", "ja3_variant_count": 1, "ja3_variants": [ "c6e0a9e720e696e01916db70a7e50923" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_b3194b0f836b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "b3194b0f836b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-16-0-17613-65281-51-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790904660, "last_seen": 1790904660, "transport": "t", "ja3_hash": "d46f3013eeb218af0c1c970c6717ecc0", "ja3_variant_count": 1, "ja3_variants": [ "d46f3013eeb218af0c1c970c6717ecc0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_b6f8ec3d8e37", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "b6f8ec3d8e37", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-65281-51-27-16-23-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789292871, "last_seen": 1789292871, "transport": "t", "ja3_hash": "5b19ae05f7e24f24ca84931a90a65787", "ja3_variant_count": 1, "ja3_variants": [ "5b19ae05f7e24f24ca84931a90a65787" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_b7e98a9378cf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "b7e98a9378cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-23-65281-11-16-51-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790340578, "last_seen": 1790340578, "transport": "t", "ja3_hash": "56178210d3da3cf15b5a8bd86d514d25", "ja3_variant_count": 1, "ja3_variants": [ "56178210d3da3cf15b5a8bd86d514d25" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_c1d2382e1594", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "c1d2382e1594", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-23-16-0-65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790158156, "last_seen": 1790158156, "transport": "t", "ja3_hash": "e05fd2f5f93d8272916d67b4ae565f91", "ja3_variant_count": 1, "ja3_variants": [ "e05fd2f5f93d8272916d67b4ae565f91" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_c6bc5b017d79", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "c6bc5b017d79", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-16-11-65037-65281-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791251118, "last_seen": 1791251118, "transport": "t", "ja3_hash": "168db42622d17bd01ce33fcf4480fb5f", "ja3_variant_count": 1, "ja3_variants": [ "168db42622d17bd01ce33fcf4480fb5f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_e6da9eb9f4c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "e6da9eb9f4c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-35-16-65281-0-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789077100, "last_seen": 1789077100, "transport": "t", "ja3_hash": "605e7e10b0f67428eb73d25fe4f72028", "ja3_variant_count": 1, "ja3_variants": [ "605e7e10b0f67428eb73d25fe4f72028" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_f6db8740d7a0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "f6db8740d7a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-18-13-35-65037-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789741131, "last_seen": 1789741131, "transport": "t", "ja3_hash": "024d1d193e9bf56b0d19a312307b82aa", "ja3_variant_count": 1, "ja3_variants": [ "024d1d193e9bf56b0d19a312307b82aa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_1b9209c22ad2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "1b9209c22ad2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51764-11-0-10-13-65037-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791229709, "last_seen": 1791229709, "transport": "t", "ja3_hash": "df6ad89453ff92b3996b888e5379d00f", "ja3_variant_count": 1, "ja3_variants": [ "df6ad89453ff92b3996b888e5379d00f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_46715ce85483", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "46715ce85483", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-65281-45-18-23-0-27-11,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024341, "last_seen": 1789024341, "transport": "t", "ja3_hash": "ce6cb52e1e0d018864a11137941ffcb0", "ja3_variant_count": 1, "ja3_variants": [ "ce6cb52e1e0d018864a11137941ffcb0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_4bb688850a24", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "4bb688850a24", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-65037-17613-5-0-13-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789034180, "last_seen": 1789034180, "transport": "t", "ja3_hash": "f74ac75d936ca8898996418479260f0f", "ja3_variant_count": 1, "ja3_variants": [ "f74ac75d936ca8898996418479260f0f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_5a356f773c8b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "5a356f773c8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-0-18-45-10-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790232379, "last_seen": 1790232379, "transport": "t", "ja3_hash": "56883d185354860ac5408c9cace99760", "ja3_variant_count": 1, "ja3_variants": [ "56883d185354860ac5408c9cace99760" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_5af7402554af", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "5af7402554af", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-35-45-0-65281-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788850312, "last_seen": 1788850312, "transport": "t", "ja3_hash": "a68ec588cb899e10e4c09b5981d1600a", "ja3_variant_count": 1, "ja3_variants": [ "a68ec588cb899e10e4c09b5981d1600a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_5bc67ae21ca9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "5bc67ae21ca9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-18-13-27-45-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789273174, "last_seen": 1789273174, "transport": "t", "ja3_hash": "3934f103898c9a7e978e7b279fdb4e83", "ja3_variant_count": 1, "ja3_variants": [ "3934f103898c9a7e978e7b279fdb4e83" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_5e8f294c156b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "5e8f294c156b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-23-18-45-51-10-17613-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791083917, "last_seen": 1791083917, "transport": "t", "ja3_hash": "dc5af3489269298a24d33a1bf036ab8d", "ja3_variant_count": 1, "ja3_variants": [ "dc5af3489269298a24d33a1bf036ab8d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_6803a649bc5a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "6803a649bc5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-65281-18-27-11-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790340576, "last_seen": 1790340576, "transport": "t", "ja3_hash": "6804daa4ff74adea530d63a646c482e1", "ja3_variant_count": 1, "ja3_variants": [ "6804daa4ff74adea530d63a646c482e1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_7c8972631927", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "7c8972631927", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-45-65281-65037-18-13-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790819987, "last_seen": 1790819987, "transport": "t", "ja3_hash": "cabf3283f7706dc41cb1ab053a953557", "ja3_variant_count": 1, "ja3_variants": [ "cabf3283f7706dc41cb1ab053a953557" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_8e51176e735d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "8e51176e735d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-65281-11-51-45-23-0-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790681978, "last_seen": 1790681978, "transport": "t", "ja3_hash": "ed70a2570a1655ef0adeb0e0c699a110", "ja3_variant_count": 1, "ja3_variants": [ "ed70a2570a1655ef0adeb0e0c699a110" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_a4f4fb6fe97a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "a4f4fb6fe97a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-0-27-10-13-5-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790298265, "last_seen": 1790298265, "transport": "t", "ja3_hash": "23bb3e5a25a6601a7133948468a74faf", "ja3_variant_count": 1, "ja3_variants": [ "23bb3e5a25a6601a7133948468a74faf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_a6f227a52e30", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "a6f227a52e30", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-18-5-27-45-0-51-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790030075, "last_seen": 1790030075, "transport": "t", "ja3_hash": "bb76071f1d948eacc7ac69a76b57629b", "ja3_variant_count": 1, "ja3_variants": [ "bb76071f1d948eacc7ac69a76b57629b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_af5f7beb6812", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "af5f7beb6812", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-23-27-65037-11-0-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789906990, "last_seen": 1789906990, "transport": "t", "ja3_hash": "d414672c2fafa2d53df4ea920e580f5f", "ja3_variant_count": 1, "ja3_variants": [ "d414672c2fafa2d53df4ea920e580f5f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c40e424fa782", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c40e424fa782", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-35-0-65037-5-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789920879, "last_seen": 1789920879, "transport": "t", "ja3_hash": "2405f6e0ef93f2d625c17f48b210d7cd", "ja3_variant_count": 1, "ja3_variants": [ "2405f6e0ef93f2d625c17f48b210d7cd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_d670fb14eac5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "d670fb14eac5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51764-18-0-45-65037-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791208420, "last_seen": 1791208420, "transport": "t", "ja3_hash": "c0379233c10c1ab5b1aa2bf67d15ad6d", "ja3_variant_count": 1, "ja3_variants": [ "c0379233c10c1ab5b1aa2bf67d15ad6d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_d9e349d1c816", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "d9e349d1c816", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-23-0-65281-17613-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790428932, "last_seen": 1790428932, "transport": "t", "ja3_hash": "945836cc57f7fb309c6800362bc2342f", "ja3_variant_count": 1, "ja3_variants": [ "945836cc57f7fb309c6800362bc2342f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_e14b3e5d2674", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "e14b3e5d2674", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-23-27-65281-18-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791250462, "last_seen": 1791250462, "transport": "t", "ja3_hash": "43f75f04ddc9c81e146c08ba32e23911", "ja3_variant_count": 1, "ja3_variants": [ "43f75f04ddc9c81e146c08ba32e23911" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_f5b0dccee7a7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "f5b0dccee7a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-0-45-11-51-23-65281-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789820706, "last_seen": 1789820706, "transport": "t", "ja3_hash": "b5c0e4c50b9d8267fdc58f9eaa5460a9", "ja3_variant_count": 1, "ja3_variants": [ "b5c0e4c50b9d8267fdc58f9eaa5460a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_fb15612a168b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "fb15612a168b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-0-13-51764-35-5-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790976622, "last_seen": 1790976622, "transport": "t", "ja3_hash": "cf48b24be056f4fef65dedbc827fe463", "ja3_variant_count": 1, "ja3_variants": [ "cf48b24be056f4fef65dedbc827fe463" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_020084cf04aa", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "020084cf04aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-27-11-0-65281-16-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790188056, "last_seen": 1790188056, "transport": "t", "ja3_hash": "c712cbca324f6e2bf202ad79ab384570", "ja3_variant_count": 1, "ja3_variants": [ "c712cbca324f6e2bf202ad79ab384570" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_0eb660cbce21", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "0eb660cbce21", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-11-5-65037-10-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790931489, "last_seen": 1790931489, "transport": "t", "ja3_hash": "ad62701a6df588e6ac6d616b2d7db9a9", "ja3_variant_count": 1, "ja3_variants": [ "ad62701a6df588e6ac6d616b2d7db9a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_34da5227fddb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "34da5227fddb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-17613-13-23-27-11-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015031, "last_seen": 1789015031, "transport": "t", "ja3_hash": "bfdc7c0633e5f55b9fb9319c3c4b90f3", "ja3_variant_count": 1, "ja3_variants": [ "bfdc7c0633e5f55b9fb9319c3c4b90f3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_44d1185a2354", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "44d1185a2354", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-10-17613-65281-16-11-18-51,514-4588-24-23-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789201596, "last_seen": 1789201596, "transport": "t", "ja3_hash": "56e39da25b4947c67462865651f33cbf", "ja3_variant_count": 1, "ja3_variants": [ "56e39da25b4947c67462865651f33cbf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_4eb309d87007", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "4eb309d87007", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-0-16-5-65281-17613-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789192491, "last_seen": 1789192491, "transport": "t", "ja3_hash": "247fc9dbd28942d99778ba5c5d23ec0a", "ja3_variant_count": 1, "ja3_variants": [ "247fc9dbd28942d99778ba5c5d23ec0a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_7309306d5346", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "7309306d5346", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-27-18-5-13-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791303609, "last_seen": 1791303609, "transport": "t", "ja3_hash": "c483ee66a876fb7994904ae9e0c1e0a7", "ja3_variant_count": 1, "ja3_variants": [ "c483ee66a876fb7994904ae9e0c1e0a7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_75397ac50362", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "75397ac50362", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-5-17613-65281-0-45-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790730176, "last_seen": 1790730176, "transport": "t", "ja3_hash": "0cb9499d1aa64e81c8647047054892de", "ja3_variant_count": 1, "ja3_variants": [ "0cb9499d1aa64e81c8647047054892de" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_8a6757fad5bc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "8a6757fad5bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-23-16-27-0-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791232112, "last_seen": 1791232112, "transport": "t", "ja3_hash": "e0e6d24a1e768b6e948c42ff4351b12c", "ja3_variant_count": 1, "ja3_variants": [ "e0e6d24a1e768b6e948c42ff4351b12c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_925830fd4017", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "925830fd4017", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51764-65037-0-13-23-65281-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791201465, "last_seen": 1791201465, "transport": "t", "ja3_hash": "50b6763179c253314761a7e6434e5d19", "ja3_variant_count": 1, "ja3_variants": [ "50b6763179c253314761a7e6434e5d19" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_a2b8ec2fab92", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "a2b8ec2fab92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-65281-13-45-0-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791241801, "last_seen": 1791241801, "transport": "t", "ja3_hash": "d9ac23506f9f67e65e08f330ff04529c", "ja3_variant_count": 1, "ja3_variants": [ "d9ac23506f9f67e65e08f330ff04529c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_b2d066118893", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "b2d066118893", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-65037-16-23-13-51764-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790601248, "last_seen": 1790601248, "transport": "t", "ja3_hash": "f9b2b572686a65bbea2d186bd827c2ef", "ja3_variant_count": 1, "ja3_variants": [ "f9b2b572686a65bbea2d186bd827c2ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_c42553ac3f3a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "c42553ac3f3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-11-45-16-27-17613-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790244508, "last_seen": 1790244508, "transport": "t", "ja3_hash": "d908a7896f2de11be73289dbb82e9b01", "ja3_variant_count": 1, "ja3_variants": [ "d908a7896f2de11be73289dbb82e9b01" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_c8c45698d570", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "c8c45698d570", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-65281-27-5-35-16-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 7, "first_seen": 1790862366, "last_seen": 1790862381, "transport": "t", "ja3_hash": "a72a2790e5164dc2c941ebbd92aee20f", "ja3_variant_count": 1, "ja3_variants": [ "a72a2790e5164dc2c941ebbd92aee20f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_d26ae7312481", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "d26ae7312481", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-10-65037-5-16-18-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788964086, "last_seen": 1788964086, "transport": "t", "ja3_hash": "e201494983a440145265db3367223372", "ja3_variant_count": 1, "ja3_variants": [ "e201494983a440145265db3367223372" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_df935ef199fb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "df935ef199fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-10-16-0-23-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788900223, "last_seen": 1788900223, "transport": "t", "ja3_hash": "8d9a94adb54fed83d507bd09680f3f14", "ja3_variant_count": 1, "ja3_variants": [ "8d9a94adb54fed83d507bd09680f3f14" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e3e9b8d060d3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e3e9b8d060d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,45-17613-0-13-5-16-11-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789472891, "last_seen": 1789472891, "transport": "t", "ja3_hash": "9c20f7dbce8b71fa7a9c291cf2ec63e7", "ja3_variant_count": 1, "ja3_variants": [ "9c20f7dbce8b71fa7a9c291cf2ec63e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e3fad44bbfad", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e3fad44bbfad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-0-16-65281-27-13-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789883817, "last_seen": 1789883817, "transport": "t", "ja3_hash": "37d6f53b78bf01bb2666d473b1168dc7", "ja3_variant_count": 1, "ja3_variants": [ "37d6f53b78bf01bb2666d473b1168dc7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f3dc2e5a963f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f3dc2e5a963f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,0-65281-51764-23-13-35-16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789842143, "last_seen": 1789842143, "transport": "t", "ja3_hash": "1d53df4fcce4971702807c9f178ca1c4", "ja3_variant_count": 1, "ja3_variants": [ "1d53df4fcce4971702807c9f178ca1c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f84c44f192b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f84c44f192b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-5-0-65037-16-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790488639, "last_seen": 1790488639, "transport": "t", "ja3_hash": "93d33354dd8b9f7fa019059316fdf048", "ja3_variant_count": 1, "ja3_variants": [ "93d33354dd8b9f7fa019059316fdf048" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_22c96a4dcb08", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "22c96a4dcb08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-45-11-17613-23-65037-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790202576, "last_seen": 1790202576, "transport": "t", "ja3_hash": "dd9de2e1056330e5a7138f2ed95ce410", "ja3_variant_count": 1, "ja3_variants": [ "dd9de2e1056330e5a7138f2ed95ce410" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_2f990aa6ee5c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "2f990aa6ee5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-45-27-10-51-65281-11-18-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789617341, "last_seen": 1789617341, "transport": "t", "ja3_hash": "94c1d3721512febfeef47d1226f7a955", "ja3_variant_count": 1, "ja3_variants": [ "94c1d3721512febfeef47d1226f7a955" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_523d701eca2b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "523d701eca2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-18-65281-11-10-23-0-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788827721, "last_seen": 1788827721, "transport": "t", "ja3_hash": "54ee17a12090f793f90ce9f1135234b5", "ja3_variant_count": 1, "ja3_variants": [ "54ee17a12090f793f90ce9f1135234b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_551d80ebc832", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "551d80ebc832", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-18-10-27-65037-11-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791303613, "last_seen": 1791303613, "transport": "t", "ja3_hash": "427812b692ca2bc6517cd9a76315b691", "ja3_variant_count": 1, "ja3_variants": [ "427812b692ca2bc6517cd9a76315b691" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_5a000a3b00cb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "5a000a3b00cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-13-17613-0-45-65037-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790299961, "last_seen": 1790299961, "transport": "t", "ja3_hash": "07906529def9a3bfc4fa54b17e5a51f7", "ja3_variant_count": 1, "ja3_variants": [ "07906529def9a3bfc4fa54b17e5a51f7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_5df31951296b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "5df31951296b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-13-17613-0-10-11-5-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789795312, "last_seen": 1789795312, "transport": "t", "ja3_hash": "4d0982f10c004fa9568d99401309122d", "ja3_variant_count": 1, "ja3_variants": [ "4d0982f10c004fa9568d99401309122d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_5df4a0757f51", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "5df4a0757f51", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-0-10-17613-13-18-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791040222, "last_seen": 1791040222, "transport": "t", "ja3_hash": "5377d385e970fc94fe9927c5ed1fe54b", "ja3_variant_count": 1, "ja3_variants": [ "5377d385e970fc94fe9927c5ed1fe54b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_62df07232a7a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "62df07232a7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-27-23-11-17613-45-65281-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789516353, "last_seen": 1789516353, "transport": "t", "ja3_hash": "5d21f8a9e6f9e6db675903c9d7853fc2", "ja3_variant_count": 1, "ja3_variants": [ "5d21f8a9e6f9e6db675903c9d7853fc2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_8b92f2ac46af", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "8b92f2ac46af", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51-45-5-65281-35-0-27-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790428935, "last_seen": 1790428935, "transport": "t", "ja3_hash": "ef333090930af2a37b1d5fbc0bea6e28", "ja3_variant_count": 1, "ja3_variants": [ "ef333090930af2a37b1d5fbc0bea6e28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_9569a32dd19c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "9569a32dd19c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-17613-27-10-51764-35-5-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791253575, "last_seen": 1791253575, "transport": "t", "ja3_hash": "b9b997265f9b8980dfe64bb65ef9c296", "ja3_variant_count": 1, "ja3_variants": [ "b9b997265f9b8980dfe64bb65ef9c296" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_9bcf0a061146", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "9bcf0a061146", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17513-10-65037-0-35-27-5-65281-16,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791281964, "last_seen": 1791281964, "transport": "t", "ja3_hash": "96388e0a7331d9c6a16735ad79507ede", "ja3_variant_count": 1, "ja3_variants": [ "96388e0a7331d9c6a16735ad79507ede" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_9db121d5a102", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "9db121d5a102", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-11-10-27-35-0-23-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788849249, "last_seen": 1788849249, "transport": "t", "ja3_hash": "3750baf84980733fd552e37d5d70b5fd", "ja3_variant_count": 1, "ja3_variants": [ "3750baf84980733fd552e37d5d70b5fd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_a85ddeecf8d7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "a85ddeecf8d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-11-0-18-45-5-35-51-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788823309, "last_seen": 1788823309, "transport": "t", "ja3_hash": "8b80eaa32de7e09382699508c20e7d03", "ja3_variant_count": 1, "ja3_variants": [ "8b80eaa32de7e09382699508c20e7d03" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_aac991d9ed80", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "aac991d9ed80", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-0-65037-35-23-13-5-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788471861, "last_seen": 1788471861, "transport": "t", "ja3_hash": "973943f3f3fdced0cf2789f858914948", "ja3_variant_count": 1, "ja3_variants": [ "973943f3f3fdced0cf2789f858914948" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_b9baecb34289", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "b9baecb34289", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-10-51-23-11-18-5-0-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789734393, "last_seen": 1789734393, "transport": "t", "ja3_hash": "80919e75bfef013424564f8f2f15171c", "ja3_variant_count": 1, "ja3_variants": [ "80919e75bfef013424564f8f2f15171c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_ba3afe7f9987", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "ba3afe7f9987", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-35-27-45-18-13-65281-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790611105, "last_seen": 1790611105, "transport": "t", "ja3_hash": "2ecef2921011ef440b3a7b6e27e3ca18", "ja3_variant_count": 1, "ja3_variants": [ "2ecef2921011ef440b3a7b6e27e3ca18" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_d14f8c511e77", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "d14f8c511e77", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-17613-0-65281-10-18-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790868167, "last_seen": 1790868167, "transport": "t", "ja3_hash": "ee651e9f173634e3fb14cb8d906d7aec", "ja3_variant_count": 1, "ja3_variants": [ "ee651e9f173634e3fb14cb8d906d7aec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_d84232dd3dab", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "d84232dd3dab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-51-5-17613-35-0-27-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790893619, "last_seen": 1790893619, "transport": "t", "ja3_hash": "ed728ef2eb04e13cd1133ebf5d33464d", "ja3_variant_count": 1, "ja3_variants": [ "ed728ef2eb04e13cd1133ebf5d33464d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_d8a888bb3d8d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "d8a888bb3d8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-0-35-13-51764-11-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788459231, "last_seen": 1788459231, "transport": "t", "ja3_hash": "e740d5d2978bcedccce424a2de18e8e5", "ja3_variant_count": 1, "ja3_variants": [ "e740d5d2978bcedccce424a2de18e8e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_de587d65373f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "de587d65373f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-27-13-0-11-5-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790237744, "last_seen": 1790237744, "transport": "t", "ja3_hash": "f03659e0b130224608fea9a0e694d15e", "ja3_variant_count": 1, "ja3_variants": [ "f03659e0b130224608fea9a0e694d15e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_f2884aa22113", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "f2884aa22113", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-13-51-65281-0-35-5-27-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791258965, "last_seen": 1791258965, "transport": "t", "ja3_hash": "b3a130312b03de9acbe7fddd11895df6", "ja3_variant_count": 1, "ja3_variants": [ "b3a130312b03de9acbe7fddd11895df6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_073e58a039a6_f412d49686a8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "073e58a039a6", "c": "f412d49686a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-51-57-47-53-10,0-23-65281-10-11-35-16-5-13-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789720971, "last_seen": 1791184206, "transport": "t", "ja3_hash": "2efb07037a97b06201ab4fe7ec0c326e", "ja3_variant_count": 1, "ja3_variants": [ "2efb07037a97b06201ab4fe7ec0c326e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_0a57d4b41068", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "0a57d4b41068", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-0-51764-23-13-65281-5-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790596081, "last_seen": 1790596081, "transport": "t", "ja3_hash": "15c4c6ec402b110eef5ddaef5321183c", "ja3_variant_count": 1, "ja3_variants": [ "15c4c6ec402b110eef5ddaef5321183c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_106f7bed2bd1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "106f7bed2bd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-11-18-16-0-5-65281-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790556367, "last_seen": 1790556367, "transport": "t", "ja3_hash": "e5ce0d8562614744d58c1fc47fe0d494", "ja3_variant_count": 1, "ja3_variants": [ "e5ce0d8562614744d58c1fc47fe0d494" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_1418c4ebac11", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "1418c4ebac11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-0-13-27-51764-16-45-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788988733, "last_seen": 1788988733, "transport": "t", "ja3_hash": "01b0ea21130ebe41e72b61c2f45ca63c", "ja3_variant_count": 1, "ja3_variants": [ "01b0ea21130ebe41e72b61c2f45ca63c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_195cc76f4ff5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "195cc76f4ff5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-23-0-27-51764-17613-16-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790004398, "last_seen": 1790004398, "transport": "t", "ja3_hash": "42154700f4a175432c5c803e6c95178c", "ja3_variant_count": 1, "ja3_variants": [ "42154700f4a175432c5c803e6c95178c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_22cd2ddff142", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "22cd2ddff142", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-27-5-10-0-17613-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788533124, "last_seen": 1788533124, "transport": "t", "ja3_hash": "89b125f17b6f98570e2866e44e4488d7", "ja3_variant_count": 1, "ja3_variants": [ "89b125f17b6f98570e2866e44e4488d7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_2dd536516309", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "2dd536516309", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-5-16-17613-0-27-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791283427, "last_seen": 1791283427, "transport": "t", "ja3_hash": "a7b63df98ebcc00cda3f0b3dfe536322", "ja3_variant_count": 1, "ja3_variants": [ "a7b63df98ebcc00cda3f0b3dfe536322" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_31b3f0ca4214", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "31b3f0ca4214", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51764-0-16-45-13-17613-18-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469861, "last_seen": 1789469861, "transport": "t", "ja3_hash": "65bd35b429eb05d38a9383c4640cd2d0", "ja3_variant_count": 1, "ja3_variants": [ "65bd35b429eb05d38a9383c4640cd2d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_3a9b2dc512dc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "3a9b2dc512dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-5-65281-11-45-27-17613-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790878141, "last_seen": 1790878141, "transport": "t", "ja3_hash": "b6e593d13ff8d6071be88a1c5a10a575", "ja3_variant_count": 1, "ja3_variants": [ "b6e593d13ff8d6071be88a1c5a10a575" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_5cf66106b46e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "5cf66106b46e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-23-45-16-65037-65281-27-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791255567, "last_seen": 1791255567, "transport": "t", "ja3_hash": "058f274ca1336e67fbcdad9676c44230", "ja3_variant_count": 1, "ja3_variants": [ "058f274ca1336e67fbcdad9676c44230" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_5fad27cca7f5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "5fad27cca7f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-0-27-65037-35-13-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552178, "last_seen": 1788552178, "transport": "t", "ja3_hash": "7cd157e9c264b2662ac20b869c6fb302", "ja3_variant_count": 1, "ja3_variants": [ "7cd157e9c264b2662ac20b869c6fb302" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_61ca40b4f65c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "61ca40b4f65c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-5-45-65281-0-10-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789488137, "last_seen": 1789488137, "transport": "t", "ja3_hash": "046d7bd190ce7b0004b3591efed3f134", "ja3_variant_count": 1, "ja3_variants": [ "046d7bd190ce7b0004b3591efed3f134" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_6916f2462b08", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "6916f2462b08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-16-18-45-65281-35-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391189, "last_seen": 1789391189, "transport": "t", "ja3_hash": "5debb2e64b58fabeced19e47916d33e5", "ja3_variant_count": 1, "ja3_variants": [ "5debb2e64b58fabeced19e47916d33e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_6a5efea09547", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "6a5efea09547", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-10-11-65281-51764-16-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790799457, "last_seen": 1790799457, "transport": "t", "ja3_hash": "305a100673893c3139bcc474fe71b868", "ja3_variant_count": 1, "ja3_variants": [ "305a100673893c3139bcc474fe71b868" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_7210f722cecb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "7210f722cecb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-16-10-35-45-51764-23-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788866160, "last_seen": 1788866160, "transport": "t", "ja3_hash": "a3bc6c4fe9362831c56632ffdb7931b9", "ja3_variant_count": 1, "ja3_variants": [ "a3bc6c4fe9362831c56632ffdb7931b9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_88e3567cf976", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "88e3567cf976", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-0-18-45-65281-27-16-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790734644, "last_seen": 1790734644, "transport": "t", "ja3_hash": "a31102eeaa92d2fd3288e6040f4c4311", "ja3_variant_count": 1, "ja3_variants": [ "a31102eeaa92d2fd3288e6040f4c4311" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_a41c225e7e00", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "a41c225e7e00", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-51764-0-65037-27-10-16-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669041, "last_seen": 1789669041, "transport": "t", "ja3_hash": "3a74b286654514a3133f4b59f83091a7", "ja3_variant_count": 1, "ja3_variants": [ "3a74b286654514a3133f4b59f83091a7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_b7b02df6c943", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "b7b02df6c943", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-0-16-35-65281-5-18-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790819980, "last_seen": 1790819980, "transport": "t", "ja3_hash": "2ebb84f36f7c25ab439839ba82a2c802", "ja3_variant_count": 1, "ja3_variants": [ "2ebb84f36f7c25ab439839ba82a2c802" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_c208f6e9ed61", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "c208f6e9ed61", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-13-65281-11-0-65037-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788835562, "last_seen": 1788835562, "transport": "t", "ja3_hash": "bbb41189b46a0fa416ecec80da569698", "ja3_variant_count": 1, "ja3_variants": [ "bbb41189b46a0fa416ecec80da569698" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_c3131c621638", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "c3131c621638", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-11-27-51764-16-10-13-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790779005, "last_seen": 1790779005, "transport": "t", "ja3_hash": "5a6b019e3cd57403f248549c7070d12f", "ja3_variant_count": 1, "ja3_variants": [ "5a6b019e3cd57403f248549c7070d12f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d50223eb16d4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d50223eb16d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-45-65281-16-23-65037-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789480239, "last_seen": 1789480239, "transport": "t", "ja3_hash": "a3d701ad1ae18fceff2e385187a2fa58", "ja3_variant_count": 1, "ja3_variants": [ "a3d701ad1ae18fceff2e385187a2fa58" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d5afbd9b6dc6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d5afbd9b6dc6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-65037-17613-0-16-45-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789034270, "last_seen": 1789034270, "transport": "t", "ja3_hash": "81df38f31899ff2c647be5eaf98ffad2", "ja3_variant_count": 1, "ja3_variants": [ "81df38f31899ff2c647be5eaf98ffad2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_e4499c7af56d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "e4499c7af56d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-18-17613-27-45-13-0-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790877939, "last_seen": 1790877939, "transport": "t", "ja3_hash": "40436c506d3209703e1c1061a3595dd7", "ja3_variant_count": 1, "ja3_variants": [ "40436c506d3209703e1c1061a3595dd7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_e9a9a2d509ea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "e9a9a2d509ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-23-45-16-10-17613-0-5-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789731597, "last_seen": 1789731597, "transport": "t", "ja3_hash": "0e6bffb02fec07d603a4270cdf474175", "ja3_variant_count": 1, "ja3_variants": [ "0e6bffb02fec07d603a4270cdf474175" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_f0a28ea170d0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "f0a28ea170d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-13-10-16-65037-23-45-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790311848, "last_seen": 1790311848, "transport": "t", "ja3_hash": "a745f140087a0c47cbece37720215388", "ja3_variant_count": 1, "ja3_variants": [ "a745f140087a0c47cbece37720215388" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1510h2_abfee28cc369_11325cc4da89", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1510h2", "b": "abfee28cc369", "c": "11325cc4da89", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49191-52393-49196-49199-156-49195-49187-52392-60-157-5-49171-49161-47-49172,13-10-0-11-35-18-23-5-16-65281,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790853418, "last_seen": 1790853418, "transport": "t", "ja3_hash": "e1a6b9c761d96211eab7e22fc8614c9e", "ja3_variant_count": 1, "ja3_variants": [ "e1a6b9c761d96211eab7e22fc8614c9e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_376a4abb92cd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "376a4abb92cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-17613-13-65281-35-27-23-5-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788867821, "last_seen": 1788867821, "transport": "t", "ja3_hash": "7a88995207618e1040463c8b71797cf2", "ja3_variant_count": 1, "ja3_variants": [ "7a88995207618e1040463c8b71797cf2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_46d437b2278e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "46d437b2278e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-0-18-5-65037-65281-10-35-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789269655, "last_seen": 1789269655, "transport": "t", "ja3_hash": "26903a56860f40e278a1779fcf386a5b", "ja3_variant_count": 1, "ja3_variants": [ "26903a56860f40e278a1779fcf386a5b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_5862e7832ce6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "5862e7832ce6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-0-23-11-51764-27-10-17613-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791015668, "last_seen": 1791015668, "transport": "t", "ja3_hash": "51e25fd2fdb2bb82094a2bab022094d8", "ja3_variant_count": 1, "ja3_variants": [ "51e25fd2fdb2bb82094a2bab022094d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_5a9f01285ae2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "5a9f01285ae2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-51764-23-13-5-45-27-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789923903, "last_seen": 1789923903, "transport": "t", "ja3_hash": "6014aa0e32229beb3c551ade43fa8960", "ja3_variant_count": 1, "ja3_variants": [ "6014aa0e32229beb3c551ade43fa8960" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_6254c299e43d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "6254c299e43d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-35-65037-10-5-45-18-27-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789732995, "last_seen": 1789732995, "transport": "t", "ja3_hash": "cda07e5fe8447bac691e299d29c10a2c", "ja3_variant_count": 1, "ja3_variants": [ "cda07e5fe8447bac691e299d29c10a2c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_91e36e2da395", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "91e36e2da395", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-35-51764-65281-17613-23-0-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790490354, "last_seen": 1790490354, "transport": "t", "ja3_hash": "544dbd43733873d7d0e08591847979f5", "ja3_variant_count": 1, "ja3_variants": [ "544dbd43733873d7d0e08591847979f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_92be78b82230", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "92be78b82230", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-23-35-17613-0-11-10-27-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790994617, "last_seen": 1790994617, "transport": "t", "ja3_hash": "3d2cd3ac717e2247eb8c31a662bc6502", "ja3_variant_count": 1, "ja3_variants": [ "3d2cd3ac717e2247eb8c31a662bc6502" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_b9bd37de95d8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "b9bd37de95d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-11-0-5-65281-45-10-18-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790153200, "last_seen": 1790153200, "transport": "t", "ja3_hash": "61d33dda337c481027837664b8e56a9e", "ja3_variant_count": 1, "ja3_variants": [ "61d33dda337c481027837664b8e56a9e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_cc03343b474a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "cc03343b474a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-65037-0-10-18-5-35-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789965145, "last_seen": 1790680744, "transport": "t", "ja3_hash": "6a345dbd534741814543353fab955253", "ja3_variant_count": 2, "ja3_variants": [ "6a345dbd534741814543353fab955253", "7a98523a1a6fcf24446dfd28bd3a6faa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_ff6acf68a7b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "ff6acf68a7b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-27-0-35-45-17613-51764-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790820975, "last_seen": 1790820975, "transport": "t", "ja3_hash": "1037d8e9722165a0059566be1282a804", "ja3_variant_count": 1, "ja3_variants": [ "1037d8e9722165a0059566be1282a804" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_11d1cbdbfd55", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "11d1cbdbfd55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-65281-18-45-5-11-35-0-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711046, "last_seen": 1788711046, "transport": "t", "ja3_hash": "65575514a1679863c74df4f2d8202588", "ja3_variant_count": 1, "ja3_variants": [ "65575514a1679863c74df4f2d8202588" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_12b57c03608b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "12b57c03608b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-16-5-23-65281-11-51764-18-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711044, "last_seen": 1788711044, "transport": "t", "ja3_hash": "454160b82bdf025d8170b10e9fa46c41", "ja3_variant_count": 1, "ja3_variants": [ "454160b82bdf025d8170b10e9fa46c41" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_139b03624716", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "139b03624716", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-5-10-0-16-27-17613-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790528080, "last_seen": 1790528080, "transport": "t", "ja3_hash": "f528d11a0747b858a8aca98c49d947c3", "ja3_variant_count": 1, "ja3_variants": [ "f528d11a0747b858a8aca98c49d947c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_2dd07853cf44", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "2dd07853cf44", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-5-11-45-0-23-27-35-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791192176, "last_seen": 1791192176, "transport": "t", "ja3_hash": "b26690a47ea6133ab9f92bd9a15d6cc9", "ja3_variant_count": 1, "ja3_variants": [ "b26690a47ea6133ab9f92bd9a15d6cc9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_2dfece8704c5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "2dfece8704c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-27-23-5-13-45-11-0-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791176886, "last_seen": 1791176886, "transport": "t", "ja3_hash": "ce27efa2092204bd3cfd555abd2329d4", "ja3_variant_count": 1, "ja3_variants": [ "ce27efa2092204bd3cfd555abd2329d4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_30ef54c7cff3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "30ef54c7cff3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-18-51764-27-11-5-65037-45-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790941893, "last_seen": 1790941893, "transport": "t", "ja3_hash": "3adeecf88d14ea989750d2066ca5ea34", "ja3_variant_count": 1, "ja3_variants": [ "3adeecf88d14ea989750d2066ca5ea34" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_30f1155c97f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "30f1155c97f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-27-16-10-23-0-11-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788899782, "last_seen": 1788899782, "transport": "t", "ja3_hash": "5ed7e2868ace9f6b22dde3ece898fb64", "ja3_variant_count": 1, "ja3_variants": [ "5ed7e2868ace9f6b22dde3ece898fb64" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_35f47bf3fd74", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "35f47bf3fd74", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-65281-0-65037-5-18-16-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791303609, "last_seen": 1791303609, "transport": "t", "ja3_hash": "96a28a6e73f864f32f6be2229be4471a", "ja3_variant_count": 1, "ja3_variants": [ "96a28a6e73f864f32f6be2229be4471a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_569b24623358", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "569b24623358", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-11-65037-27-23-0-17613-35-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791305711, "last_seen": 1791305711, "transport": "t", "ja3_hash": "ab55710a08e34e0833044427f510a298", "ja3_variant_count": 1, "ja3_variants": [ "ab55710a08e34e0833044427f510a298" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_59523ff55795", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "59523ff55795", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-13-17613-16-23-35-5-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791192306, "last_seen": 1791192306, "transport": "t", "ja3_hash": "464c5ce517c2608753741b5ac008c5b0", "ja3_variant_count": 1, "ja3_variants": [ "464c5ce517c2608753741b5ac008c5b0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_59b6bdbf70a4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "59b6bdbf70a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-17613-35-13-65281-65037-0-5-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790864600, "last_seen": 1790864600, "transport": "t", "ja3_hash": "f405cdcbe53b4428be3ae28481a31add", "ja3_variant_count": 1, "ja3_variants": [ "f405cdcbe53b4428be3ae28481a31add" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_6fa7b7c5ab3c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "6fa7b7c5ab3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-0-18-65281-65037-13-5-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750657, "last_seen": 1789750657, "transport": "t", "ja3_hash": "5286ce1b825385b24877b718aee72c6d", "ja3_variant_count": 1, "ja3_variants": [ "5286ce1b825385b24877b718aee72c6d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_722609c4e077", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "722609c4e077", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-18-11-27-5-16-23-10-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788515684, "last_seen": 1788515684, "transport": "t", "ja3_hash": "f1f96f94a8875bf2cfa7379701e03255", "ja3_variant_count": 1, "ja3_variants": [ "f1f96f94a8875bf2cfa7379701e03255" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_72b92613dbba", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "72b92613dbba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-51764-11-23-18-13-16-0-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790251454, "last_seen": 1790251454, "transport": "t", "ja3_hash": "b0ec5bb193d908fb95c74d8ee0a52ef8", "ja3_variant_count": 1, "ja3_variants": [ "b0ec5bb193d908fb95c74d8ee0a52ef8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_7d660fe68177", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "7d660fe68177", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-13-65037-0-18-17513-16-65281-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788976465, "last_seen": 1788976465, "transport": "t", "ja3_hash": "ffcc08672b6d994fbcf081f88cb8da0f", "ja3_variant_count": 1, "ja3_variants": [ "ffcc08672b6d994fbcf081f88cb8da0f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8dd5c141c42c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8dd5c141c42c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-0-17613-10-45-16-11-23-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790531417, "last_seen": 1790531417, "transport": "t", "ja3_hash": "c9cb4c11c0ae01680e3b2b4991f6797d", "ja3_variant_count": 1, "ja3_variants": [ "c9cb4c11c0ae01680e3b2b4991f6797d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_a27b3041de30", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "a27b3041de30", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-51764-0-18-23-35-45-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791229709, "last_seen": 1791229709, "transport": "t", "ja3_hash": "1afeff41a6edf7f2232e86c4d5730147", "ja3_variant_count": 1, "ja3_variants": [ "1afeff41a6edf7f2232e86c4d5730147" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_a6fa30fe45ad", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "a6fa30fe45ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-0-16-17613-11-23-45-13-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790906617, "last_seen": 1791102394, "transport": "t", "ja3_hash": "1f1202bef379203969734c88a6c13606", "ja3_variant_count": 2, "ja3_variants": [ "1f1202bef379203969734c88a6c13606", "a05fc6f078d0996467cb4f90eada4ead" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_b337454f6645", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "b337454f6645", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-5-11-18-35-13-16-27-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791022136, "last_seen": 1791022136, "transport": "t", "ja3_hash": "90d17abc6ae05fe3d8fe4ff85e2bec0c", "ja3_variant_count": 1, "ja3_variants": [ "90d17abc6ae05fe3d8fe4ff85e2bec0c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_c072d18c18cf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "c072d18c18cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-51764-16-23-13-5-0-17613-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789667823, "last_seen": 1789667823, "transport": "t", "ja3_hash": "4b102c4fc8b89c05b6426d177cdc444f", "ja3_variant_count": 1, "ja3_variants": [ "4b102c4fc8b89c05b6426d177cdc444f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_c77bf7e4c030", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "c77bf7e4c030", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-18-10-35-11-13-0-27-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791022075, "last_seen": 1791022075, "transport": "t", "ja3_hash": "0ba7cfefb896c42da5dee7b8ea1336b6", "ja3_variant_count": 1, "ja3_variants": [ "0ba7cfefb896c42da5dee7b8ea1336b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_e136dacb97e7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "e136dacb97e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-10-45-65281-17613-18-11-16-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788900216, "last_seen": 1788900216, "transport": "t", "ja3_hash": "de4b6e38c29a858c7d13a01206dac93f", "ja3_variant_count": 1, "ja3_variants": [ "de4b6e38c29a858c7d13a01206dac93f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_f0cac484eba8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "f0cac484eba8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51764-65281-10-18-16-45-35-0-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789753855, "last_seen": 1789753855, "transport": "t", "ja3_hash": "6805836f5f99a9b03fb4020c1338fcb9", "ja3_variant_count": 1, "ja3_variants": [ "6805836f5f99a9b03fb4020c1338fcb9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_1688fab856b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "1688fab856b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-13-23-27-18-65281-11-10-45-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788900223, "last_seen": 1788900223, "transport": "t", "ja3_hash": "0b4e24905d6247e6a187a6ff092cce33", "ja3_variant_count": 1, "ja3_variants": [ "0b4e24905d6247e6a187a6ff092cce33" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_b84cfc1faec6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "b84cfc1faec6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-35-65281-5-17613-0-51764-45-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790807818, "last_seen": 1790807818, "transport": "t", "ja3_hash": "b42dcc81b4e7f1c013f74d9369d87886", "ja3_variant_count": 1, "ja3_variants": [ "b42dcc81b4e7f1c013f74d9369d87886" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_c1d43cf48b3a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "c1d43cf48b3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-51764-27-11-35-0-65281-45-23-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789617874, "last_seen": 1789617874, "transport": "t", "ja3_hash": "98e2f935a084628a04b84e2928137d40", "ja3_variant_count": 1, "ja3_variants": [ "98e2f935a084628a04b84e2928137d40" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_c8def42c56a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "c8def42c56a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-13-35-51764-65281-10-65037-45-17613-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469863, "last_seen": 1789469863, "transport": "t", "ja3_hash": "7205c217a6cbdd4a5d219909969f5e4f", "ja3_variant_count": 1, "ja3_variants": [ "7205c217a6cbdd4a5d219909969f5e4f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_d8edff1af1e6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "d8edff1af1e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-51764-35-17613-27-18-13-5-23-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790976622, "last_seen": 1790976622, "transport": "t", "ja3_hash": "2f655b31e7956e38da91743dfb0c2745", "ja3_variant_count": 1, "ja3_variants": [ "2f655b31e7956e38da91743dfb0c2745" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_da8ae372f638", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "da8ae372f638", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-45-18-65037-65281-10-13-23-5-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790252608, "last_seen": 1790252608, "transport": "t", "ja3_hash": "d02cb911786f2ad21312af061620a242", "ja3_variant_count": 1, "ja3_variants": [ "d02cb911786f2ad21312af061620a242" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h1_8daaf6152771_68d52e8bc0f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h1", "b": "8daaf6152771", "c": "68d52e8bc0f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-65281-18-13-35-11-5-0-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790543502, "last_seen": 1790543502, "transport": "t", "ja3_hash": "03f7704a962e470aa2a260f1042e669d", "ja3_variant_count": 1, "ja3_variants": [ "03f7704a962e470aa2a260f1042e669d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1235052c0395", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1235052c0395", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-16-13-35-65037-45-18-27-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789024334, "last_seen": 1789024334, "transport": "t", "ja3_hash": "773f5d065ef239d720fc6a3863675107", "ja3_variant_count": 1, "ja3_variants": [ "773f5d065ef239d720fc6a3863675107" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1da37f9aafbb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1da37f9aafbb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-23-10-0-18-17613-16-13-45-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790933523, "last_seen": 1790933523, "transport": "t", "ja3_hash": "723b0fbee04f984020055575548b5f36", "ja3_variant_count": 1, "ja3_variants": [ "723b0fbee04f984020055575548b5f36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_2170f86d61b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "2170f86d61b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-17613-0-35-45-51764-27-65281-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789063162, "last_seen": 1789063162, "transport": "t", "ja3_hash": "ad504cacf16817c0b679c2e20dc16e1f", "ja3_variant_count": 1, "ja3_variants": [ "ad504cacf16817c0b679c2e20dc16e1f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_271d61939618", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "271d61939618", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-45-65281-5-13-23-16-18-65037-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789785607, "last_seen": 1789785607, "transport": "t", "ja3_hash": "d6ff2c8de312c8e4726d316d93b53940", "ja3_variant_count": 1, "ja3_variants": [ "d6ff2c8de312c8e4726d316d93b53940" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_2fd58e7266c1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "2fd58e7266c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-45-0-11-51764-27-23-16-18-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790082406, "last_seen": 1790082406, "transport": "t", "ja3_hash": "bf0e5868b7959657c72142216f2df92d", "ja3_variant_count": 1, "ja3_variants": [ "bf0e5868b7959657c72142216f2df92d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_3d832be87f33", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "3d832be87f33", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-13-5-0-65281-16-10-27-65037-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789694707, "last_seen": 1789694707, "transport": "t", "ja3_hash": "299e3f88f6ad63901ebab098429c185a", "ja3_variant_count": 1, "ja3_variants": [ "299e3f88f6ad63901ebab098429c185a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_4e347bfd433f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "4e347bfd433f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51764-0-5-45-27-17613-16-65037-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789679046, "last_seen": 1789679046, "transport": "t", "ja3_hash": "606116c78c0693957de0e62e259ce341", "ja3_variant_count": 1, "ja3_variants": [ "606116c78c0693957de0e62e259ce341" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_81add266b544", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "81add266b544", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-65281-5-13-17613-0-23-35-16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791202530, "last_seen": 1791202530, "transport": "t", "ja3_hash": "076659e9779b656d60831aada5a68481", "ja3_variant_count": 1, "ja3_variants": [ "076659e9779b656d60831aada5a68481" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_854247e86784", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "854247e86784", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-27-11-23-16-10-18-17613-5-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790237744, "last_seen": 1790237744, "transport": "t", "ja3_hash": "a03c21adb4c5ded1446a5a36b3b1f0cf", "ja3_variant_count": 1, "ja3_variants": [ "a03c21adb4c5ded1446a5a36b3b1f0cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_8b5473f50f9e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "8b5473f50f9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-11-65037-45-16-17613-23-0-27-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790623645, "last_seen": 1790623645, "transport": "t", "ja3_hash": "081a2ce5dc9c55bd9dfb001a0102618f", "ja3_variant_count": 1, "ja3_variants": [ "081a2ce5dc9c55bd9dfb001a0102618f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_97944220f2ef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "97944220f2ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-0-35-10-45-5-65281-27-16-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790730174, "last_seen": 1790730174, "transport": "t", "ja3_hash": "8619ac870c5ca90be96512a9e8d2bb1a", "ja3_variant_count": 1, "ja3_variants": [ "8619ac870c5ca90be96512a9e8d2bb1a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_d2f58b9befeb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "d2f58b9befeb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-18-65281-11-13-5-17513-0-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791108050, "last_seen": 1791108050, "transport": "t", "ja3_hash": "6bfed18913a07631bd1c8f7d55d1e25f", "ja3_variant_count": 1, "ja3_variants": [ "6bfed18913a07631bd1c8f7d55d1e25f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_ebb0d8e3ac2c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "ebb0d8e3ac2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-35-10-18-16-13-11-27-45-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789556193, "last_seen": 1789556193, "transport": "t", "ja3_hash": "2aa20a7b6cabedec58dbed4144ad8c3a", "ja3_variant_count": 1, "ja3_variants": [ "2aa20a7b6cabedec58dbed4144ad8c3a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_eca08b9a2194", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "eca08b9a2194", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-18-16-65037-51764-17613-0-35-45-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790060661, "last_seen": 1790060661, "transport": "t", "ja3_hash": "ec02d9ca1408a7528854470811356928", "ja3_variant_count": 1, "ja3_variants": [ "ec02d9ca1408a7528854470811356928" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_7c17162d57c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "7c17162d57c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-17613-27-23-18-45-51764-65281-10-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789641489, "last_seen": 1789641489, "transport": "t", "ja3_hash": "f01b2a53a4f6ec50bf1f72523d80026c", "ja3_variant_count": 1, "ja3_variants": [ "f01b2a53a4f6ec50bf1f72523d80026c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_b09642ef1b96", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "b09642ef1b96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-18-23-13-65037-5-11-35-45-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790234294, "last_seen": 1790234294, "transport": "t", "ja3_hash": "f9735d4e06166be8c4699dacf6901aa4", "ja3_variant_count": 1, "ja3_variants": [ "f9735d4e06166be8c4699dacf6901aa4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_d735600089ac", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "d735600089ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-0-51764-17613-5-65281-11-65037-10-35-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789913345, "last_seen": 1789913345, "transport": "t", "ja3_hash": "aff45240c140b56feee7ae1c3f442d37", "ja3_variant_count": 1, "ja3_variants": [ "aff45240c140b56feee7ae1c3f442d37" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_ee0f559d2348", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "ee0f559d2348", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-17613-65037-5-10-13-18-35-0-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788777960, "last_seen": 1788777960, "transport": "t", "ja3_hash": "559b2aa773918be4de811f952bda1f60", "ja3_variant_count": 1, "ja3_variants": [ "559b2aa773918be4de811f952bda1f60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_1fc27656785e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "1fc27656785e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-5-13-65281-16-18-0-11-65037-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790240009, "last_seen": 1790240009, "transport": "t", "ja3_hash": "7d74340dbed196ceff6b3f6a95b0f23a", "ja3_variant_count": 1, "ja3_variants": [ "7d74340dbed196ceff6b3f6a95b0f23a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_20aa904ea21f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "20aa904ea21f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-51764-16-17613-35-27-0-11-18-45-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789929107, "last_seen": 1789929107, "transport": "t", "ja3_hash": "e0f795b5a69aff27c26cc454f9696f2c", "ja3_variant_count": 1, "ja3_variants": [ "e0f795b5a69aff27c26cc454f9696f2c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_21a12b38d9f9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "21a12b38d9f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-0-45-10-5-17613-11-65037-65281-23-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791040177, "last_seen": 1791040177, "transport": "t", "ja3_hash": "4389bc4f5cd78fa01d3a0ada4f41cd87", "ja3_variant_count": 1, "ja3_variants": [ "4389bc4f5cd78fa01d3a0ada4f41cd87" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_2217b4dc6dd3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "2217b4dc6dd3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-17613-10-65281-0-16-45-18-27-65037-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790064257, "last_seen": 1790064257, "transport": "t", "ja3_hash": "3eafd6112ae4521701d971cb0ad0320e", "ja3_variant_count": 1, "ja3_variants": [ "3eafd6112ae4521701d971cb0ad0320e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_29b93b360dca", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "29b93b360dca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-65037-27-23-17613-10-13-0-65281-18-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790269782, "last_seen": 1790269782, "transport": "t", "ja3_hash": "82d4be1c4272fd8bce4a2ae9659c1037", "ja3_variant_count": 1, "ja3_variants": [ "82d4be1c4272fd8bce4a2ae9659c1037" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_2c9b18a1e084", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "2c9b18a1e084", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-23-10-13-65037-45-18-35-0-65281-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790916247, "last_seen": 1790916247, "transport": "t", "ja3_hash": "98f0d9c5627d2cc287ef4979ffec56d6", "ja3_variant_count": 1, "ja3_variants": [ "98f0d9c5627d2cc287ef4979ffec56d6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_3e2fb2398056", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "3e2fb2398056", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-45-5-11-65281-0-10-51764-18-16-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789231683, "last_seen": 1789231683, "transport": "t", "ja3_hash": "456943480ad94605c42d69e7c11d78dd", "ja3_variant_count": 1, "ja3_variants": [ "456943480ad94605c42d69e7c11d78dd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_484bdba34081", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "484bdba34081", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-65037-17613-13-51764-0-5-35-11-45-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790764991, "last_seen": 1790764991, "transport": "t", "ja3_hash": "f587749b3d8ac7a7ce55e7e39594f8b6", "ja3_variant_count": 1, "ja3_variants": [ "f587749b3d8ac7a7ce55e7e39594f8b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_5c6fb5164846", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "5c6fb5164846", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-35-18-45-11-13-16-65281-65037-51764-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789739403, "last_seen": 1789739403, "transport": "t", "ja3_hash": "26fb5abdc6c44e7b99457f5b054e716c", "ja3_variant_count": 1, "ja3_variants": [ "26fb5abdc6c44e7b99457f5b054e716c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_69a0c0890ddc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "69a0c0890ddc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-11-0-16-65281-27-17613-5-18-13-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790829569, "last_seen": 1790829569, "transport": "t", "ja3_hash": "c887fe573835b0c4ce92dd1e46c48cce", "ja3_variant_count": 1, "ja3_variants": [ "c887fe573835b0c4ce92dd1e46c48cce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_6f5c1e5c2f55", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "6f5c1e5c2f55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-35-13-23-0-18-45-27-10-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789556191, "last_seen": 1789556191, "transport": "t", "ja3_hash": "6bacacf19c64057ebcfe33f8c5eb13a8", "ja3_variant_count": 1, "ja3_variants": [ "6bacacf19c64057ebcfe33f8c5eb13a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_7de80710b7f0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "7de80710b7f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-11-65281-17613-0-13-51764-18-65037-45-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790055347, "last_seen": 1790055347, "transport": "t", "ja3_hash": "db06c5c2bf68ddb5003c851ed1f7fbc2", "ja3_variant_count": 1, "ja3_variants": [ "db06c5c2bf68ddb5003c851ed1f7fbc2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_81a3b5c0dbca", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "81a3b5c0dbca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,65281-0-16-45-35-27-65037-10-5-13-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789719564, "last_seen": 1789719564, "transport": "t", "ja3_hash": "09e5db25d380dc87ea219e405f3737fc", "ja3_variant_count": 1, "ja3_variants": [ "09e5db25d380dc87ea219e405f3737fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_861e9dcdcffc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "861e9dcdcffc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-16-11-0-23-10-18-13-65281-5-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788643387, "last_seen": 1788643387, "transport": "t", "ja3_hash": "eeab3b080223d0edf7f620094e81d23a", "ja3_variant_count": 1, "ja3_variants": [ "eeab3b080223d0edf7f620094e81d23a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_a4afb8a89362", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "a4afb8a89362", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-5-16-10-35-45-13-0-65037-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789662836, "last_seen": 1789662836, "transport": "t", "ja3_hash": "d3176712361445a7362d981f40741f31", "ja3_variant_count": 1, "ja3_variants": [ "d3176712361445a7362d981f40741f31" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_af2b06b918d2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "af2b06b918d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-45-65037-16-65281-35-10-0-23-51764-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790362141, "last_seen": 1790362141, "transport": "t", "ja3_hash": "2e439f03a6e3f748044b6b34a67c82e6", "ja3_variant_count": 1, "ja3_variants": [ "2e439f03a6e3f748044b6b34a67c82e6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_ba3e74145d2d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "ba3e74145d2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-18-16-35-27-10-65037-0-23-17613-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789885579, "last_seen": 1789885579, "transport": "t", "ja3_hash": "2c86f9fb3f754b0e13c6d04c9bfea2e4", "ja3_variant_count": 1, "ja3_variants": [ "2c86f9fb3f754b0e13c6d04c9bfea2e4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_d323c33fb431", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "d323c33fb431", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-11-65281-5-65037-27-0-13-10-23-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789722974, "last_seen": 1789722974, "transport": "t", "ja3_hash": "a8eba56a3cf097bd4bb43e6b572a1e58", "ja3_variant_count": 1, "ja3_variants": [ "a8eba56a3cf097bd4bb43e6b572a1e58" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1513h2_8daaf6152771_db19c28115c4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1513h2", "b": "8daaf6152771", "c": "db19c28115c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-27-65281-51-17513-16-45-65037-18-35-11-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790944212, "last_seen": 1790944212, "transport": "t", "ja3_hash": "5e8ecc735a05ac288bea2ac768dbcff7", "ja3_variant_count": 1, "ja3_variants": [ "5e8ecc735a05ac288bea2ac768dbcff7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_422c0872b983", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "422c0872b983", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-23-17613-10-13-11-27-35-45-0-65281-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790124045, "last_seen": 1790124045, "transport": "t", "ja3_hash": "c87a4c78acf2ae0571b7d7157bdc42aa", "ja3_variant_count": 1, "ja3_variants": [ "c87a4c78acf2ae0571b7d7157bdc42aa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_9f86501cadc8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "9f86501cadc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-11-17613-23-0-5-35-65037-10-13-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790639993, "last_seen": 1790639993, "transport": "t", "ja3_hash": "6dcb7bde7058768df9e27467d40ff745", "ja3_variant_count": 1, "ja3_variants": [ "6dcb7bde7058768df9e27467d40ff745" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_b0e6af452bc4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "b0e6af452bc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-10-13-65037-0-27-23-35-11-65281-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791138619, "last_seen": 1791138619, "transport": "t", "ja3_hash": "1de96165497b078d03807f52bd936171", "ja3_variant_count": 1, "ja3_variants": [ "1de96165497b078d03807f52bd936171" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_c3dd6200a952", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "c3dd6200a952", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-45-35-11-23-0-17613-65037-13-51764-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789436550, "last_seen": 1789436550, "transport": "t", "ja3_hash": "637557be4d821bad2b422fdbd4215910", "ja3_variant_count": 1, "ja3_variants": [ "637557be4d821bad2b422fdbd4215910" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d151400_8daaf6152771_c6a9d134343e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d151400", "b": "8daaf6152771", "c": "c6a9d134343e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-0-10-11-27-65037-35-65281-18-17613-13-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791112534, "last_seen": 1791112534, "transport": "t", "ja3_hash": "eb0dbeaba53d81d7621666a79b869de2", "ja3_variant_count": 1, "ja3_variants": [ "eb0dbeaba53d81d7621666a79b869de2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_2222be3f10cd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "2222be3f10cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-65281-18-17613-10-23-13-0-11-27-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791312112, "last_seen": 1791312112, "transport": "t", "ja3_hash": "d0f522063667ba1bde112edb4b5ed40b", "ja3_variant_count": 1, "ja3_variants": [ "d0f522063667ba1bde112edb4b5ed40b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_22aa0ec41cc5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "22aa0ec41cc5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-23-51764-35-11-16-5-65037-27-45-0-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790601305, "last_seen": 1790601305, "transport": "t", "ja3_hash": "ebcd8adedfb5c6a395fd868bb7b45d19", "ja3_variant_count": 1, "ja3_variants": [ "ebcd8adedfb5c6a395fd868bb7b45d19" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_2448c53f8442", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "2448c53f8442", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-65037-65281-35-11-13-10-45-51764-23-0-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791071852, "last_seen": 1791071852, "transport": "t", "ja3_hash": "9a5f9eaf5c1027a2f83e508877889362", "ja3_variant_count": 1, "ja3_variants": [ "9a5f9eaf5c1027a2f83e508877889362" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_25a14435e36a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "25a14435e36a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-13-65281-27-0-51764-45-5-16-65037-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789820704, "last_seen": 1789820704, "transport": "t", "ja3_hash": "b15eae16d73bd729a272afff384c7289", "ja3_variant_count": 1, "ja3_variants": [ "b15eae16d73bd729a272afff384c7289" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_4906fc499ab7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "4906fc499ab7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-11-45-18-65281-35-17613-10-23-27-16-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790428937, "last_seen": 1790428937, "transport": "t", "ja3_hash": "6e753a1cc70240ff75ba34ab8bb774e6", "ja3_variant_count": 1, "ja3_variants": [ "6e753a1cc70240ff75ba34ab8bb774e6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_49fb45ee539f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "49fb45ee539f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-35-45-11-51-0-17513-18-5-10-13-23-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791287423, "last_seen": 1791287423, "transport": "t", "ja3_hash": "5bd8feff78fcf20f663616066a66932c", "ja3_variant_count": 1, "ja3_variants": [ "5bd8feff78fcf20f663616066a66932c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_793f6c46d541", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "793f6c46d541", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-65037-35-13-27-18-11-65281-51764-23-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789744516, "last_seen": 1789744516, "transport": "t", "ja3_hash": "137ca73fc639d8a0ab6355ddb7795a81", "ja3_variant_count": 1, "ja3_variants": [ "137ca73fc639d8a0ab6355ddb7795a81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_a9de1a46c76f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "a9de1a46c76f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-5-35-11-65281-27-45-16-13-51764-65037-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790667892, "last_seen": 1790667892, "transport": "t", "ja3_hash": "aae9e4dfa07870995c73bf206b19b788", "ja3_variant_count": 1, "ja3_variants": [ "aae9e4dfa07870995c73bf206b19b788" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_adf959c0ea83", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "adf959c0ea83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-35-13-65037-45-18-23-16-11-0-5-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790962562, "last_seen": 1790962562, "transport": "t", "ja3_hash": "666bc70cc697e096b126b349ec1a91b1", "ja3_variant_count": 1, "ja3_variants": [ "666bc70cc697e096b126b349ec1a91b1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_b3daed529873", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "b3daed529873", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-35-65037-65281-13-45-27-16-23-5-0-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790060421, "last_seen": 1790060421, "transport": "t", "ja3_hash": "c29cc7fa8b121aceed82dac48c5c1bd4", "ja3_variant_count": 1, "ja3_variants": [ "c29cc7fa8b121aceed82dac48c5c1bd4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_bc7d8c526a84", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "bc7d8c526a84", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-13-16-23-10-45-65281-5-17613-27-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790788777, "last_seen": 1790788777, "transport": "t", "ja3_hash": "f8c0be5e46a12554d5f7945e5af197a5", "ja3_variant_count": 1, "ja3_variants": [ "f8c0be5e46a12554d5f7945e5af197a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_e6c9a88f42b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "e6c9a88f42b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-65037-10-23-13-0-11-16-5-27-45-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931565, "last_seen": 1789931565, "transport": "t", "ja3_hash": "479eed5204ec3c2832b9ba53e1b8bcb5", "ja3_variant_count": 1, "ja3_variants": [ "479eed5204ec3c2832b9ba53e1b8bcb5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1514h2_8daaf6152771_f442e4d23ff6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1514h2", "b": "8daaf6152771", "c": "f442e4d23ff6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-16-10-18-65281-11-65037-13-23-17613-35-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788535993, "last_seen": 1788535993, "transport": "t", "ja3_hash": "d644b4ca8dff5435d08dc38fe5fa0aa1", "ja3_variant_count": 1, "ja3_variants": [ "d644b4ca8dff5435d08dc38fe5fa0aa1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_03a19d5278e6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "03a19d5278e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-10-0-16-17613-65281-18-5-65037-45-27-13-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789732681, "last_seen": 1789732681, "transport": "t", "ja3_hash": "83cdb5f80d5f3f98a8bbb11e31737834", "ja3_variant_count": 1, "ja3_variants": [ "83cdb5f80d5f3f98a8bbb11e31737834" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_09ce68a64ac1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "09ce68a64ac1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-18-45-17613-10-27-23-0-5-13-65037-65281-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027379, "last_seen": 1789027379, "transport": "t", "ja3_hash": "2d6922e024f15518a6bf5e57b8ba9444", "ja3_variant_count": 1, "ja3_variants": [ "2d6922e024f15518a6bf5e57b8ba9444" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_0c4b4c30d0dd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "0c4b4c30d0dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-65037-11-27-51764-0-10-16-45-18-35-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788461891, "last_seen": 1788461891, "transport": "t", "ja3_hash": "7cb721a109b60dfd7fa6cb962b2a96c2", "ja3_variant_count": 1, "ja3_variants": [ "7cb721a109b60dfd7fa6cb962b2a96c2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_0d9c62265aa3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "0d9c62265aa3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-13-11-18-51764-65037-45-17613-0-5-27-16-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789240088, "last_seen": 1789240088, "transport": "t", "ja3_hash": "b500a9576e9ab62fb228b77280d024e5", "ja3_variant_count": 1, "ja3_variants": [ "b500a9576e9ab62fb228b77280d024e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_37a7dc93cc8c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "37a7dc93cc8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65037-16-18-10-65281-11-0-27-35-51764-45-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788967483, "last_seen": 1788967483, "transport": "t", "ja3_hash": "8d56aaa34f2bb69f2759981e2434f534", "ja3_variant_count": 1, "ja3_variants": [ "8d56aaa34f2bb69f2759981e2434f534" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_5e2165e4963a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "5e2165e4963a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-23-13-10-11-65281-18-35-5-17613-0-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788897970, "last_seen": 1788897970, "transport": "t", "ja3_hash": "cf66d0816002f228a47aca3f9de63ff6", "ja3_variant_count": 1, "ja3_variants": [ "cf66d0816002f228a47aca3f9de63ff6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_6cbde9051cc0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "6cbde9051cc0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,23-13-16-65281-18-0-51764-45-35-5-27-11-17613-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788887846, "last_seen": 1788887846, "transport": "t", "ja3_hash": "fb9d246e89c0b5ee85d282a1ddeeabc1", "ja3_variant_count": 1, "ja3_variants": [ "fb9d246e89c0b5ee85d282a1ddeeabc1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_7645b50074e1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "7645b50074e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-27-10-17613-18-0-16-23-65281-11-5-51764-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789026972, "last_seen": 1789026972, "transport": "t", "ja3_hash": "7af2391a26de63b09bfb81a45df54387", "ja3_variant_count": 1, "ja3_variants": [ "7af2391a26de63b09bfb81a45df54387" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_7a7b06fa4164", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "7a7b06fa4164", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-27-17613-18-45-51764-23-65037-16-13-11-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789989018, "last_seen": 1789989018, "transport": "t", "ja3_hash": "cffa3ae8e36166580c177a30bc993891", "ja3_variant_count": 1, "ja3_variants": [ "cffa3ae8e36166580c177a30bc993891" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_c57922a65c6a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "c57922a65c6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-11-16-10-0-23-65281-65037-17613-35-18-45-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791283428, "last_seen": 1791283428, "transport": "t", "ja3_hash": "e3003d2f00f38e526c5a2eeebc357703", "ja3_variant_count": 1, "ja3_variants": [ "e3003d2f00f38e526c5a2eeebc357703" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1515h2_8daaf6152771_f6615d59cd5c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1515h2", "b": "8daaf6152771", "c": "f6615d59cd5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-17613-0-51764-45-65037-13-65281-18-10-23-11-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789998655, "last_seen": 1789998655, "transport": "t", "ja3_hash": "cf4317e0f8b202ba1475729e46eb9d4c", "ja3_variant_count": 1, "ja3_variants": [ "cf4317e0f8b202ba1475729e46eb9d4c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1516h2_8daaf6152771_2d9ee4d0ad3f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1516h2", "b": "8daaf6152771", "c": "2d9ee4d0ad3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-16-11-5-65281-13-51764-65037-23-17613-27-45-0-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789034262, "last_seen": 1789034262, "transport": "t", "ja3_hash": "67637063997e0c421ae3406e456c14a6", "ja3_variant_count": 1, "ja3_variants": [ "67637063997e0c421ae3406e456c14a6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1516h2_8daaf6152771_6ba66e7c09ab", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1516h2", "b": "8daaf6152771", "c": "6ba66e7c09ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-18-51764-0-35-65037-4832-23-5-16-13-45-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789701023, "last_seen": 1789701023, "transport": "t", "ja3_hash": "c1e48179ed2c4d4693c6f99584d68b66", "ja3_variant_count": 1, "ja3_variants": [ "c1e48179ed2c4d4693c6f99584d68b66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d160800_8cdfa2d4673b_b80abeb657b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d160800", "b": "8cdfa2d4673b", "c": "b80abeb657b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 16, "extension_count": 8, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10,0-5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 150, "first_seen": 1787495080, "last_seen": 1791353484, "transport": "t", "ja3_hash": "a4af752b7cb5ef242a98c0c7f446a96d", "ja3_variant_count": 1, "ja3_variants": [ "a4af752b7cb5ef242a98c0c7f446a96d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d161000_bac3852d4616_71776a6e6e2b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d161000", "b": "bac3852d4616", "c": "71776a6e6e2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49196-156-157-49200-52392-49187-60-49195-49199-52393-49191-10-49162-49159-49161-47,21-13-18-5-11-65281-35-23-0-10,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 21, "name": "padding", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789502864, "last_seen": 1789502864, "transport": "t", "ja3_hash": "bff455a0da7a6ca1640648a58d6693ef", "ja3_variant_count": 1, "ja3_variants": [ "bff455a0da7a6ca1640648a58d6693ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d170600_5b57614c22b0_047df114b631", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d170600", "b": "5b57614c22b0", "c": "047df114b631", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-11-51-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790856957, "last_seen": 1790856957, "transport": "t", "ja3_hash": "838c9ff622f8b8cdab3fc53fcdf1cab5", "ja3_variant_count": 1, "ja3_variants": [ "838c9ff622f8b8cdab3fc53fcdf1cab5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1710h2_5d45335196f8_5302501154e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1710h2", "b": "5d45335196f8", "c": "5302501154e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49187-157-49196-60-52393-49199-49200-49191-52392-156-49171-53-5-49159-49172-49161-10,13-0-10-5-11-16-65281-35-18-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791217954, "last_seen": 1791217954, "transport": "t", "ja3_hash": "bf8694c3d88f0022bac6f25b3b099b17", "ja3_variant_count": 1, "ja3_variants": [ "bf8694c3d88f0022bac6f25b3b099b17" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1711h1_5b57614c22b0_d51f866a7e11", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t12d1711h1", "b": "5b57614c22b0", "c": "d51f866a7e11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 17, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790533253, "last_seen": 1790722173, "transport": "t", "ja3_hash": "96b22128f807c8a6c212074cc3acc98a", "ja3_variant_count": 1, "ja3_variants": [ "96b22128f807c8a6c212074cc3acc98a" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OpenCode-User/1.0; +https://opencode.ai": 2, "Bun/1.4.2": 1 }, "ua_disagreement": false } }, { "hash": "t12d180800_4b22cbed5bed_62f610611f10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d180800", "b": "4b22cbed5bed", "c": "62f610611f10", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1787594707, "last_seen": 1791218211, "transport": "t", "ja3_hash": "258a5a1e95b8a911872bae9081526644", "ja3_variant_count": 1, "ja3_variants": [ "258a5a1e95b8a911872bae9081526644" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1809h1_5d04281c6031_08de9d6ffbb8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t12d1809h1", "b": "5d04281c6031", "c": "08de9d6ffbb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49199-49195-49200-49196-49191-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-16-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791314140, "last_seen": 1791314140, "transport": "t", "ja3_hash": "ba30c8215a9bfc9e305204124fa98a09", "ja3_variant_count": 1, "ja3_variants": [ "ba30c8215a9bfc9e305204124fa98a09" ], "user_agents": { "deepseek-harness/0.0.1 (+https://github.com/deepseek-ai)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1809h2_4da576aed5c1_6dadff81672f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1809h2", "b": "4da576aed5c1", "c": "6dadff81672f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,52392-60-49196-49191-49199-49200-49187-52393-49195-156-157-47-53-49169-49170-49161-49162-10,5-18-23-13-10-0-35-16-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789802337, "last_seen": 1789802337, "transport": "t", "ja3_hash": "7cbde9699d7dec06cb8bfb098efcc0a1", "ja3_variant_count": 1, "ja3_variants": [ "7cbde9699d7dec06cb8bfb098efcc0a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1809h2_ca1ff0992a9f_a9efee95875b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1809h2", "b": "ca1ff0992a9f", "c": "a9efee95875b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,60-157-52393-52392-49191-49199-49195-49200-49187-156-49169-49170-49172-10-47-49162-53-5,0-65281-18-23-13-16-11-35-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790358522, "last_seen": 1790358522, "transport": "t", "ja3_hash": "de4316c8ed3d6fbe46ff07b7542dfac8", "ja3_variant_count": 1, "ja3_variants": [ "de4316c8ed3d6fbe46ff07b7542dfac8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1810h2_b1064e464c5c_e173790c61ff", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1810h2", "b": "b1064e464c5c", "c": "e173790c61ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,60-49191-49199-49200-52392-49196-157-49187-156-52393-49195-49161-5-49171-49169-10-49162-47,23-11-65281-13-35-16-21-10-0-18,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790985761, "last_seen": 1790985761, "transport": "t", "ja3_hash": "3ded3ccbc4ceeeceb56fbeb295b0c970", "ja3_variant_count": 1, "ja3_variants": [ "3ded3ccbc4ceeeceb56fbeb295b0c970" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d190600_826a7383a64d_66cfc59077e0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d190600", "b": "826a7383a64d", "c": "66cfc59077e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-49199-158-49162-49161-49171-49172-49159-49169-51-50-57-156-47-53-10-5-4-255,0-11-10-35-13-15,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 33, "first_seen": 1787488236, "last_seen": 1791296039, "transport": "t", "ja3_hash": "1885aa9927f99ed538ed895d9335995c", "ja3_variant_count": 1, "ja3_variants": [ "1885aa9927f99ed538ed895d9335995c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d190700_724f0b7e6496_dead13803058", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d190700", "b": "724f0b7e6496", "c": "dead13803058", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-255,0-10-11-23-35-13-45,29-23-24-25-30,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789588217, "last_seen": 1789588217, "transport": "t", "ja3_hash": "cae1b13191e105f49d96a781c7dd74ef", "ja3_variant_count": 1, "ja3_variants": [ "cae1b13191e105f49d96a781c7dd74ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d190700_d83cc789557e_8e03bb9b6084", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d190700", "b": "d83cc789557e", "c": "8e03bb9b6084", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,11-10-65281-0-5-13-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790498741, "last_seen": 1790498741, "transport": "t", "ja3_hash": "ae3ea46dd92d56c0fb6b6d30aac81f3f", "ja3_variant_count": 1, "ja3_variants": [ "ae3ea46dd92d56c0fb6b6d30aac81f3f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d190800_d83cc789557e_62f610611f10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d190800", "b": "d83cc789557e", "c": "62f610611f10", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 164, "first_seen": 1787558090, "last_seen": 1791361916, "transport": "t", "ja3_hash": "a0e9f5d64349fb13191bc781f81f42e1", "ja3_variant_count": 1, "ja3_variants": [ "a0e9f5d64349fb13191bc781f81f42e1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1909h2_04cf00e2c016_1ca79865cae6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1909h2", "b": "04cf00e2c016", "c": "1ca79865cae6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,157-49187-49199-49200-52393-60-156-49191-52392-5-47-49171-49169-49161-53-49162-10-49170-49172,23-13-10-5-11-35-16-0-65281,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791048827, "last_seen": 1791048827, "transport": "t", "ja3_hash": "fee71a077a867c0f3bc4dbcb374c04c5", "ja3_variant_count": 1, "ja3_variants": [ "fee71a077a867c0f3bc4dbcb374c04c5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1910h2_d83cc789557e_396e29a8f06b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1910h2", "b": "d83cc789557e", "c": "396e29a8f06b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-24-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791351547, "last_seen": 1791351547, "transport": "t", "ja3_hash": "10ee8d30a5d01c042afd7b2b205facc4", "ja3_variant_count": 1, "ja3_variants": [ "10ee8d30a5d01c042afd7b2b205facc4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1910h2_e23e2c49fe80_9cf6fd8da9d8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d1910h2", "b": "e23e2c49fe80", "c": "9cf6fd8da9d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49199-157-52393-52392-49195-60-156-49200-49187-49169-47-49171-53-5-49162-49161-49172-49159-49170,23-13-18-10-35-5-0-21-11-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791084560, "last_seen": 1791084560, "transport": "t", "ja3_hash": "cfdc6777520e5c00d04548b0fd8fa71e", "ja3_variant_count": 1, "ja3_variants": [ "cfdc6777520e5c00d04548b0fd8fa71e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d200600_19d7ba6ed342_617aa96a424f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d200600", "b": "19d7ba6ed342", "c": "617aa96a424f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 6, "alpn": null } }, "ja3_string": "771,157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-5-10-255,0-35-5-22-23-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787825497, "last_seen": 1790703163, "transport": "t", "ja3_hash": "e7b042ca84c354ea70e87678c32bb511", "ja3_variant_count": 1, "ja3_variants": [ "e7b042ca84c354ea70e87678c32bb511" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d200700_c903b3b6e441_6a6462463895", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d200700", "b": "c903b3b6e441", "c": "6a6462463895", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10-255,0-11-10-35-5-23-13,29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791034795, "last_seen": 1791034795, "transport": "t", "ja3_hash": "68e52bfcaacb5e9f03157d88642739d5", "ja3_variant_count": 1, "ja3_variants": [ "68e52bfcaacb5e9f03157d88642739d5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d2007h2_a8b3e4156f07_2eb009e832fe", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d2007h2", "b": "a8b3e4156f07", "c": "2eb009e832fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,157-60-156-49199-49196-49200-52392-49191-52393-49195-49162-49169-49171-5-49159-49170-49172-47-53-10,35-5-0-11-13-16-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789662151, "last_seen": 1789662151, "transport": "t", "ja3_hash": "7279fc31fe63c80a8d97fb972ef15c02", "ja3_variant_count": 1, "ja3_variants": [ "7279fc31fe63c80a8d97fb972ef15c02" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d210400_89c2427e67e4_b648b7f3bc8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d210400", "b": "89c2427e67e4", "c": "b648b7f3bc8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 21, "extension_count": 4, "alpn": null } }, "ja3_string": "771,157-61-53-132-156-60-47-150-65-7-5-4-10-9-8-6-3-59-2-1-255,0-35-13-15,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 18, "first_seen": 1787825494, "last_seen": 1791319589, "transport": "t", "ja3_hash": "87e9cd9ca0d10c0b01a762fdeb5691df", "ja3_variant_count": 1, "ja3_variants": [ "87e9cd9ca0d10c0b01a762fdeb5691df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d210800_76e208dd3e22_465a47a21f65", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d210800", "b": "76e208dd3e22", "c": "465a47a21f65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 21, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787842214, "last_seen": 1789587324, "transport": "t", "ja3_hash": "ce5f3254611a8c095a3d821d44539877", "ja3_variant_count": 1, "ja3_variants": [ "ce5f3254611a8c095a3d821d44539877" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d220800_560f53e7a786_b80abeb657b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d220800", "b": "560f53e7a786", "c": "b80abeb657b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 22, "extension_count": 8, "alpn": null } }, "ja3_string": "771,10-47-53-156-157-49161-49162-49170-49171-49172-49195-49196-49199-49200-52392-52393-5-60-49159-49169-49187-49191,0-5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1787969613, "last_seen": 1791001310, "transport": "t", "ja3_hash": "85b6ca9145a1bfdae43699d7a116b9f5", "ja3_variant_count": 1, "ja3_variants": [ "85b6ca9145a1bfdae43699d7a116b9f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d220800_fe100e50004f_b80abeb657b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d220800", "b": "fe100e50004f", "c": "b80abeb657b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 22, "extension_count": 8, "alpn": null } }, "ja3_string": "771,156-157-47-53-60-61-49171-49172-49191-49192-49161-49162-49187-49188-10-49170-49160-22-51-57-103-107,0-5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1789325129, "last_seen": 1789325129, "transport": "t", "ja3_hash": "851be6e458e759523c0f78f6b486f484", "ja3_variant_count": 1, "ja3_variants": [ "851be6e458e759523c0f78f6b486f484" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d2210h2_560f53e7a786_befba1ae359c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d2210h2", "b": "560f53e7a786", "c": "befba1ae359c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 22, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49199-49195-157-60-49200-156-52392-49191-52393-49187-49196-49172-5-49170-49161-49159-10-49162-49169-49171-47-53,23-65281-5-16-0-35-10-18-13-11,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788671800, "last_seen": 1788671800, "transport": "t", "ja3_hash": "9e68d5ff0f42a3d33f6ac90e7c7791cd", "ja3_variant_count": 1, "ja3_variants": [ "9e68d5ff0f42a3d33f6ac90e7c7791cd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d230800_31bea9ec6298_b80abeb657b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d230800", "b": "31bea9ec6298", "c": "b80abeb657b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 23, "extension_count": 8, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49161-158-52392-52394-51-61-22-49162-57-49171-10-49172-156-157-47-53-49170,0-5-10-11-13-65281-18-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 43, "first_seen": 1787995884, "last_seen": 1790681466, "transport": "t", "ja3_hash": "8212b3464705ca0acc33919cbace7958", "ja3_variant_count": 1, "ja3_variants": [ "8212b3464705ca0acc33919cbace7958" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d2310h2_f91c41aead95_5466d6a1e075", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d2310h2", "b": "f91c41aead95", "c": "5466d6a1e075", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 23, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-23-13-5-13172-18-16-11-10,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790178464, "last_seen": 1790881931, "transport": "t", "ja3_hash": "5c118da645babe52f060d0754256a73c", "ja3_variant_count": 1, "ja3_variants": [ "5c118da645babe52f060d0754256a73c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d240600_9295eb73ea51_7a3643a9f024", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d240600", "b": "9295eb73ea51", "c": "7a3643a9f024", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 24, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49192-49191-49172-49171-159-158-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1790509310, "last_seen": 1790509315, "transport": "t", "ja3_hash": "2d0c1aa81856c537394b05616d38dbae", "ja3_variant_count": 1, "ja3_variants": [ "2d0c1aa81856c537394b05616d38dbae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d260400_c69ecbaecc6c_16266c2fce5b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d260400", "b": "c69ecbaecc6c", "c": "16266c2fce5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 26, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49196-49200-49195-49199-49188-49192-49187-49191-157-156-61-60-159-158-107-103-49162-49172-49161-49171-53-47-57-51-10-255,13-0-11-10,9-10-11-12-13-14-22-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1789726957, "last_seen": 1789729477, "transport": "t", "ja3_hash": "9c9bed22d2af7306848a133d025bb66a", "ja3_variant_count": 1, "ja3_variants": [ "9c9bed22d2af7306848a133d025bb66a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d270800_a2460661a67a_5d316f34096e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d270800", "b": "a2460661a67a", "c": "5d316f34096e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 27, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13,29-23-30-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7471, "first_seen": 1787442802, "last_seen": 1791326324, "transport": "t", "ja3_hash": "1c9a15ffefdbe3d51d703fde3c4086eb", "ja3_variant_count": 1, "ja3_variants": [ "1c9a15ffefdbe3d51d703fde3c4086eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d280700_b75078996b15_b85b7b870361", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d280700", "b": "b75078996b15", "c": "b85b7b870361", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 28, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49162-49195-52393-49161-49200-49172-49199-52392-49171-159-57-56-107-158-52394-51-50-103-22-19-157-53-61-156-47-60-10,0-23-65281-10-11-13-28,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787771047, "last_seen": 1790139167, "transport": "t", "ja3_hash": "c8446f59cca2149cb5f56ced4b448c8d", "ja3_variant_count": 1, "ja3_variants": [ "c8446f59cca2149cb5f56ced4b448c8d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d280700_bbd4f008d9b2_122ea0d3d2f7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d280700", "b": "bbd4f008d9b2", "c": "122ea0d3d2f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 28, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-57-51-157-156-61-60-53-47-10-106-64-56-50-19,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 68, "first_seen": 1787959607, "last_seen": 1790838374, "transport": "t", "ja3_hash": "7c410ce832e848a3321432c9a82e972b", "ja3_variant_count": 1, "ja3_variants": [ "7c410ce832e848a3321432c9a82e972b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d280700_d943125447b4_b1069b7c31f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d280700", "b": "d943125447b4", "c": "b1069b7c31f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 28, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 18, "first_seen": 1787697749, "last_seen": 1790717120, "transport": "t", "ja3_hash": "871a754af286dfb70c1b53c6887c62e0", "ja3_variant_count": 1, "ja3_variants": [ "871a754af286dfb70c1b53c6887c62e0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d280800_d943125447b4_699838c0e161", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d280800", "b": "d943125447b4", "c": "699838c0e161", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 28, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-13172-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788989786, "last_seen": 1788989786, "transport": "t", "ja3_hash": "da34bf49c259ade1dcd0bf16d4215171", "ja3_variant_count": 1, "ja3_variants": [ "da34bf49c259ade1dcd0bf16d4215171" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d281000_0df5e5c63df4_dc2a3e31388b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d281000", "b": "0df5e5c63df4", "c": "dc2a3e31388b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 28, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-17-23-35-13-43-50,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19, "first_seen": 1789485410, "last_seen": 1791184081, "transport": "t", "ja3_hash": "e91a667db6105d9ca11ecc980cd8ff6e", "ja3_variant_count": 1, "ja3_variants": [ "e91a667db6105d9ca11ecc980cd8ff6e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d290700_fc2078a0b8c0_98c48c6649d0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d290700", "b": "fc2078a0b8c0", "c": "98c48c6649d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 29, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49195-49199-158-49196-49200-159-52393-52392-52244-52243-49161-49187-49171-49191-51-103-49162-49188-49172-49192-57-107-156-157-47-60-53-61-10,65281-0-23-35-13-11-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 26, "first_seen": 1787614734, "last_seen": 1790345601, "transport": "t", "ja3_hash": "2de42bb701d689176cd3487a44aaccab", "ja3_variant_count": 2, "ja3_variants": [ "2de42bb701d689176cd3487a44aaccab", "11e1137464a4343105031631d470cd92" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d300600_a9ca94f90404_935ee41de825", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d300600", "b": "a9ca94f90404", "c": "935ee41de825", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 30, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49192-49172-107-57-61-53-49191-49171-103-51-60-47-49200-159-157-49199-158-156-49161-49187-49162-49188-49170-22-10-49169-5-4-21-9,0-10-11-5-65281-13,23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 22, "first_seen": 1788665401, "last_seen": 1788665415, "transport": "t", "ja3_hash": "db118c9bec1363ef684b95ac91b005ad", "ja3_variant_count": 1, "ja3_variants": [ "db118c9bec1363ef684b95ac91b005ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d310600_f3b328a90fc1_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d310600", "b": "f3b328a90fc1", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 31, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-158-162-159-163-49187-49191-49161-49171-49188-49192-49162-49172-103-107-51-57-64-106-50-56-156-157-60-61-47-53-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1788053828, "last_seen": 1791354127, "transport": "t", "ja3_hash": "32926ca3e59f0413d0b98725454594f5", "ja3_variant_count": 1, "ja3_variants": [ "32926ca3e59f0413d0b98725454594f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d310800_1d947a95fc68_834abc1a9a7d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d310800", "b": "1d947a95fc68", "c": "834abc1a9a7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 31, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-17-23-35-13,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790086541, "last_seen": 1790086541, "transport": "t", "ja3_hash": "19970965acebd7baf8f857b646688f44", "ja3_variant_count": 1, "ja3_variants": [ "19970965acebd7baf8f857b646688f44" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d320400_992cb694dc73_bacfa8fa5626", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d320400", "b": "992cb694dc73", "c": "bacfa8fa5626", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 32, "extension_count": 4, "alpn": null } }, "ja3_string": "771,136-150-156-157-158-159-255-49154-49155-49156-49157-49159-49160-49161-49162-49164-49165-49166-49167-49169-49170-49171-49172-49187-49188-49191-49195-49196-49199-49200-49201-49202,0-11-10-13,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509853, "last_seen": 1791290839, "transport": "t", "ja3_hash": "5f4b707a25de4e5f465ea53927052503", "ja3_variant_count": 1, "ja3_variants": [ "5f4b707a25de4e5f465ea53927052503" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d320800_b415a99ff5d8_3ebdebe9c84d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d320800", "b": "b415a99ff5d8", "c": "3ebdebe9c84d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 32, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-163-52393-49327-49325-49245-49239-49195-162-49326-49324-49244-49238-49188-106-49267-195-49187-64-49266-189-49162-56-135-49161-50-153-68-49159-49160-19-255,0-11-10-35-5-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791319589, "last_seen": 1791319589, "transport": "t", "ja3_hash": "fe10b965566e9c716a13963600e2d08f", "ja3_variant_count": 1, "ja3_variants": [ "fe10b965566e9c716a13963600e2d08f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d330600_5172cef6ed69_334f0aaed909", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d330600", "b": "5172cef6ed69", "c": "334f0aaed909", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 33, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49162-49161-49160-49192-49191-49172-49171-49170-61-60-53-47-10-49159-49169-5-4-49195-49199-156,0-5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 147, "first_seen": 1788076304, "last_seen": 1790783535, "transport": "t", "ja3_hash": "5c9e2c7e9d59662f068f51c5de5ff825", "ja3_variant_count": 1, "ja3_variants": [ "5c9e2c7e9d59662f068f51c5de5ff825" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d340200_280581216cf5_e4b0759bffdd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d340200", "b": "280581216cf5", "c": "e4b0759bffdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 34, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4-5-10-13-16-19-22-47-48-49-50-51-53-54-55-56-57-60-61-62-63-64-65-68-69-102-103-104-105-106-107-132-135-255,0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 56, "first_seen": 1787509858, "last_seen": 1791290839, "transport": "t", "ja3_hash": "48153283a6674234e4c7ba641586ca55", "ja3_variant_count": 1, "ja3_variants": [ "48153283a6674234e4c7ba641586ca55" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d340600_498eeac4deb3_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d340600", "b": "498eeac4deb3", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 34, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-158-162-159-163-49187-49191-49161-49171-49188-49192-49162-49172-103-107-51-57-64-106-50-56-156-157-60-61-47-53-49159-49169-5-255,0-11-10-35-13-15,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789583808, "last_seen": 1791320159, "transport": "t", "ja3_hash": "71711c0feb4d0d407f7a4e10b7b1c385", "ja3_variant_count": 1, "ja3_variants": [ "71711c0feb4d0d407f7a4e10b7b1c385" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d370400_3fce34ec6c8f_5d941312bb9a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d370400", "b": "3fce34ec6c8f", "c": "5d941312bb9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 37, "extension_count": 4, "alpn": null } }, "ja3_string": "771,255-49196-49200-49188-49192-49198-49202-49190-49194-159-163-107-106-49195-49199-49187-49191-49197-49201-49189-49193-158-162-103-64-49162-49172-57-56-49157-49167-49161-49171-51-50-49156-49166,0-13-10-11,14-13-25-28-11-12-27-24-9-10-26-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 24, "first_seen": 1787710530, "last_seen": 1791081175, "transport": "t", "ja3_hash": "216ef4b2d074458cbe1330368c85d325", "ja3_variant_count": 1, "ja3_variants": [ "216ef4b2d074458cbe1330368c85d325" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d380500_10ed599f3404_654fe63324b3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d380500", "b": "10ed599f3404", "c": "654fe63324b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 38, "extension_count": 5, "alpn": null } }, "ja3_string": "771,52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-255,0-11-10-35-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 79, "first_seen": 1787687190, "last_seen": 1791101916, "transport": "t", "ja3_hash": "047bfa6321a7921f57d5b91d04dcedaf", "ja3_variant_count": 1, "ja3_variants": [ "047bfa6321a7921f57d5b91d04dcedaf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d3805ht_10ed599f3404_4f2194e778ad", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d3805ht", "b": "10ed599f3404", "c": "4f2194e778ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 38, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-255,0-11-10-13-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 25, "first_seen": 1787851584, "last_seen": 1790922294, "transport": "t", "ja3_hash": "c1020cdb6413396a7c2106cb216d7dad", "ja3_variant_count": 1, "ja3_variants": [ "c1020cdb6413396a7c2106cb216d7dad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d3806ht_10ed599f3404_ac7f9eb85633", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d3806ht", "b": "10ed599f3404", "c": "ac7f9eb85633", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 38, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-255,0-11-10-35-13-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789893036, "last_seen": 1791356579, "transport": "t", "ja3_hash": "a90d7be7e610500140ab790873da8a2e", "ja3_variant_count": 1, "ja3_variants": [ "a90d7be7e610500140ab790873da8a2e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d400600_44c89e5422f1_a6ad5fe9ef24", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d400600", "b": "44c89e5422f1", "c": "a6ad5fe9ef24", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 40, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10-49188-49187-49160-158-157-156-49192-49191-52393-52392-52394-107-103-57-51-22-61-60-4-20-159-21-49196-49200-8-6-3,0-5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 78, "first_seen": 1787464623, "last_seen": 1791289941, "transport": "t", "ja3_hash": "1b9bb541fa237aff65acf838b154df7f", "ja3_variant_count": 1, "ja3_variants": [ "1b9bb541fa237aff65acf838b154df7f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d430500_1ce71f0edbb1_0b643df80691", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d430500", "b": "1ce71f0edbb1", "c": "0b643df80691", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 43, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-49196-49195-49200-157-49198-49202-159-163-49199-156-49197-49201-158-162-255,10-11-13-23-0,23-24-25-9-10-11-12-13-14-22,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791007629, "last_seen": 1791131406, "transport": "t", "ja3_hash": "d2935c58fe676744fecc8614ee5356c7", "ja3_variant_count": 1, "ja3_variants": [ "d2935c58fe676744fecc8614ee5356c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d430700_1ce71f0edbb1_85fd39bfcaa8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d430700", "b": "1ce71f0edbb1", "c": "85fd39bfcaa8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 43, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-10-11-13-50-23-43,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790366004, "last_seen": 1790366004, "transport": "t", "ja3_hash": "026e5ca865ce1f09da3a81d8a4e3effb", "ja3_variant_count": 1, "ja3_variants": [ "026e5ca865ce1f09da3a81d8a4e3effb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d460500_0b5b145d87b5_7447efa29e2f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d460500", "b": "0b5b145d87b5", "c": "7447efa29e2f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 46, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49172-49162-57-56-55-54-136-135-134-133-49167-49157-53-132-49196-49171-49161-51-50-49-48-154-153-152-151-69-68-67-66-49166-49156-47-150-65-7-49195-49170-49160-22-19-16-13-49165-49155-10-255,0-11-10-35-13,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1790760375, "last_seen": 1790760825, "transport": "t", "ja3_hash": "5bec1241b06a16b366e27ca65a1115fb", "ja3_variant_count": 1, "ja3_variants": [ "5bec1241b06a16b366e27ca65a1115fb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d490600_730fb1b0ac6a_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d490600", "b": "730fb1b0ac6a", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 49, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-49196-49199-49195-159-158-49202-49198-49201-49197-165-161-164-160-49192-49188-49172-49162-49194-49190-49167-49157-49191-49187-49171-49161-49193-49189-49166-49156-107-105-104-57-55-54-103-63-62-51-49-48-157-156-61-53-60-47-255,0-11-10-35-13-15,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 218, "first_seen": 1787929606, "last_seen": 1791342342, "transport": "t", "ja3_hash": "fde79076cad267e37a9dc6f3f666b2d1", "ja3_variant_count": 1, "ja3_variants": [ "fde79076cad267e37a9dc6f3f666b2d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d4906ht_730fb1b0ac6a_d27d9be533b8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d4906ht", "b": "730fb1b0ac6a", "c": "d27d9be533b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 49, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,49200-49196-49199-49195-159-158-49202-49198-49201-49197-165-161-164-160-49192-49188-49172-49162-49194-49190-49167-49157-49191-49187-49171-49161-49193-49189-49166-49156-107-105-104-57-55-54-103-63-62-51-49-48-157-156-61-53-60-47-255,0-11-10-13-15-16,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787826683, "last_seen": 1791293848, "transport": "t", "ja3_hash": "3ed5a566e6a60d27a09ba381962a8d8b", "ja3_variant_count": 1, "ja3_variants": [ "3ed5a566e6a60d27a09ba381962a8d8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d490700_ed211f7843e6_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d490700", "b": "ed211f7843e6", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 49, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49199-49195-49200-49196-158-162-163-159-49191-49187-49171-49161-49192-49188-49172-49162-103-51-64-107-56-57-156-157-50-49201-49197-49193-49189-49166-49156-60-47-106-49202-49198-49194-49190-49167-49157-61-53-136-135-132-69-68-65-255,0-11-10-35-13-15-21,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788972708, "last_seen": 1788972708, "transport": "t", "ja3_hash": "fff172bbdf6990354f316a39f3ef5867", "ja3_variant_count": 1, "ja3_variants": [ "fff172bbdf6990354f316a39f3ef5867" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d4907ht_730fb1b0ac6a_20308a74e42f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d4907ht", "b": "730fb1b0ac6a", "c": "20308a74e42f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 49, "extension_count": 7, "alpn": "ht" } }, "ja3_string": "771,49200-49196-49199-49195-159-158-49202-49198-49201-49197-165-161-164-160-49192-49188-49172-49162-49194-49190-49167-49157-49191-49187-49171-49161-49193-49189-49166-49156-107-105-104-57-55-54-103-63-62-51-49-48-157-156-61-53-60-47-255,0-11-10-13-15-16-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 60, "first_seen": 1787507879, "last_seen": 1791312720, "transport": "t", "ja3_hash": "86cb13d6bbb3ac96b78b408bcfc18794", "ja3_variant_count": 1, "ja3_variants": [ "86cb13d6bbb3ac96b78b408bcfc18794" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d520500_26e41e4f9c7e_d44182472191", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d520500", "b": "26e41e4f9c7e", "c": "d44182472191", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 52, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-163-159-107-106-57-56-136-135-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-162-158-103-64-51-50-154-153-69-68-49201-49197-49193-49189-49166-49156-156-60-47-150-65-255,0-11-10-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1790229826, "last_seen": 1790229960, "transport": "t", "ja3_hash": "026820f6c414422c0244a44960cb9d3c", "ja3_variant_count": 1, "ja3_variants": [ "026820f6c414422c0244a44960cb9d3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d520600_7554301188de_a6ad5fe9ef24", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d520600", "b": "7554301188de", "c": "a6ad5fe9ef24", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 52, "extension_count": 6, "alpn": null } }, "ja3_string": "771,51-53-49170-3-49162-4-159-156-47-157-49161-49200-57-49169-103-10-158-102-6-163-49199-18-61-49187-49172-17-106-56-52394-5-49188-49192-50-162-49159-25-22-23-64-52392-52393-60-49171-8-49195-19-49191-49196-21-107-49160-20,0-5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 20, "name": "20 (0x0014)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1788461574, "last_seen": 1790865308, "transport": "t", "ja3_hash": "e9da4e41318323918a489cf658abff08", "ja3_variant_count": 7, "ja3_variants": [ "e9da4e41318323918a489cf658abff08", "17441c51b7f60ac9ceea81da25a495cc", "a72c59c9a862b8f9522d96da837cd017", "c322cf491f2f9418d627ab16c153646f", "f05eba3492d1816dc560613ee4e29200", "77f345bb6929f410f22cdc2cc7d5c052", "8298ab6c91b5647b1cd77b0f585455b8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d520700_3874cc0afe49_d4749a06ddf8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d520700", "b": "3874cc0afe49", "c": "d4749a06ddf8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 52, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52244-52243-49199-49195-49200-49196-49169-49159-49191-49187-49171-49161-49192-49188-49172-49162-52245-158-159-103-107-51-57-156-157-5-4-60-61-47-53-49170-22-10-3-8-6-20-17-25-23-50-49160-18-19-21-56-64-102-106-162-163,0-5-10-11-13-65281-15,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790522225, "last_seen": 1790522225, "transport": "t", "ja3_hash": "14fbddc85522dba426ae572ff2f04372", "ja3_variant_count": 1, "ja3_variants": [ "14fbddc85522dba426ae572ff2f04372" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d520800_9e42dd384d95_3ebdebe9c84d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d520800", "b": "9e42dd384d95", "c": "3ebdebe9c84d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 52, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49200-159-52392-52394-49315-49311-49249-49235-49199-158-49314-49310-49248-49234-49192-107-49271-196-49191-103-49270-190-49172-57-136-49171-51-154-69-49169-49170-22-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-5-10-255,0-11-10-35-5-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791319589, "last_seen": 1791319589, "transport": "t", "ja3_hash": "a517fa1658caabf558e0e70b9aa2b628", "ja3_variant_count": 1, "ja3_variants": [ "a517fa1658caabf558e0e70b9aa2b628" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d560700_8aab05645947_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d560700", "b": "8aab05645947", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 56, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49196-49202-49198-49199-49195-49201-49197-163-159-162-158-49192-49188-49172-49162-49194-49190-49167-49157-107-106-57-56-49191-49187-49171-49161-49193-49189-49166-49156-103-64-51-50-136-135-69-68-49170-49160-49165-49155-22-19-157-156-61-53-60-47-132-65-10-255,0-11-10-35-13-15-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 30, "first_seen": 1788374803, "last_seen": 1789144383, "transport": "t", "ja3_hash": "85da163441fc0c68e2bd4ad8c55c3380", "ja3_variant_count": 1, "ja3_variants": [ "85da163441fc0c68e2bd4ad8c55c3380" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d560700_99d8c53049f3_577401a16f57", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d560700", "b": "99d8c53049f3", "c": "577401a16f57", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 56, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788922359, "last_seen": 1789253278, "transport": "t", "ja3_hash": "c0220cd64849a629397a9cb68f78a0ea", "ja3_variant_count": 1, "ja3_variants": [ "c0220cd64849a629397a9cb68f78a0ea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d590600_7bd0586cbef7_6956cdc5de3d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d590600", "b": "7bd0586cbef7", "c": "6956cdc5de3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 59, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-163-159-107-106-57-56-136-135-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-162-158-103-64-51-50-154-153-69-68-49201-49197-49193-49189-49166-49156-156-60-47-150-65-49170-49160-22-19-49165-49155-10-255,0-11-10-13-15-21,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788972714, "last_seen": 1788972714, "transport": "t", "ja3_hash": "e3b2ab1f9a56f2fb4c9248f2f41631fa", "ja3_variant_count": 1, "ja3_variants": [ "e3b2ab1f9a56f2fb4c9248f2f41631fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d5908h1_7bd0586cbef7_cf46fd089bfb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d5908h1", "b": "7bd0586cbef7", "c": "cf46fd089bfb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 59, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-163-159-107-106-57-56-136-135-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-162-158-103-64-51-50-154-153-69-68-49201-49197-49193-49189-49166-49156-156-60-47-150-65-49170-49160-22-19-49165-49155-10-255,0-11-10-13-15-13172-16-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1791093232, "last_seen": 1791127878, "transport": "t", "ja3_hash": "f2a29a175b3645283af6428ff0f49108", "ja3_variant_count": 1, "ja3_variants": [ "f2a29a175b3645283af6428ff0f49108" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d610700_8a10cb45a794_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d610700", "b": "8a10cb45a794", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 61, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49196-49202-49198-49199-49195-49201-49197-163-159-162-158-49192-49188-49172-49162-49194-49190-49167-49157-107-106-57-56-49191-49187-49171-49161-49193-49189-49166-49156-103-64-51-50-49170-49160-49165-49155-136-135-69-68-22-19-157-156-61-53-60-47-132-65-10-49169-49159-49164-49154-5-255,0-11-10-35-13-15-21,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 253, "first_seen": 1787443279, "last_seen": 1789455991, "transport": "t", "ja3_hash": "683145f4a4104e2eb28ac44273d13469", "ja3_variant_count": 1, "ja3_variants": [ "683145f4a4104e2eb28ac44273d13469" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d620500_f293919562b9_654fe63324b3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d620500", "b": "f293919562b9", "c": "654fe63324b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 62, "extension_count": 5, "alpn": null } }, "ja3_string": "771,52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-49177-167-109-58-197-137-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-49176-166-108-52-191-70-156-60-47-186-65-49169-49159-49174-24-5-4-49170-49160-22-49175-27-10-255,0-11-10-35-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 12, "first_seen": 1790858904, "last_seen": 1790870567, "transport": "t", "ja3_hash": "110a8ba925c1fee7af54f6a830368c08", "ja3_variant_count": 1, "ja3_variants": [ "110a8ba925c1fee7af54f6a830368c08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d620700_106a9de34958_89e5d97212f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d620700", "b": "106a9de34958", "c": "89e5d97212f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 62, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49200-49195-49199-52393-52392-163-159-162-158-52394-49327-49325-49188-49192-49162-49172-49315-49311-107-106-57-56-49326-49324-49187-49191-49161-49171-49314-49310-103-64-51-50-49267-49271-49266-49270-196-195-190-189-136-135-69-68-157-156-49313-49309-49312-49308-61-60-53-47-192-186-132-65-255,0-11-10-35-22-23-13,23,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788471644, "last_seen": 1788471644, "transport": "t", "ja3_hash": "a29b8182facd436a82a9340c60b16cac", "ja3_variant_count": 1, "ja3_variants": [ "a29b8182facd436a82a9340c60b16cac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d640400_1715b94e3896_326c0be892b4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d640400", "b": "1715b94e3896", "c": "326c0be892b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": "771,98-97-96-100-8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182,10-0-11-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "4c97b7767843dde9f11cbd08f8100a68", "ja3_variant_count": 1, "ja3_variants": [ "4c97b7767843dde9f11cbd08f8100a68" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d640400_1e98fdfb27e9_326c0be892b4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d640400", "b": "1e98fdfb27e9", "c": "326c0be892b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": "771,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49411-49413-49409-49412-49414-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138,10-0-11-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49411, "name": "49411 (0xc103)", "known": false }, { "value": 49413, "name": "49413 (0xc105)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49412, "name": "49412 (0xc104)", "known": false }, { "value": 49414, "name": "49414 (0xc106)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "c9abacd19e1e55c75eb8b09bea77e4db", "ja3_variant_count": 1, "ja3_variants": [ "c9abacd19e1e55c75eb8b09bea77e4db" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d640400_a3acda31d846_326c0be892b4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d640400", "b": "a3acda31d846", "c": "326c0be892b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,10-0-11-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "b195a4d8cf322287dbd54c903c8aec06", "ja3_variant_count": 1, "ja3_variants": [ "b195a4d8cf322287dbd54c903c8aec06" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d640400_e31a90cd0803_326c0be892b4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d640400", "b": "e31a90cd0803", "c": "326c0be892b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": "771,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,10-0-11-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "0ba6170c7ab621b46af31dae344d4fee", "ja3_variant_count": 1, "ja3_variants": [ "0ba6170c7ab621b46af31dae344d4fee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d640400_e7b476f9520b_326c0be892b4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d640400", "b": "e7b476f9520b", "c": "326c0be892b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": "771,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,10-0-11-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "76fedaa77aad39ee3d527447cafa6fbf", "ja3_variant_count": 1, "ja3_variants": [ "76fedaa77aad39ee3d527447cafa6fbf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d640400_f559eb9565fd_326c0be892b4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d640400", "b": "f559eb9565fd", "c": "326c0be892b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": "771,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,10-0-11-13,23-24-25-29-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020294, "last_seen": 1791020294, "transport": "t", "ja3_hash": "f6564f6e44de66a4a6c02bd56d063eaf", "ja3_variant_count": 1, "ja3_variants": [ "f6564f6e44de66a4a6c02bd56d063eaf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d640800_60fcec5a41cb_3ebdebe9c84d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d640800", "b": "60fcec5a41cb", "c": "3ebdebe9c84d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-154-153-69-68-49159-49169-49160-49170-22-19-255,0-11-10-35-5-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787825499, "last_seen": 1790703163, "transport": "t", "ja3_hash": "9b9f883715ef45d4a3fe0d034e324e65", "ja3_variant_count": 1, "ja3_variants": [ "9b9f883715ef45d4a3fe0d034e324e65" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d650600_77b304177063_6956cdc5de3d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d650600", "b": "77b304177063", "c": "6956cdc5de3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 65, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-163-159-107-106-57-56-136-135-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-162-158-103-64-51-50-154-153-69-68-49201-49197-49193-49189-49166-49156-156-60-47-150-65-49169-49159-49164-49154-5-4-49170-49160-22-19-49165-49155-10-255,0-11-10-13-15-21,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790106118, "last_seen": 1790106118, "transport": "t", "ja3_hash": "e9273590c7875d6367325f8714890790", "ja3_variant_count": 1, "ja3_variants": [ "e9273590c7875d6367325f8714890790" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d650700_0dd215169a35_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d650700", "b": "0dd215169a35", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 65, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49196-49202-49198-49199-49195-49201-49197-165-163-161-159-164-162-160-158-49192-49188-49172-49162-49194-49190-49167-49157-107-106-105-104-57-56-55-54-49191-49187-49171-49161-49193-49189-49166-49156-103-64-63-62-51-50-49-48-136-135-134-133-69-68-67-66-157-156-61-53-60-47-132-65-255,0-11-10-35-13-15-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 38, "first_seen": 1788106577, "last_seen": 1791319427, "transport": "t", "ja3_hash": "e0fe397a5edfba9a6facc7c7b341f4eb", "ja3_variant_count": 1, "ja3_variants": [ "e0fe397a5edfba9a6facc7c7b341f4eb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d670600_3d07528e3801_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d670600", "b": "3d07528e3801", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 67, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-49202-49198-49194-49190-49167-49157-157-61-53-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-49201-49197-49193-49189-49166-49156-156-60-47-154-153-152-151-150-7-49169-49159-49164-49154-5-4-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 18, "first_seen": 1787825500, "last_seen": 1791319590, "transport": "t", "ja3_hash": "9041d6504ebc6cc1717341964eaa16cf", "ja3_variant_count": 1, "ja3_variants": [ "9041d6504ebc6cc1717341964eaa16cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d6912hq_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d6912hq", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "hq" } }, "ja3_string": "771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2570, "first_seen": 1787442801, "last_seen": 1791347877, "transport": "t", "ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6", "ja3_variant_count": 1, "ja3_variants": [ "db8d4ad49cb378fa370b43a61a9b06b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d6912ht_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d6912ht", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,5-4-7-192-132-186-65-157-49313-49309-61-53-156-49312-49308-60-47-10-49169-52243-4867-4868-4869-52392-49271-49270-49249-49248-49200-49192-49172-49199-49191-49171-49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2592, "first_seen": 1787442803, "last_seen": 1791347877, "transport": "t", "ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283", "ja3_variant_count": 1, "ja3_variants": [ "013c30c8ce44c8b27e9ceb2a14db7283" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d720800_1b75dbf8ecb1_bccd9a762ad0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d720800", "b": "1b75dbf8ecb1", "c": "bccd9a762ad0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 72, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49199-49195-49200-49196-158-162-163-159-49191-49187-49171-49161-49192-49188-49172-49162-103-51-64-107-56-57-156-157-49326-49324-49314-49310-50-49312-49308-60-47-49327-49325-49315-49311-106-49313-49309-61-53-52393-52392-52394-49245-49249-49239-49235-49244-49248-49238-49234-49267-49271-196-195-49266-49270-190-189-136-135-69-68-49233-49232-192-186-132-65-255,0-11-10-35-22-23-13-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788750556, "last_seen": 1788750556, "transport": "t", "ja3_hash": "68485c296b23ddbea8137b9d37c1422c", "ja3_variant_count": 1, "ja3_variants": [ "68485c296b23ddbea8137b9d37c1422c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d8007h2_9cedc1f1428b_20308a74e42f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d8007h2", "b": "9cedc1f1428b", "c": "20308a74e42f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 80, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-136-135-134-133-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-154-153-152-151-69-68-67-66-49201-49197-49193-49189-49166-49156-156-60-47-150-65-49170-49160-22-19-16-13-49165-49155-10-7-255,0-11-10-13-15-16-21,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 28, "first_seen": 1787718281, "last_seen": 1790998272, "transport": "t", "ja3_hash": "84cafd5f1a72431ad419e01609614f11", "ja3_variant_count": 1, "ja3_variants": [ "84cafd5f1a72431ad419e01609614f11" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d830800_f2e3c83f4807_02830a49146e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d830800", "b": "f2e3c83f4807", "c": "02830a49146e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 83, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65,65281-0-11-10-35-22-23-13,29-23-30-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 101, "first_seen": 1791324680, "last_seen": 1791363210, "transport": "t", "ja3_hash": "0ca28aa37394765c3f0a56cb4370a4e6", "ja3_variant_count": 1, "ja3_variants": [ "0ca28aa37394765c3f0a56cb4370a4e6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d860600_e18388e7f3a3_25552ceac63b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d860600", "b": "e18388e7f3a3", "c": "25552ceac63b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 86, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-136-135-134-133-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-154-153-152-151-69-68-67-66-49201-49197-49193-49189-49166-49156-156-60-47-150-65-7-49169-49159-49164-49154-5-4-49170-49160-22-19-16-13-49165-49155-10-255,0-11-10-35-13-15,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 279, "first_seen": 1787474457, "last_seen": 1791362844, "transport": "t", "ja3_hash": "fd80fa9c6120cdeea8520510f3c644ac", "ja3_variant_count": 2, "ja3_variants": [ "fd80fa9c6120cdeea8520510f3c644ac", "b22b3950835f7eba2f3be0917e4f949e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d860700_e18388e7f3a3_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d860700", "b": "e18388e7f3a3", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 86, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-136-135-134-133-49202-49198-49194-49190-49167-49157-157-61-53-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-154-153-152-151-69-68-67-66-49201-49197-49193-49189-49166-49156-156-60-47-150-65-49170-49160-22-19-16-13-49165-49155-10-7-49169-49159-49164-49154-5-4-255,0-11-10-35-13-15-21,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788218011, "last_seen": 1788514095, "transport": "t", "ja3_hash": "b3e0f4d956240eb92ec0b60867adf96b", "ja3_variant_count": 1, "ja3_variants": [ "b3e0f4d956240eb92ec0b60867adf96b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d880500_9d74d59be4ce_7562623a49ec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d880500", "b": "9d74d59be4ce", "c": "7562623a49ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 88, "extension_count": 5, "alpn": null } }, "ja3_string": "771,7-29-47-48-49-50-51-53-54-55-56-57-60-61-62-63-64-103-104-105-106-107-150-151-152-153-154-156-157-158-159-160-161-162-163-164-165-4865-4866-4867-4868-4869-49156-49157-49161-49162-49166-49167-49171-49172-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49308-49309-49310-49311-49312-49313-49314-49315-49324-49325-49326-49327-52392-52393-52394-5815-5816-5817-5818-253-198-199,11-10-0-13-65281,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-41-256-257-258-259-260-65281-65282,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 65281, "name": "65281 (0xff01)", "known": false }, { "value": 65282, "name": "65282 (0xff02)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1789653167, "last_seen": 1790678609, "transport": "t", "ja3_hash": "d7a0d03c05a2dcaaf006ce4b2754bdb2", "ja3_variant_count": 1, "ja3_variants": [ "d7a0d03c05a2dcaaf006ce4b2754bdb2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990500_039a0bf59e5c_7562623a49ec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990500", "b": "039a0bf59e5c", "c": "7562623a49ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-96-97-98-99-100-101-102-103-104-105-106-107-108-109-128-129-130-131-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-52392-52393-52394-52395-52396-52397-52398-5815-5816-5817-5818-253-65413-65415-198-199,11-10-0-13-65281,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-41-256-257-258-259-260-65281-65282,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 65415, "name": "65415 (0xff87)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 65281, "name": "65281 (0xff01)", "known": false }, { "value": 65282, "name": "65282 (0xff02)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1789653160, "last_seen": 1790678606, "transport": "t", "ja3_hash": "fefd4a7b4aa70ca1608794ffdaaa04d6", "ja3_variant_count": 1, "ja3_variants": [ "fefd4a7b4aa70ca1608794ffdaaa04d6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990500_41a9ebd02c1f_7562623a49ec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990500", "b": "41a9ebd02c1f", "c": "7562623a49ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-71-72-73-74-75-76-78-79-80-81-82-83-84-85-86-87-88-89-90-91-92-96-97-98-99-100-101-102-103-104-105-106-107-108-109-128-129-130-131-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-52242-52243-52244-52245-52246-52247-52248-52249-52392-52393-52394-52395-52396-52397-52398-5815-5816-5817-5818-253-65413-65415-198-199,11-10-0-13-65281,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-41-256-257-258-259-260-65281-65282,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 52242, "name": "52242 (0xcc12)", "known": false }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52246, "name": "52246 (0xcc16)", "known": false }, { "value": 52247, "name": "52247 (0xcc17)", "known": false }, { "value": 52248, "name": "52248 (0xcc18)", "known": false }, { "value": 52249, "name": "52249 (0xcc19)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 65415, "name": "65415 (0xff87)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 65281, "name": "65281 (0xff01)", "known": false }, { "value": 65282, "name": "65282 (0xff02)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 233, "first_seen": 1789653163, "last_seen": 1790678609, "transport": "t", "ja3_hash": "4a956b53a6e8d558759f630bc0d2540b", "ja3_variant_count": 3, "ja3_variants": [ "4a956b53a6e8d558759f630bc0d2540b", "27fd80ee2d5a158a738ce596864abcc5", "14e0e325f758db57c72d1b9042cd0efa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990500_87ce778b49c2_8ce18dd517a1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990500", "b": "87ce778b49c2", "c": "8ce18dd517a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-103-104-105-106-107-108-109-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-198-199-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-49332-49333-49408-49409-49410-52392-52393-52394-52395-52396-52397-52398-53249-53250-53251-53253,0-11-35-13-10,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790837937, "last_seen": 1790837937, "transport": "t", "ja3_hash": "57090b776b76aeed501fb763a57ff6f6", "ja3_variant_count": 1, "ja3_variants": [ "57090b776b76aeed501fb763a57ff6f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990500_e91dfaae0f87_7562623a49ec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990500", "b": "e91dfaae0f87", "c": "7562623a49ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,1-2-4-5-7-9-10-12-13-15-16-18-19-21-22-28-29-47-48-49-50-51-53-54-55-56-57-59-60-61-62-63-64-102-103-104-105-106-107-150-151-152-153-154-156-157-158-159-160-161-162-163-164-165-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49308-49309-49310-49311-49312-49313-49314-49315-49324-49325-49326-49327-52392-52393-52394-5815-5816-5817-5818-253-198-199,11-10-0-13-65281,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-41-256-257-258-259-260-65281-65282,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 65281, "name": "65281 (0xff01)", "known": false }, { "value": 65282, "name": "65282 (0xff02)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1789653165, "last_seen": 1790678608, "transport": "t", "ja3_hash": "a7fbfe260eab66c63e9dde2c2dd50d83", "ja3_variant_count": 1, "ja3_variants": [ "a7fbfe260eab66c63e9dde2c2dd50d83" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990500_ecf6b0aa1042_7562623a49ec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990500", "b": "ecf6b0aa1042", "c": "7562623a49ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-96-97-98-99-100-101-102-103-104-105-106-107-108-109-128-129-130-131-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-52392-52393-52394-52395-52396-52397-52398-5815-5816-5817-5818-253-65413-65415-198-199,11-10-0-13-65281,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-41-256-257-258-259-260-65281-65282,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 65415, "name": "65415 (0xff87)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 65281, "name": "65281 (0xff01)", "known": false }, { "value": 65282, "name": "65282 (0xff02)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1789653165, "last_seen": 1790678606, "transport": "t", "ja3_hash": "bb5870ded0eb2a02b44ad01aa4caa20d", "ja3_variant_count": 1, "ja3_variants": [ "bb5870ded0eb2a02b44ad01aa4caa20d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990700_9839e1f8b32d_91c50624ef9b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990700", "b": "9839e1f8b32d", "c": "91c50624ef9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 7, "alpn": null } }, "ja3_string": "771,52244-52243-52245-49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-49271-49267-196-195-194-193-136-135-134-133-49177-167-109-58-197-137-49202-49198-49194-49190-49167-49157-49273-49269-157-61-53-192-132-149-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-49270-49266-190-189-188-187-154-153-152-151-69-68-67-66-49176-166-108-52-191-155-70-49201-49197-49193-49189-49166-49156-49272-49268-156-60-47-186-150-65-7-148-49169-49159-102-49174-24-49164-49154-5-4-146-49170-49160-22-19-16-13-49175-27-49165-49155-10-147-99-21-18-15-12-26-98-9-97-101-100-96-20-17-14-11-25-8-6-23-3-49173-49168-49158-49163-49153-59-2-1-255,0-11-10-35-13-5-15,14-13-25-28-11-12-27-24-9-10-26-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 15, "name": "heartbeat", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 10, "first_seen": 1787663870, "last_seen": 1790817898, "transport": "t", "ja3_hash": "49826454e14fe89f32bec2f79ddadf73", "ja3_variant_count": 1, "ja3_variants": [ "49826454e14fe89f32bec2f79ddadf73" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990700_a40d17a72bcb_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990700", "b": "a40d17a72bcb", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 7, "alpn": null } }, "ja3_string": "771,5-4-2-1-22-51-57-58-24-53-10-27-47-52-49168-49158-49173-49163-49153-59-49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-56-55-54-136-135-134-133-49177-167-109-137-49202-49198-49194-49190-49167-49157-157-61-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-50-49-48-154-153-152-151-69-68-67-66-49176-166-108-155-70-49201-49197-49193-49189-49166-49156-156-60-150-65-7-49169-49159-49174-49164-49154-49170-49160-19-16-13-49175-49165-49155-255,0-11-10-35-13-15-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789126195, "last_seen": 1790984525, "transport": "t", "ja3_hash": "4ea9b75df5b825f5f735af30836da87d", "ja3_variant_count": 1, "ja3_variants": [ "4ea9b75df5b825f5f735af30836da87d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990700_ffeaddab04ac_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990700", "b": "ffeaddab04ac", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 7, "alpn": null } }, "ja3_string": "771,5-4-2-8-20-3-1-21-6-22-23-51-57-25-58-26-24-53-9-10-27-47-52-49168-49158-49173-49163-49153-59-49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-56-55-54-136-135-134-133-49177-167-109-137-49202-49198-49194-49190-49167-49157-157-61-132-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-50-49-48-154-153-152-151-69-68-67-66-49176-166-108-155-70-49201-49197-49193-49189-49166-49156-156-60-150-65-7-49169-49159-49174-49164-49154-49170-49160-19-16-13-49175-49165-49155-18-15-12-17-255,0-11-10-35-13-15-21,23-25-28-27-24-26-22-14-13-11-12-9-10,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789066053, "last_seen": 1789688217, "transport": "t", "ja3_hash": "cd42c9a128a181f95ce2f309c857061c", "ja3_variant_count": 1, "ja3_variants": [ "cd42c9a128a181f95ce2f309c857061c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d990801_9839e1f8b32d_8bd0e887432c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12d990801", "b": "9839e1f8b32d", "c": "8bd0e887432c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 99, "extension_count": 8, "alpn": "01" } }, "ja3_string": "771,52244-52243-52245-49200-49196-49192-49188-49172-49162-165-163-161-159-107-106-105-104-57-56-55-54-49271-49267-196-195-194-193-136-135-134-133-49177-167-109-58-197-137-49202-49198-49194-49190-49167-49157-49273-49269-157-61-53-192-132-149-49199-49195-49191-49187-49171-49161-164-162-160-158-103-64-63-62-51-50-49-48-49270-49266-190-189-188-187-154-153-152-151-69-68-67-66-49176-166-108-52-191-155-70-49201-49197-49193-49189-49166-49156-49272-49268-156-60-47-186-150-65-7-148-49169-49159-102-49174-24-49164-49154-5-4-146-49170-49160-22-19-16-13-49175-27-49165-49155-10-147-99-21-18-15-12-26-98-9-97-101-100-96-20-17-14-11-25-8-6-23-3-49173-49168-49158-49163-49153-59-2-1-255,0-11-10-35-13-5-15-16,14-13-25-28-11-12-27-24-9-10-26-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790738003, "last_seen": 1790738003, "transport": "t", "ja3_hash": "ef1e072f6449bad7dce48b32ec4f6a78", "ja3_variant_count": 1, "ja3_variants": [ "ef1e072f6449bad7dce48b32ec4f6a78" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i0808h2_c9d1e06f98c4_ac6a06c2a0bd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i0808h2", "b": "c9d1e06f98c4", "c": "ac6a06c2a0bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,52393-52392-49195-49199-49196-49200-156-157,43-10-13-16-23-22-65281-35,23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 102, "first_seen": 1787497767, "last_seen": 1791308195, "transport": "t", "ja3_hash": "857aea9be2f35c272d23f3c4e0deefaa", "ja3_variant_count": 1, "ja3_variants": [ "857aea9be2f35c272d23f3c4e0deefaa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i0808ht_c9d1e06f98c4_ac6a06c2a0bd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i0808ht", "b": "c9d1e06f98c4", "c": "ac6a06c2a0bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,49195-49196-49199-49200-52393-52392-156-157,43-10-13-16-23-22-65281-35,23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 103, "first_seen": 1787497798, "last_seen": 1791308228, "transport": "t", "ja3_hash": "a7da2bc4375750ea67e9e97d561b1fdd", "ja3_variant_count": 1, "ja3_variants": [ "a7da2bc4375750ea67e9e97d561b1fdd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i0809h2_c9d1e06f98c4_199b71c7db97", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i0809h2", "b": "c9d1e06f98c4", "c": "199b71c7db97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,52393-49196-49195-52392-49200-49199-157-156,43-10-13-16-23-22-65281-35-28,24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 103, "first_seen": 1787497697, "last_seen": 1791308128, "transport": "t", "ja3_hash": "845637b65493166751bd102deb9f9116", "ja3_variant_count": 1, "ja3_variants": [ "845637b65493166751bd102deb9f9116" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_7ca2e5979b2a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "7ca2e5979b2a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1787890554, "last_seen": 1791089161, "transport": "t", "ja3_hash": "9ec7db6e71a7c361ca8c41f85728dc73", "ja3_variant_count": 2, "ja3_variants": [ "9ec7db6e71a7c361ca8c41f85728dc73", "6b818b13bc122a0d4ce43da208808590" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_a439cba1f1e7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "a439cba1f1e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790929406, "last_seen": 1790929406, "transport": "t", "ja3_hash": "e5ecb8edd237a1b256ecc75497d62109", "ja3_variant_count": 1, "ja3_variants": [ "e5ecb8edd237a1b256ecc75497d62109" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1503h2_8daaf6152771_c97aa4dd9f5a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1503h2", "b": "8daaf6152771", "c": "c97aa4dd9f5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789587740, "last_seen": 1791077859, "transport": "t", "ja3_hash": "62c6033329d35e4781b6fb18d5737808", "ja3_variant_count": 2, "ja3_variants": [ "62c6033329d35e4781b6fb18d5737808", "cdd0d1eef18d0a55a0072b01af2dd2b0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_04dec919cf2f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "04dec919cf2f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791122028, "last_seen": 1791122028, "transport": "t", "ja3_hash": "df563ba8589f5bd8957cadfdff350559", "ja3_variant_count": 1, "ja3_variants": [ "df563ba8589f5bd8957cadfdff350559" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_4ac01172dfcf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "4ac01172dfcf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790321142, "last_seen": 1790321142, "transport": "t", "ja3_hash": "36a8f5f98f09883160237b13c87e5959", "ja3_variant_count": 1, "ja3_variants": [ "36a8f5f98f09883160237b13c87e5959" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_66e0d15328ae", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "66e0d15328ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788776664, "last_seen": 1788776664, "transport": "t", "ja3_hash": "f0f211e6ed5646282f792dbafc0c0113", "ja3_variant_count": 1, "ja3_variants": [ "f0f211e6ed5646282f792dbafc0c0113" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_6973c90d71ea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "6973c90d71ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789980966, "last_seen": 1789980966, "transport": "t", "ja3_hash": "f68a28d405ca03294c456e9389a55dda", "ja3_variant_count": 1, "ja3_variants": [ "f68a28d405ca03294c456e9389a55dda" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_853aec97cc49", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "853aec97cc49", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790123599, "last_seen": 1790123599, "transport": "t", "ja3_hash": "b8ada12288421db8e1d92ace2dd36311", "ja3_variant_count": 1, "ja3_variants": [ "b8ada12288421db8e1d92ace2dd36311" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_85cf7a6ef633", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "85cf7a6ef633", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-51-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789414877, "last_seen": 1789414877, "transport": "t", "ja3_hash": "b278033f2addcce3a41e41e059f33716", "ja3_variant_count": 1, "ja3_variants": [ "b278033f2addcce3a41e41e059f33716" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_c245bb1ab1fe", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "c245bb1ab1fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-18-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791208420, "last_seen": 1791208420, "transport": "t", "ja3_hash": "afacc7f582a1fbb8f292dfe80eb0df41", "ja3_variant_count": 1, "ja3_variants": [ "afacc7f582a1fbb8f292dfe80eb0df41" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_d5ca406f6f55", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "d5ca406f6f55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789416155, "last_seen": 1789416155, "transport": "t", "ja3_hash": "b459f736577a637b62f2b84b34f62a77", "ja3_variant_count": 1, "ja3_variants": [ "b459f736577a637b62f2b84b34f62a77" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_dc67962036b3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "dc67962036b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789283188, "last_seen": 1789283188, "transport": "t", "ja3_hash": "42861abf67b2117e98a93c224c5f955c", "ja3_variant_count": 1, "ja3_variants": [ "42861abf67b2117e98a93c224c5f955c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_e8048a751f68", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "e8048a751f68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789050361, "last_seen": 1789050361, "transport": "t", "ja3_hash": "d86ddb057cf320f75f9edf79a056fb28", "ja3_variant_count": 1, "ja3_variants": [ "d86ddb057cf320f75f9edf79a056fb28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_05cfb8aa73db", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "05cfb8aa73db", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789865337, "last_seen": 1789865337, "transport": "t", "ja3_hash": "fe5cbb386261e20791e8edc81d66b7bc", "ja3_variant_count": 1, "ja3_variants": [ "fe5cbb386261e20791e8edc81d66b7bc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_0f2ec705819d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "0f2ec705819d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-51764-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789240525, "last_seen": 1789240525, "transport": "t", "ja3_hash": "86760cb6fee326997b0b7d5a5579a756", "ja3_variant_count": 1, "ja3_variants": [ "86760cb6fee326997b0b7d5a5579a756" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_26378f68b707", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "26378f68b707", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-51-18-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790639872, "last_seen": 1790639872, "transport": "t", "ja3_hash": "24864072cb50bcaf2a77618afebc79c2", "ja3_variant_count": 1, "ja3_variants": [ "24864072cb50bcaf2a77618afebc79c2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_2a184be5a224", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "2a184be5a224", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-16-23-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789796841, "last_seen": 1789796841, "transport": "t", "ja3_hash": "8e53d016edd23f360f72e6f32f78c933", "ja3_variant_count": 1, "ja3_variants": [ "8e53d016edd23f360f72e6f32f78c933" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_2d364ae6fb80", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "2d364ae6fb80", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-16-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790595261, "last_seen": 1790595261, "transport": "t", "ja3_hash": "adbd7804dd3fd3b0fc6aca4b9415b267", "ja3_variant_count": 1, "ja3_variants": [ "adbd7804dd3fd3b0fc6aca4b9415b267" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_317cb200ce28", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "317cb200ce28", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-51-35-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790640708, "last_seen": 1790640708, "transport": "t", "ja3_hash": "fd203f31fab124a080dcdd940412a7f9", "ja3_variant_count": 1, "ja3_variants": [ "fd203f31fab124a080dcdd940412a7f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_459efd5d1d9e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "459efd5d1d9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-16-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790517365, "last_seen": 1790517365, "transport": "t", "ja3_hash": "7b62d9134b64bb39a0ee1b9fbbf65044", "ja3_variant_count": 1, "ja3_variants": [ "7b62d9134b64bb39a0ee1b9fbbf65044" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_48fdfab7270c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "48fdfab7270c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-65281-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790219903, "last_seen": 1790219903, "transport": "t", "ja3_hash": "708e92ec080e914f74f88f7a6a3a7a21", "ja3_variant_count": 1, "ja3_variants": [ "708e92ec080e914f74f88f7a6a3a7a21" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_53c5b1838b96", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "53c5b1838b96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-16-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790661099, "last_seen": 1790661099, "transport": "t", "ja3_hash": "d844fbcdfce1c94b9fee2ad3b988a165", "ja3_variant_count": 1, "ja3_variants": [ "d844fbcdfce1c94b9fee2ad3b988a165" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_697ffc8436c8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "697ffc8436c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789565241, "last_seen": 1789565241, "transport": "t", "ja3_hash": "3cd216db87181c78160d9e8c21b9cba0", "ja3_variant_count": 1, "ja3_variants": [ "3cd216db87181c78160d9e8c21b9cba0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_79a046205eef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "79a046205eef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788988733, "last_seen": 1788988733, "transport": "t", "ja3_hash": "d4c28a9edd20a8e10d42034d4f34a7bf", "ja3_variant_count": 1, "ja3_variants": [ "d4c28a9edd20a8e10d42034d4f34a7bf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_79d0dc772631", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "79d0dc772631", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791005960, "last_seen": 1791005960, "transport": "t", "ja3_hash": "e702fe4c838be52f9f1e557c7e1b07d6", "ja3_variant_count": 1, "ja3_variants": [ "e702fe4c838be52f9f1e557c7e1b07d6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_7c90efbf5543", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "7c90efbf5543", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788812132, "last_seen": 1788812132, "transport": "t", "ja3_hash": "9e3806f7b1423d65c1f0d9707b06e2bd", "ja3_variant_count": 1, "ja3_variants": [ "9e3806f7b1423d65c1f0d9707b06e2bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_a3e81914eb93", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "a3e81914eb93", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015030, "last_seen": 1789015030, "transport": "t", "ja3_hash": "1eecb0bb1aa59767842fb6bd272b2ac2", "ja3_variant_count": 1, "ja3_variants": [ "1eecb0bb1aa59767842fb6bd272b2ac2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_aaa1bb268050", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "aaa1bb268050", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790222538, "last_seen": 1790222538, "transport": "t", "ja3_hash": "5fc3b8c10db22b481543b9a85ea8a8b8", "ja3_variant_count": 1, "ja3_variants": [ "5fc3b8c10db22b481543b9a85ea8a8b8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_afda78a8b431", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "afda78a8b431", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-65281-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789702103, "last_seen": 1789702103, "transport": "t", "ja3_hash": "6509d806a870ff8029c75b16c90bf47d", "ja3_variant_count": 1, "ja3_variants": [ "6509d806a870ff8029c75b16c90bf47d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_aff3deea7f12", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "aff3deea7f12", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789497603, "last_seen": 1789497603, "transport": "t", "ja3_hash": "85ffbb0edaa858edf1e5172661e4a72f", "ja3_variant_count": 1, "ja3_variants": [ "85ffbb0edaa858edf1e5172661e4a72f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_bf91c976a911", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "bf91c976a911", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-65281-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789400295, "last_seen": 1789400295, "transport": "t", "ja3_hash": "0b666e7fbd73c8320f6dd319738a7d23", "ja3_variant_count": 1, "ja3_variants": [ "0b666e7fbd73c8320f6dd319738a7d23" ], "user_agents": { "PromptingBot/1.0.0": 23 }, "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_c2097553ab4a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "c2097553ab4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-17613-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791129957, "last_seen": 1791129957, "transport": "t", "ja3_hash": "33a361a7deb05e5598dfc333bfcb2831", "ja3_variant_count": 1, "ja3_variants": [ "33a361a7deb05e5598dfc333bfcb2831" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_d2e3de365767", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "d2e3de365767", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-16-35-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790905488, "last_seen": 1790905488, "transport": "t", "ja3_hash": "074a05b6ee12d57849ecd346f9cf5dcf", "ja3_variant_count": 1, "ja3_variants": [ "074a05b6ee12d57849ecd346f9cf5dcf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_d672f3539fb4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "d672f3539fb4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-16-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790795507, "last_seen": 1790795507, "transport": "t", "ja3_hash": "151bb0fec413995828e58c02a226f9d3", "ja3_variant_count": 1, "ja3_variants": [ "151bb0fec413995828e58c02a226f9d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_e452696aae62", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "e452696aae62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-16-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015039, "last_seen": 1789015039, "transport": "t", "ja3_hash": "821edd21b3ee76db0cb7f8959b73f7c8", "ja3_variant_count": 1, "ja3_variants": [ "821edd21b3ee76db0cb7f8959b73f7c8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_e73a38c48156", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "e73a38c48156", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-65281-51-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015030, "last_seen": 1789015030, "transport": "t", "ja3_hash": "b4bb526d35fe15e7f5684797e7cc58c9", "ja3_variant_count": 1, "ja3_variants": [ "b4bb526d35fe15e7f5684797e7cc58c9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1505h2_8daaf6152771_efdcf0f9a773", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1505h2", "b": "8daaf6152771", "c": "efdcf0f9a773", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-65281-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391191, "last_seen": 1789391191, "transport": "t", "ja3_hash": "48c9a16366ab078b1cba4cd5f0cbbf69", "ja3_variant_count": 1, "ja3_variants": [ "48c9a16366ab078b1cba4cd5f0cbbf69" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h1_8daaf6152771_8e3b5f026003", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h1", "b": "8daaf6152771", "c": "8e3b5f026003", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-18-23-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524017, "last_seen": 1790524017, "transport": "t", "ja3_hash": "741227885ea2351e80faacaa32686b1b", "ja3_variant_count": 1, "ja3_variants": [ "741227885ea2351e80faacaa32686b1b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_01543ff06477", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "01543ff06477", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-5-65037-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790207556, "last_seen": 1790207556, "transport": "t", "ja3_hash": "41a9948f9462909b3c46c6e72eedf06c", "ja3_variant_count": 1, "ja3_variants": [ "41a9948f9462909b3c46c6e72eedf06c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_057b4e4d2b3d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "057b4e4d2b3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-23-51-35-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790253691, "last_seen": 1790253691, "transport": "t", "ja3_hash": "206f1061b3901cc8247c7bdb450e7f4d", "ja3_variant_count": 1, "ja3_variants": [ "206f1061b3901cc8247c7bdb450e7f4d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_0965147a6f52", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "0965147a6f52", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-65281-18-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789415558, "last_seen": 1789415558, "transport": "t", "ja3_hash": "6f4c7a4c5f7bf288a5394be8db6a00af", "ja3_variant_count": 1, "ja3_variants": [ "6f4c7a4c5f7bf288a5394be8db6a00af" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_317b1abd98bf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "317b1abd98bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-51764-23-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788778762, "last_seen": 1788778762, "transport": "t", "ja3_hash": "8b3269063f561862b003bf934c315c6f", "ja3_variant_count": 1, "ja3_variants": [ "8b3269063f561862b003bf934c315c6f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_41da1b532f1d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "41da1b532f1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-10-51-16-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791213933, "last_seen": 1791213933, "transport": "t", "ja3_hash": "2a4f746e7cfd600facb29133faf445d3", "ja3_variant_count": 1, "ja3_variants": [ "2a4f746e7cfd600facb29133faf445d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_43f8afbbfab7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "43f8afbbfab7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-51-16-5-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790013219, "last_seen": 1790013219, "transport": "t", "ja3_hash": "716482d55f8f80ec7fb509036bee84f7", "ja3_variant_count": 1, "ja3_variants": [ "716482d55f8f80ec7fb509036bee84f7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_4df255c676f9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "4df255c676f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-45-16-35-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790492254, "last_seen": 1790492254, "transport": "t", "ja3_hash": "ad419675f9f43a0ca77a782c723b1de0", "ja3_variant_count": 1, "ja3_variants": [ "ad419675f9f43a0ca77a782c723b1de0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_5424759ae979", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "5424759ae979", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-16-51764-51-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790778993, "last_seen": 1790778993, "transport": "t", "ja3_hash": "d0896788f0742ec06cc1b6b3a3728779", "ja3_variant_count": 1, "ja3_variants": [ "d0896788f0742ec06cc1b6b3a3728779" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_5b06854c7af9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "5b06854c7af9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-51-18-16-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790220362, "last_seen": 1790220362, "transport": "t", "ja3_hash": "2ab1455c42abef4c07663e96c91c460f", "ja3_variant_count": 1, "ja3_variants": [ "2ab1455c42abef4c07663e96c91c460f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_6336c6cb1417", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "6336c6cb1417", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17513-16-45-23-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790666672, "last_seen": 1790666672, "transport": "t", "ja3_hash": "1627429c719bfc24570de043f46f0a7e", "ja3_variant_count": 1, "ja3_variants": [ "1627429c719bfc24570de043f46f0a7e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_7387b6029475", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "7387b6029475", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-65281-45-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791169823, "last_seen": 1791169823, "transport": "t", "ja3_hash": "9a19463b11d621c7f3a50005b023728a", "ja3_variant_count": 1, "ja3_variants": [ "9a19463b11d621c7f3a50005b023728a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_745ca75e536c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "745ca75e536c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-45-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730567, "last_seen": 1789730567, "transport": "t", "ja3_hash": "4271f0e0099dbb988273bb7c6273153f", "ja3_variant_count": 1, "ja3_variants": [ "4271f0e0099dbb988273bb7c6273153f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_74759dd3ab6e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "74759dd3ab6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-51-10-18-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788876067, "last_seen": 1788876067, "transport": "t", "ja3_hash": "f0903a90e12599c4796876fc933c4434", "ja3_variant_count": 1, "ja3_variants": [ "f0903a90e12599c4796876fc933c4434" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_7acd2815969f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "7acd2815969f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-27-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789402740, "last_seen": 1789402740, "transport": "t", "ja3_hash": "5e208ec80f76000f73cb7518dce8f529", "ja3_variant_count": 1, "ja3_variants": [ "5e208ec80f76000f73cb7518dce8f529" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_7b8aa45a1046", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "7b8aa45a1046", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-35-18-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790249320, "last_seen": 1790249320, "transport": "t", "ja3_hash": "d0b2a30f6f22854765aad5c910d8fca1", "ja3_variant_count": 1, "ja3_variants": [ "d0b2a30f6f22854765aad5c910d8fca1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_810c6ce444a8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "810c6ce444a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-65037-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791000439, "last_seen": 1791000439, "transport": "t", "ja3_hash": "2defc56a5367d289dad9e34afd574aaa", "ja3_variant_count": 1, "ja3_variants": [ "2defc56a5367d289dad9e34afd574aaa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_86cadf1492a6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "86cadf1492a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-10-35-16-18-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790384007, "last_seen": 1790384007, "transport": "t", "ja3_hash": "d7fb3337b9ab991f2426bda9d7a1fc1a", "ja3_variant_count": 1, "ja3_variants": [ "d7fb3337b9ab991f2426bda9d7a1fc1a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_8e5c9cc2af63", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "8e5c9cc2af63", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-18-16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790517365, "last_seen": 1790517365, "transport": "t", "ja3_hash": "75662708800c1bff3a3a3a6481a217fa", "ja3_variant_count": 1, "ja3_variants": [ "75662708800c1bff3a3a3a6481a217fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_b0d3698e5096", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "b0d3698e5096", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-11-16-51-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790601248, "last_seen": 1790601248, "transport": "t", "ja3_hash": "972e8c346e8c877886d320767355a5c7", "ja3_variant_count": 1, "ja3_variants": [ "972e8c346e8c877886d320767355a5c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_b649636998cb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "b649636998cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-16-10-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789950624, "last_seen": 1789950624, "transport": "t", "ja3_hash": "134c7ba2ac0c53b5c3bbc440c2ae593c", "ja3_variant_count": 1, "ja3_variants": [ "134c7ba2ac0c53b5c3bbc440c2ae593c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_c1ec3f343e73", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "c1ec3f343e73", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-45-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790491667, "last_seen": 1790491667, "transport": "t", "ja3_hash": "bee672082e4de07ac761778fbd3002bc", "ja3_variant_count": 1, "ja3_variants": [ "bee672082e4de07ac761778fbd3002bc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_ce23fb417aac", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "ce23fb417aac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-51-35-27-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197013, "last_seen": 1790197013, "transport": "t", "ja3_hash": "2366d089118b33ec6a337a3633189e64", "ja3_variant_count": 1, "ja3_variants": [ "2366d089118b33ec6a337a3633189e64" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_d4db3e0c010c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "d4db3e0c010c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-65281-23-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791302058, "last_seen": 1791302058, "transport": "t", "ja3_hash": "1a5aa9fe7e72fa3a9117815ad2f1e38a", "ja3_variant_count": 1, "ja3_variants": [ "1a5aa9fe7e72fa3a9117815ad2f1e38a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_e793300d7d47", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "e793300d7d47", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-51-17613-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790615293, "last_seen": 1790615293, "transport": "t", "ja3_hash": "da035593c845ebb7de9a8dfe6ea8fbe5", "ja3_variant_count": 1, "ja3_variants": [ "da035593c845ebb7de9a8dfe6ea8fbe5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_ea204d78966a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "ea204d78966a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-17613-51-23-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790459480, "last_seen": 1790459480, "transport": "t", "ja3_hash": "4c795dee830f71e739bbd02cbe96a1ab", "ja3_variant_count": 1, "ja3_variants": [ "4c795dee830f71e739bbd02cbe96a1ab" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1506h2_8daaf6152771_ec24e4ee1cf2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1506h2", "b": "8daaf6152771", "c": "ec24e4ee1cf2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-5-11-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791122618, "last_seen": 1791122618, "transport": "t", "ja3_hash": "222ca11fae8c7f0e6e4b820de21aa605", "ja3_variant_count": 1, "ja3_variants": [ "222ca11fae8c7f0e6e4b820de21aa605" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h1_8daaf6152771_05766404738f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h1", "b": "8daaf6152771", "c": "05766404738f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-18-13-45-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790542287, "last_seen": 1790542287, "transport": "t", "ja3_hash": "04d0b80056f6575e1dd50155eab08933", "ja3_variant_count": 1, "ja3_variants": [ "04d0b80056f6575e1dd50155eab08933" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_0eb7788d75df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "0eb7788d75df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-10-16-35-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788491112, "last_seen": 1788491112, "transport": "t", "ja3_hash": "2a0e2e5bf7da374ba5954c58da1f9ae8", "ja3_variant_count": 1, "ja3_variants": [ "2a0e2e5bf7da374ba5954c58da1f9ae8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_10ed277f9ef1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "10ed277f9ef1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-27-65281-13-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789617350, "last_seen": 1789617350, "transport": "t", "ja3_hash": "47d33b797370a41f7cf1bcc1610f511b", "ja3_variant_count": 1, "ja3_variants": [ "47d33b797370a41f7cf1bcc1610f511b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_1566c837be95", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "1566c837be95", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-10-35-27-16-18,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788860939, "last_seen": 1788860939, "transport": "t", "ja3_hash": "16a317529e5084cf8cbe51392e4c6a23", "ja3_variant_count": 1, "ja3_variants": [ "16a317529e5084cf8cbe51392e4c6a23" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_1facd8e38c97", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "1facd8e38c97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-17613-27-16-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790998774, "last_seen": 1790998774, "transport": "t", "ja3_hash": "ab74d9f1901b1474c1fca51bf0a3bf2e", "ja3_variant_count": 1, "ja3_variants": [ "ab74d9f1901b1474c1fca51bf0a3bf2e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_1fcf7b400206", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "1fcf7b400206", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-17613-65037-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790595062, "last_seen": 1790595062, "transport": "t", "ja3_hash": "1c815c4756cd38ab6bfc1709389f189c", "ja3_variant_count": 1, "ja3_variants": [ "1c815c4756cd38ab6bfc1709389f189c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_2de458f6e166", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "2de458f6e166", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-5-10-16-18-51764,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790400254, "last_seen": 1790400254, "transport": "t", "ja3_hash": "3fe52ddd3e1e60e4d2030dfe61372a08", "ja3_variant_count": 1, "ja3_variants": [ "3fe52ddd3e1e60e4d2030dfe61372a08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_31d6346cb81e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "31d6346cb81e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-35-16-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790930582, "last_seen": 1790930582, "transport": "t", "ja3_hash": "a46890fc0cebdab949d00d78172ce654", "ja3_variant_count": 1, "ja3_variants": [ "a46890fc0cebdab949d00d78172ce654" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_3dc138390035", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "3dc138390035", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-23-17613-10-13-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789545185, "last_seen": 1789545185, "transport": "t", "ja3_hash": "456e59821300f0e55e6b927326d59bbb", "ja3_variant_count": 1, "ja3_variants": [ "456e59821300f0e55e6b927326d59bbb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_49f193ed448b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "49f193ed448b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-17613-27-51-23-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788932608, "last_seen": 1788932608, "transport": "t", "ja3_hash": "5d08ddf6ae475c4f353a079f7725b9c3", "ja3_variant_count": 1, "ja3_variants": [ "5d08ddf6ae475c4f353a079f7725b9c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_4a2ceb0da223", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "4a2ceb0da223", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-10-45-23-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789867018, "last_seen": 1789867018, "transport": "t", "ja3_hash": "ea2487c2f596c01d56ed4a51f2c3c54e", "ja3_variant_count": 1, "ja3_variants": [ "ea2487c2f596c01d56ed4a51f2c3c54e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_59b96b53af19", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "59b96b53af19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-18-35-17613-16-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789062931, "last_seen": 1789062931, "transport": "t", "ja3_hash": "c7c8545cee0eab243275db648c93717e", "ja3_variant_count": 1, "ja3_variants": [ "c7c8545cee0eab243275db648c93717e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_6463f7700619", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "6463f7700619", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-65281-10-16-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790563905, "last_seen": 1790563905, "transport": "t", "ja3_hash": "379a1b286554612e706d2e6ca92e42d5", "ja3_variant_count": 1, "ja3_variants": [ "379a1b286554612e706d2e6ca92e42d5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_7494fdb763c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "7494fdb763c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-16-35-5-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791045307, "last_seen": 1791045307, "transport": "t", "ja3_hash": "0815bbaac38594d54ab04368d4c7545d", "ja3_variant_count": 1, "ja3_variants": [ "0815bbaac38594d54ab04368d4c7545d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_75145a50a9bd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "75145a50a9bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-51764-23-27-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790079971, "last_seen": 1790079971, "transport": "t", "ja3_hash": "c0461c880709489614b9b22d6864494c", "ja3_variant_count": 1, "ja3_variants": [ "c0461c880709489614b9b22d6864494c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_7e9f881eb132", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "7e9f881eb132", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-11-13-18-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790247051, "last_seen": 1790247051, "transport": "t", "ja3_hash": "d67da7b056b9eec8c032f236a5136924", "ja3_variant_count": 1, "ja3_variants": [ "d67da7b056b9eec8c032f236a5136924" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_9f989d55f075", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "9f989d55f075", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-65281-35-11-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789751589, "last_seen": 1789751589, "transport": "t", "ja3_hash": "3f5a985f1a0ea515b24d4d966aa7a3b6", "ja3_variant_count": 1, "ja3_variants": [ "3f5a985f1a0ea515b24d4d966aa7a3b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_a555bcbf2bc9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "a555bcbf2bc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-13-10-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791285733, "last_seen": 1791285733, "transport": "t", "ja3_hash": "775c06ffea4e4e2a9cd1c5e1f62d88a4", "ja3_variant_count": 1, "ja3_variants": [ "775c06ffea4e4e2a9cd1c5e1f62d88a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_ae689d3866d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "ae689d3866d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-65281-5-65037-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791101277, "last_seen": 1791101277, "transport": "t", "ja3_hash": "9b1a2ccee9dcee2c62dca1a185d0f2cc", "ja3_variant_count": 1, "ja3_variants": [ "9b1a2ccee9dcee2c62dca1a185d0f2cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_afbcb77db765", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "afbcb77db765", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-65281-51764-51-16-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791246129, "last_seen": 1791246129, "transport": "t", "ja3_hash": "d8fa8376c647bf8f0ce55d216491aa66", "ja3_variant_count": 1, "ja3_variants": [ "d8fa8376c647bf8f0ce55d216491aa66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_b0b3c68bfe92", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "b0b3c68bfe92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-27-51-11-5-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790153199, "last_seen": 1790153199, "transport": "t", "ja3_hash": "22c76bb0ded4782c44ca658984a2bc80", "ja3_variant_count": 1, "ja3_variants": [ "22c76bb0ded4782c44ca658984a2bc80" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_b1a4f2c78826", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "b1a4f2c78826", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-51-35-17613-11-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790859697, "last_seen": 1790859697, "transport": "t", "ja3_hash": "a6a7e34a87d2af17f04ac2cf48e72a69", "ja3_variant_count": 1, "ja3_variants": [ "a6a7e34a87d2af17f04ac2cf48e72a69" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_bff5e00562ca", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "bff5e00562ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-23-10-11-65037-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790104228, "last_seen": 1790104228, "transport": "t", "ja3_hash": "55154b982658e8d31d689cd35a7a109e", "ja3_variant_count": 1, "ja3_variants": [ "55154b982658e8d31d689cd35a7a109e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_c6b7a2ed985f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "c6b7a2ed985f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-23-51764-18-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788911281, "last_seen": 1788911281, "transport": "t", "ja3_hash": "1d21eba3ef08a2ca8b8214cdb722940d", "ja3_variant_count": 1, "ja3_variants": [ "1d21eba3ef08a2ca8b8214cdb722940d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_de3a2e9504f9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "de3a2e9504f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-51764-45-18-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790252608, "last_seen": 1790252608, "transport": "t", "ja3_hash": "74949572ec95e0af58bc6bb662270796", "ja3_variant_count": 1, "ja3_variants": [ "74949572ec95e0af58bc6bb662270796" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_e0b201ca86c8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "e0b201ca86c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-51-16-35-17613-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789949800, "last_seen": 1789949800, "transport": "t", "ja3_hash": "dcd927dcb6897a8ef66110a0d78df740", "ja3_variant_count": 1, "ja3_variants": [ "dcd927dcb6897a8ef66110a0d78df740" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_f043f2ccc561", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "f043f2ccc561", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-23-5-16-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790211132, "last_seen": 1790211132, "transport": "t", "ja3_hash": "1d65531bd5e2a25c165ba054bdc0fc52", "ja3_variant_count": 1, "ja3_variants": [ "1d65531bd5e2a25c165ba054bdc0fc52" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_fce8a138ad83", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "fce8a138ad83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-11-65281-13-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790611105, "last_seen": 1790611105, "transport": "t", "ja3_hash": "b349051fb8ddf5663cf2299a52e7af1b", "ja3_variant_count": 1, "ja3_variants": [ "b349051fb8ddf5663cf2299a52e7af1b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h1_8daaf6152771_a2460445d57c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h1", "b": "8daaf6152771", "c": "a2460445d57c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-5-27-16-65037-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790545627, "last_seen": 1790545627, "transport": "t", "ja3_hash": "c114d45a1b7c53e4761779af2b0365a5", "ja3_variant_count": 1, "ja3_variants": [ "c114d45a1b7c53e4761779af2b0365a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_08a792c65da1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "08a792c65da1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-65281-45-16-13-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789253276, "last_seen": 1789253276, "transport": "t", "ja3_hash": "3e69c98b24f213f9bbf817d802b44f0b", "ja3_variant_count": 1, "ja3_variants": [ "3e69c98b24f213f9bbf817d802b44f0b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_1b1ce02dbc99", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "1b1ce02dbc99", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-18-65281-35-27-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789478085, "last_seen": 1789478085, "transport": "t", "ja3_hash": "55cfc88eb16ccca0714b4101d73eec31", "ja3_variant_count": 1, "ja3_variants": [ "55cfc88eb16ccca0714b4101d73eec31" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3225aaed9dfe", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3225aaed9dfe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-5-51-18-16-35-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788542023, "last_seen": 1788542023, "transport": "t", "ja3_hash": "6f39de4b40ace56bd6ccd970525cb922", "ja3_variant_count": 1, "ja3_variants": [ "6f39de4b40ace56bd6ccd970525cb922" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3819f89efd29", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3819f89efd29", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-65281-17613-13-16-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789582323, "last_seen": 1789582323, "transport": "t", "ja3_hash": "e9061cb290b30f850cf6d6179211625a", "ja3_variant_count": 1, "ja3_variants": [ "e9061cb290b30f850cf6d6179211625a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3aad94f89760", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3aad94f89760", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-65281-17613-11-18-51-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790244507, "last_seen": 1790244507, "transport": "t", "ja3_hash": "6f85e52ea4eacb49e91c611e951448d8", "ja3_variant_count": 1, "ja3_variants": [ "6f85e52ea4eacb49e91c611e951448d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3bd5cb5172ba", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3bd5cb5172ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-35-13-11-5-18-23,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931566, "last_seen": 1789931566, "transport": "t", "ja3_hash": "5a3a1c7ff03ef146a7b7630df5ea99e5", "ja3_variant_count": 1, "ja3_variants": [ "5a3a1c7ff03ef146a7b7630df5ea99e5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_41ed70721b56", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "41ed70721b56", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-17613-45-27-51-18-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790242106, "last_seen": 1790242106, "transport": "t", "ja3_hash": "6c9b41da1245a98a734abe36cd58698f", "ja3_variant_count": 1, "ja3_variants": [ "6c9b41da1245a98a734abe36cd58698f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_47f19204c909", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "47f19204c909", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-13-16-35-45-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790638292, "last_seen": 1790638292, "transport": "t", "ja3_hash": "f452c77dcd33f1f8d2eea4b1b3af33c1", "ja3_variant_count": 1, "ja3_variants": [ "f452c77dcd33f1f8d2eea4b1b3af33c1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_4b53028a2715", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "4b53028a2715", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-5-27-16-51764-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790400254, "last_seen": 1790400254, "transport": "t", "ja3_hash": "430d5a9cf3b5295e16814b85ccf450c6", "ja3_variant_count": 1, "ja3_variants": [ "430d5a9cf3b5295e16814b85ccf450c6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_541eb61b3ab1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "541eb61b3ab1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-5-11-10-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789196277, "last_seen": 1789196277, "transport": "t", "ja3_hash": "d00448e8463e13e0ea57412099b1dae6", "ja3_variant_count": 1, "ja3_variants": [ "d00448e8463e13e0ea57412099b1dae6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_54460493fae5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "54460493fae5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-65037-27-35-16-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790008485, "last_seen": 1790008485, "transport": "t", "ja3_hash": "83f6e9224e72e2876cae876cb18dbead", "ja3_variant_count": 1, "ja3_variants": [ "83f6e9224e72e2876cae876cb18dbead" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_6b60287f541d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "6b60287f541d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-13-27-11-65037-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790106275, "last_seen": 1790106275, "transport": "t", "ja3_hash": "e7200a2fe32449026569dc440f74fcc9", "ja3_variant_count": 1, "ja3_variants": [ "e7200a2fe32449026569dc440f74fcc9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_6cc87a9df605", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "6cc87a9df605", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-5-27-65281-51764-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790764068, "last_seen": 1790764068, "transport": "t", "ja3_hash": "ef35d1d8df89f48e968c7d4ce6f07973", "ja3_variant_count": 1, "ja3_variants": [ "ef35d1d8df89f48e968c7d4ce6f07973" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_7027c4f4131a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "7027c4f4131a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-16-18-13-17613-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790954004, "last_seen": 1790954004, "transport": "t", "ja3_hash": "ca70866c7a6234ba96cb7bffdde1eb8e", "ja3_variant_count": 1, "ja3_variants": [ "ca70866c7a6234ba96cb7bffdde1eb8e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_75d1f9c55191", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "75d1f9c55191", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-11-51764-65281-27-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788514909, "last_seen": 1788514909, "transport": "t", "ja3_hash": "7c24b9911f514f0dd77908de2ebe803c", "ja3_variant_count": 1, "ja3_variants": [ "7c24b9911f514f0dd77908de2ebe803c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_7aac7e436890", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "7aac7e436890", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-27-51-45-11-16-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789062932, "last_seen": 1789062932, "transport": "t", "ja3_hash": "7de038b0b7a974245d02f040e8d0deb6", "ja3_variant_count": 1, "ja3_variants": [ "7de038b0b7a974245d02f040e8d0deb6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_960578f014b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "960578f014b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-11-51-65281-18-17613-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789430692, "last_seen": 1789430692, "transport": "t", "ja3_hash": "2137edc912f3080d263c333014647a75", "ja3_variant_count": 1, "ja3_variants": [ "2137edc912f3080d263c333014647a75" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_9b566607c4f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "9b566607c4f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-11-18-65281-27-17613-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789463336, "last_seen": 1789463336, "transport": "t", "ja3_hash": "54247dff55cd67d6b1da96c8abd9cf32", "ja3_variant_count": 1, "ja3_variants": [ "54247dff55cd67d6b1da96c8abd9cf32" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_a0711822b781", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "a0711822b781", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-17613-11-27-45-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789467195, "last_seen": 1789467195, "transport": "t", "ja3_hash": "50fea6fde0e34a809ae6b502cd44bff5", "ja3_variant_count": 1, "ja3_variants": [ "50fea6fde0e34a809ae6b502cd44bff5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_a1d79d390f9f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "a1d79d390f9f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-35-10-23-51764-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789744531, "last_seen": 1789744531, "transport": "t", "ja3_hash": "f8bf0551b6389e92a5a608b508827969", "ja3_variant_count": 1, "ja3_variants": [ "f8bf0551b6389e92a5a608b508827969" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_ad4e5ebcc3e0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "ad4e5ebcc3e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-51764-65281-35-10-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723895, "last_seen": 1788723895, "transport": "t", "ja3_hash": "241ce40399b9a6865c10447c4a3aa08e", "ja3_variant_count": 1, "ja3_variants": [ "241ce40399b9a6865c10447c4a3aa08e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_afb4dcb7f981", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "afb4dcb7f981", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-16-18-5-27-65281-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790337426, "last_seen": 1790337426, "transport": "t", "ja3_hash": "973a67be6c8886e1c0de353391339349", "ja3_variant_count": 1, "ja3_variants": [ "973a67be6c8886e1c0de353391339349" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_d57df442efa3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "d57df442efa3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-27-18-51-35-5-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790905130, "last_seen": 1790905130, "transport": "t", "ja3_hash": "c0516c6b08d98681a79d50356c579aa0", "ja3_variant_count": 1, "ja3_variants": [ "c0516c6b08d98681a79d50356c579aa0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_d8c55735d155", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "d8c55735d155", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-35-17613-5-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790622544, "last_seen": 1790622544, "transport": "t", "ja3_hash": "5ffb2c00ca2ce7c157353b12640c2344", "ja3_variant_count": 1, "ja3_variants": [ "5ffb2c00ca2ce7c157353b12640c2344" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_eac087866b28", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "eac087866b28", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-17613-23-27-16-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790819980, "last_seen": 1790819980, "transport": "t", "ja3_hash": "c2e4163bbbe5dbc0383f08c838c363b4", "ja3_variant_count": 1, "ja3_variants": [ "c2e4163bbbe5dbc0383f08c838c363b4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_f1a111b46443", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "f1a111b46443", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-65037-23-16-11-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788448166, "last_seen": 1788448166, "transport": "t", "ja3_hash": "8abb6e244391edc262a2673650a4116a", "ja3_variant_count": 1, "ja3_variants": [ "8abb6e244391edc262a2673650a4116a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_f2f9bc6a6b49", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "f2f9bc6a6b49", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-18-35-5-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789847467, "last_seen": 1789847467, "transport": "t", "ja3_hash": "42b26653c2ab1df2117300ab5635481b", "ja3_variant_count": 1, "ja3_variants": [ "42b26653c2ab1df2117300ab5635481b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_f4ef2db0f9ee", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "f4ef2db0f9ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-16-13-27-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790520859, "last_seen": 1790520859, "transport": "t", "ja3_hash": "0c8e31310210304d950c86ca52bb5a2d", "ja3_variant_count": 1, "ja3_variants": [ "0c8e31310210304d950c86ca52bb5a2d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h1_8daaf6152771_4ddd4d84542c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h1", "b": "8daaf6152771", "c": "4ddd4d84542c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-18-51-45-65281-10-35-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790559463, "last_seen": 1790559463, "transport": "t", "ja3_hash": "3bce151e37c54ed4bfa23157f10684a0", "ja3_variant_count": 1, "ja3_variants": [ "3bce151e37c54ed4bfa23157f10684a0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_0de19ea910aa", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "0de19ea910aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-18-16-5-13-65281-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791229709, "last_seen": 1791229709, "transport": "t", "ja3_hash": "559d48bba2716bf122dd3b9cdeae15ff", "ja3_variant_count": 1, "ja3_variants": [ "559d48bba2716bf122dd3b9cdeae15ff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_0faf7d3e4c5a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "0faf7d3e4c5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-35-23-18-27-10-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789517698, "last_seen": 1789517698, "transport": "t", "ja3_hash": "f04b3d4930774f0d98b35d1f74a7b320", "ja3_variant_count": 1, "ja3_variants": [ "f04b3d4930774f0d98b35d1f74a7b320" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_11b3671e67a5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "11b3671e67a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-10-65281-45-51764-65037-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790329178, "last_seen": 1790329178, "transport": "t", "ja3_hash": "afd14c987d4947ac915f2857b549501b", "ja3_variant_count": 1, "ja3_variants": [ "afd14c987d4947ac915f2857b549501b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_1849556a3e6a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "1849556a3e6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-10-17613-65037-65281-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790219982, "last_seen": 1790219982, "transport": "t", "ja3_hash": "328d7c870437ecc9badb7923eed1cb48", "ja3_variant_count": 1, "ja3_variants": [ "328d7c870437ecc9badb7923eed1cb48" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_31c443769eb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "31c443769eb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-23-10-65281-5-27-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790239289, "last_seen": 1790239289, "transport": "t", "ja3_hash": "4259eaea30c72af94c299e55c45c3cb5", "ja3_variant_count": 1, "ja3_variants": [ "4259eaea30c72af94c299e55c45c3cb5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_61b428ce7a46", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "61b428ce7a46", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-65037-45-51764-18-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790188278, "last_seen": 1790188278, "transport": "t", "ja3_hash": "07d251abb8c8c1ab5a47a197cb3ef943", "ja3_variant_count": 1, "ja3_variants": [ "07d251abb8c8c1ab5a47a197cb3ef943" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_64279d7341cc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "64279d7341cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-23-18-45-5-11-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790786095, "last_seen": 1790786095, "transport": "t", "ja3_hash": "63e8c627add1c6367a2e76fa61c5eb3e", "ja3_variant_count": 1, "ja3_variants": [ "63e8c627add1c6367a2e76fa61c5eb3e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_65d7df6850db", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "65d7df6850db", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-18-5-23-10-65281-11-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788897833, "last_seen": 1788897833, "transport": "t", "ja3_hash": "40d8e1fe432cd900c82b6f0b9bf30fe2", "ja3_variant_count": 1, "ja3_variants": [ "40d8e1fe432cd900c82b6f0b9bf30fe2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_6d1b2207b01c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "6d1b2207b01c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-23-35-18-10-17613-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791216843, "last_seen": 1791216843, "transport": "t", "ja3_hash": "8291f942750fa64252d1d3e5b391c5f6", "ja3_variant_count": 1, "ja3_variants": [ "8291f942750fa64252d1d3e5b391c5f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_70eb9d457524", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "70eb9d457524", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-35-10-45-5-17613-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790241354, "last_seen": 1790241354, "transport": "t", "ja3_hash": "7933520e22cf125a8eb933f19b9af1f7", "ja3_variant_count": 1, "ja3_variants": [ "7933520e22cf125a8eb933f19b9af1f7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_81b23e1cfe8b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "81b23e1cfe8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-18-35-51-16-23-11-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790239289, "last_seen": 1790239289, "transport": "t", "ja3_hash": "9e2303058e95f8c9e3428a1ed17b8a52", "ja3_variant_count": 1, "ja3_variants": [ "9e2303058e95f8c9e3428a1ed17b8a52" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_8720c114d136", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "8720c114d136", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-16-5-35-65037-27-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789559513, "last_seen": 1789559513, "transport": "t", "ja3_hash": "e465c4586607cea73f106f465e48c4e2", "ja3_variant_count": 1, "ja3_variants": [ "e465c4586607cea73f106f465e48c4e2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_baf35259f0a3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "baf35259f0a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-51764-65037-16-10-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789572026, "last_seen": 1789572026, "transport": "t", "ja3_hash": "04bf4a0b90a2230a4f16360e4d00afd2", "ja3_variant_count": 1, "ja3_variants": [ "04bf4a0b90a2230a4f16360e4d00afd2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_bd11714b9262", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "bd11714b9262", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-23-17613-16-13-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788561627, "last_seen": 1788561627, "transport": "t", "ja3_hash": "dee18219164557a28ff35519a90b48f6", "ja3_variant_count": 1, "ja3_variants": [ "dee18219164557a28ff35519a90b48f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_c9ac86013c8a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "c9ac86013c8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-65281-35-45-5-23-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789676095, "last_seen": 1789676095, "transport": "t", "ja3_hash": "238985e1f7cf0110cd99a6aa072a62fe", "ja3_variant_count": 1, "ja3_variants": [ "238985e1f7cf0110cd99a6aa072a62fe" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_e72a096aeedc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "e72a096aeedc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-10-16-17613-45-27-11-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790215114, "last_seen": 1790215114, "transport": "t", "ja3_hash": "2b63ab13b5a7936a20e7ffdcbe273ca9", "ja3_variant_count": 1, "ja3_variants": [ "2b63ab13b5a7936a20e7ffdcbe273ca9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_e760ec0b3a69", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "e760ec0b3a69", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-51-11-45-27-17613-23-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790242201, "last_seen": 1790242201, "transport": "t", "ja3_hash": "afc8b1723f6ea25c405f596620c8452b", "ja3_variant_count": 1, "ja3_variants": [ "afc8b1723f6ea25c405f596620c8452b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_ea47e43b21a4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "ea47e43b21a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-65037-45-18-17613-16-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789744518, "last_seen": 1789744518, "transport": "t", "ja3_hash": "5942a0ee5a4799d5a6373a08a75e75dc", "ja3_variant_count": 1, "ja3_variants": [ "5942a0ee5a4799d5a6373a08a75e75dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h1_8daaf6152771_b65bc14d537d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h1", "b": "8daaf6152771", "c": "b65bc14d537d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-11-27-23-45-13-18-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790650482, "last_seen": 1790650482, "transport": "t", "ja3_hash": "7bb785e78d14242e6aa1f5cfb502288e", "ja3_variant_count": 1, "ja3_variants": [ "7bb785e78d14242e6aa1f5cfb502288e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_0f1c0d585a59", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "0f1c0d585a59", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-5-65037-27-23-35-16-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789398570, "last_seen": 1789398570, "transport": "t", "ja3_hash": "e649538e50e045a5d0ed2383e1a529e7", "ja3_variant_count": 1, "ja3_variants": [ "e649538e50e045a5d0ed2383e1a529e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_1adffa8f8dd6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "1adffa8f8dd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-11-27-23-45-65281-51-10-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931634, "last_seen": 1789931634, "transport": "t", "ja3_hash": "1d3273d26880e8e6bd1f857ea42b955f", "ja3_variant_count": 1, "ja3_variants": [ "1d3273d26880e8e6bd1f857ea42b955f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_3fe0579d3ed7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "3fe0579d3ed7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-17613-27-5-10-65281-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790754173, "last_seen": 1790754173, "transport": "t", "ja3_hash": "287c10949f93a54b8ebd33a57f008f7b", "ja3_variant_count": 1, "ja3_variants": [ "287c10949f93a54b8ebd33a57f008f7b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_55f57fe9406a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "55f57fe9406a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-11-45-16-17613-23-35-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791015453, "last_seen": 1791015453, "transport": "t", "ja3_hash": "e27152ab823abec797b5557ae5c6ccc7", "ja3_variant_count": 1, "ja3_variants": [ "e27152ab823abec797b5557ae5c6ccc7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_8b729da37de9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "8b729da37de9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-16-10-18-45-65037-13-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789693045, "last_seen": 1789693045, "transport": "t", "ja3_hash": "ff7bc7c6de82cf9301c919546b90fd35", "ja3_variant_count": 1, "ja3_variants": [ "ff7bc7c6de82cf9301c919546b90fd35" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_8d28cf51bedc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "8d28cf51bedc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-17613-5-18-51764-27-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789638536, "last_seen": 1789638536, "transport": "t", "ja3_hash": "7793d00cccc3e08eb4d293c8bf81a97f", "ja3_variant_count": 1, "ja3_variants": [ "7793d00cccc3e08eb4d293c8bf81a97f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_980bfa27ccb2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "980bfa27ccb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-45-23-13-27-11-16-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788496640, "last_seen": 1788496640, "transport": "t", "ja3_hash": "ff0cf3ee399b1b589e01c06cdd180283", "ja3_variant_count": 1, "ja3_variants": [ "ff0cf3ee399b1b589e01c06cdd180283" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_ae700b083824", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "ae700b083824", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-10-16-45-5-35-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015035, "last_seen": 1789015035, "transport": "t", "ja3_hash": "3fadcdabf2b9f8e483682ab2b545b185", "ja3_variant_count": 1, "ja3_variants": [ "3fadcdabf2b9f8e483682ab2b545b185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_b8465e333ec7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "b8465e333ec7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-65281-18-10-5-35-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789617344, "last_seen": 1789617344, "transport": "t", "ja3_hash": "8abde88dc971b8308645868b77b19207", "ja3_variant_count": 1, "ja3_variants": [ "8abde88dc971b8308645868b77b19207" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_b9ac5e6308c2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "b9ac5e6308c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-5-65037-10-51764-45-13-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790008482, "last_seen": 1790008482, "transport": "t", "ja3_hash": "f39f96aac13365e1706e93342c00153e", "ja3_variant_count": 1, "ja3_variants": [ "f39f96aac13365e1706e93342c00153e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_c094ecaabaea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "c094ecaabaea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-17613-35-18-13-27-16-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789369474, "last_seen": 1789369474, "transport": "t", "ja3_hash": "76a76a0455c37cce4a7f86ecba591164", "ja3_variant_count": 1, "ja3_variants": [ "76a76a0455c37cce4a7f86ecba591164" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_d7ec8b2f1aa4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "d7ec8b2f1aa4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-10-11-35-65281-27-18-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788454687, "last_seen": 1788454687, "transport": "t", "ja3_hash": "4abe7b29775c9795f877b9de9551694d", "ja3_variant_count": 1, "ja3_variants": [ "4abe7b29775c9795f877b9de9551694d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_dfd4d69e6341", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "dfd4d69e6341", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-18-16-17613-51764-5-23-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791255584, "last_seen": 1791255584, "transport": "t", "ja3_hash": "7deec7f5d89faa50726a1f9ae55e516f", "ja3_variant_count": 1, "ja3_variants": [ "7deec7f5d89faa50726a1f9ae55e516f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_e0f54a189e7d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "e0f54a189e7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-13-65037-16-5-11-18-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790596893, "last_seen": 1790596893, "transport": "t", "ja3_hash": "255eae115c7dcb7248ab9648602ede69", "ja3_variant_count": 1, "ja3_variants": [ "255eae115c7dcb7248ab9648602ede69" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_eb82186874a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "eb82186874a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-45-23-11-17613-16-51764-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730567, "last_seen": 1789730567, "transport": "t", "ja3_hash": "bb166a837c2b43ac7150c2510f86434f", "ja3_variant_count": 1, "ja3_variants": [ "bb166a837c2b43ac7150c2510f86434f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_f386194d7ef6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "f386194d7ef6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-65037-5-11-17613-45-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789414870, "last_seen": 1789414870, "transport": "t", "ja3_hash": "db1da6fa2d9510d99367c617c395aad4", "ja3_variant_count": 1, "ja3_variants": [ "db1da6fa2d9510d99367c617c395aad4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1510h2_8daaf6152771_f922a566b475", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1510h2", "b": "8daaf6152771", "c": "f922a566b475", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-35-17613-11-23-18-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790202576, "last_seen": 1790202576, "transport": "t", "ja3_hash": "6f000a50617a6fd96fac0155c4d1c94c", "ja3_variant_count": 1, "ja3_variants": [ "6f000a50617a6fd96fac0155c4d1c94c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_0968e040be30", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "0968e040be30", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-27-5-23-13-51764-45-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788776659, "last_seen": 1788776659, "transport": "t", "ja3_hash": "663cebbaf8fd109a63b18ca0176dd495", "ja3_variant_count": 1, "ja3_variants": [ "663cebbaf8fd109a63b18ca0176dd495" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_320e343aa6dc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "320e343aa6dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-45-10-23-27-16-17613-65281-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788491105, "last_seen": 1788491105, "transport": "t", "ja3_hash": "41f86ace2d523bdb64df7098ca0c8185", "ja3_variant_count": 1, "ja3_variants": [ "41f86ace2d523bdb64df7098ca0c8185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_52a5af5f622d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "52a5af5f622d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65037-65281-45-10-5-18-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789431408, "last_seen": 1789431408, "transport": "t", "ja3_hash": "5cb2a448457cc3fa834848ee664bffcc", "ja3_variant_count": 1, "ja3_variants": [ "5cb2a448457cc3fa834848ee664bffcc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_55869acab536", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "55869acab536", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-23-11-27-35-13-5-16-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790931415, "last_seen": 1790931415, "transport": "t", "ja3_hash": "b2d35fefbe304f4c16cbd6143e08e902", "ja3_variant_count": 1, "ja3_variants": [ "b2d35fefbe304f4c16cbd6143e08e902" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_5b88218b99ac", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "5b88218b99ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51764-65037-16-45-10-5-11-13-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791259231, "last_seen": 1791259231, "transport": "t", "ja3_hash": "ffbb277beb9fd62b32519e2af0939191", "ja3_variant_count": 1, "ja3_variants": [ "ffbb277beb9fd62b32519e2af0939191" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_63e75f0e92ac", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "63e75f0e92ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-23-65281-16-17613-65037-35-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790775872, "last_seen": 1790775872, "transport": "t", "ja3_hash": "02652afb6b59e9d867984a13e44db8e8", "ja3_variant_count": 1, "ja3_variants": [ "02652afb6b59e9d867984a13e44db8e8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_6581f3800b87", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "6581f3800b87", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-45-18-17613-16-11-51764-10-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791232409, "last_seen": 1791232409, "transport": "t", "ja3_hash": "e3f74b990126d799361675d32437bf95", "ja3_variant_count": 1, "ja3_variants": [ "e3f74b990126d799361675d32437bf95" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_6801fe325ac5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "6801fe325ac5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-17613-16-13-45-35-18-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790840401, "last_seen": 1790840401, "transport": "t", "ja3_hash": "35b451070fde9b3dc10633400b7c7cf9", "ja3_variant_count": 1, "ja3_variants": [ "35b451070fde9b3dc10633400b7c7cf9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_79cfec709a48", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "79cfec709a48", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-16-17613-65281-23-35-51764-5-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788499351, "last_seen": 1788499351, "transport": "t", "ja3_hash": "97107aa1a48419d04dfa37e7cfa29049", "ja3_variant_count": 1, "ja3_variants": [ "97107aa1a48419d04dfa37e7cfa29049" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_7be8703dfe02", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "7be8703dfe02", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65037-17613-16-11-18-5-51764-13-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789984923, "last_seen": 1789984923, "transport": "t", "ja3_hash": "67ea32d962e7211d12b0f5085797490a", "ja3_variant_count": 1, "ja3_variants": [ "67ea32d962e7211d12b0f5085797490a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_7f120964cd27", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "7f120964cd27", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-13-17613-65281-16-11-45-23-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788891717, "last_seen": 1788891717, "transport": "t", "ja3_hash": "5040d62310aad50ea7f0da0c2bf56b2f", "ja3_variant_count": 1, "ja3_variants": [ "5040d62310aad50ea7f0da0c2bf56b2f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_8934c96212b8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "8934c96212b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-65037-5-23-10-27-35-65281-17613-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789658018, "last_seen": 1789658018, "transport": "t", "ja3_hash": "5cb4ba1db31c1c99c0195b2f91973cb3", "ja3_variant_count": 1, "ja3_variants": [ "5cb4ba1db31c1c99c0195b2f91973cb3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_8bfd182cf565", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "8bfd182cf565", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-35-65281-13-17613-27-45-18-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791168023, "last_seen": 1791168023, "transport": "t", "ja3_hash": "45046117c57741df9d5b6f3c0ec15bb6", "ja3_variant_count": 1, "ja3_variants": [ "45046117c57741df9d5b6f3c0ec15bb6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_af22d0c84162", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "af22d0c84162", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-18-11-35-23-16-10-13-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791067589, "last_seen": 1791067589, "transport": "t", "ja3_hash": "964c03090dc094b5819c66fcff0b100e", "ja3_variant_count": 1, "ja3_variants": [ "964c03090dc094b5819c66fcff0b100e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_cfcd491eb659", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "cfcd491eb659", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-17613-65281-13-23-45-10-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790516688, "last_seen": 1790516688, "transport": "t", "ja3_hash": "1d7e54d63083fd9552be8f6d45974520", "ja3_variant_count": 1, "ja3_variants": [ "1d7e54d63083fd9552be8f6d45974520" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_d70f2e40ee3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "d70f2e40ee3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-65037-13-45-65281-16-11-18-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789704608, "last_seen": 1789704608, "transport": "t", "ja3_hash": "1a5bda93591bbb7016c42111ef1a7fc6", "ja3_variant_count": 1, "ja3_variants": [ "1a5bda93591bbb7016c42111ef1a7fc6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1511h2_8daaf6152771_f185fa46ae68", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1511h2", "b": "8daaf6152771", "c": "f185fa46ae68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51764-5-65037-17613-65281-10-23-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788945091, "last_seen": 1788945091, "transport": "t", "ja3_hash": "19548cc1e29f1cdaeea0ec4dfb2b6a03", "ja3_variant_count": 1, "ja3_variants": [ "19548cc1e29f1cdaeea0ec4dfb2b6a03" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_67a5bdf8c29a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "67a5bdf8c29a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-51764-35-45-27-16-18-65281-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788891365, "last_seen": 1788891365, "transport": "t", "ja3_hash": "bbe9247d7ab1a66669cae8e8508a201b", "ja3_variant_count": 1, "ja3_variants": [ "bbe9247d7ab1a66669cae8e8508a201b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_73bb0cafcabc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "73bb0cafcabc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-13-27-17613-18-16-35-65281-5-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790222318, "last_seen": 1790222318, "transport": "t", "ja3_hash": "671fb034b6e3da3e915561d08a56c0b2", "ja3_variant_count": 1, "ja3_variants": [ "671fb034b6e3da3e915561d08a56c0b2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_8423e8b48f42", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "8423e8b48f42", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-45-16-35-13-51764-18-65037-5-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508348, "last_seen": 1788508348, "transport": "t", "ja3_hash": "dcd5ba94e28819e47731427835075004", "ja3_variant_count": 1, "ja3_variants": [ "dcd5ba94e28819e47731427835075004" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_96935d829e54", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "96935d829e54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-5-65037-16-17613-65281-23-18-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391190, "last_seen": 1789391190, "transport": "t", "ja3_hash": "060bbbaeedd78bd5eb8f55257f758b20", "ja3_variant_count": 1, "ja3_variants": [ "060bbbaeedd78bd5eb8f55257f758b20" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_aa634d860130", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "aa634d860130", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-16-17613-23-65037-13-27-35-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788542448, "last_seen": 1788542448, "transport": "t", "ja3_hash": "6dadfe89b5f087c79806361ab22d7bf3", "ja3_variant_count": 1, "ja3_variants": [ "6dadfe89b5f087c79806361ab22d7bf3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_b964f4d6f061", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "b964f4d6f061", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-18-5-13-16-27-65037-65281-45-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790252246, "last_seen": 1790252246, "transport": "t", "ja3_hash": "399df17935b85e3cf42075bfcc64fafb", "ja3_variant_count": 1, "ja3_variants": [ "399df17935b85e3cf42075bfcc64fafb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_ba231424323b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "ba231424323b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-5-11-18-35-10-27-16-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788442219, "last_seen": 1788442219, "transport": "t", "ja3_hash": "b55da5a9287b60645990a12b46b8df1f", "ja3_variant_count": 1, "ja3_variants": [ "b55da5a9287b60645990a12b46b8df1f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_bdae94000642", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "bdae94000642", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-10-17613-5-13-35-23-18-16-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791092461, "last_seen": 1791092461, "transport": "t", "ja3_hash": "ece8fbbc4dc4c4df0ac846bdb8baa953", "ja3_variant_count": 1, "ja3_variants": [ "ece8fbbc4dc4c4df0ac846bdb8baa953" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_c3b22e90674a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "c3b22e90674a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-13-65281-11-65037-45-35-27-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790202095, "last_seen": 1790202095, "transport": "t", "ja3_hash": "b54a4c12241a4510f20654a3a4109834", "ja3_variant_count": 1, "ja3_variants": [ "b54a4c12241a4510f20654a3a4109834" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1512h2_8daaf6152771_cfdf6605d3a5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "cfdf6605d3a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-23-27-65281-35-65037-10-16-5-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020752, "last_seen": 1791020752, "transport": "t", "ja3_hash": "12987d8f2e01a3efb053dd3e5a70eb17", "ja3_variant_count": 1, "ja3_variants": [ "12987d8f2e01a3efb053dd3e5a70eb17" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_21d4bdf9bf46", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "21d4bdf9bf46", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-13-27-18-65281-65037-11-16-5-17613-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791045597, "last_seen": 1791045597, "transport": "t", "ja3_hash": "8f793e602b0fff0a701a82f41a67259d", "ja3_variant_count": 1, "ja3_variants": [ "8f793e602b0fff0a701a82f41a67259d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_235c36c1b92e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "235c36c1b92e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-51764-5-11-16-65281-65037-35-45-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790870960, "last_seen": 1790870960, "transport": "t", "ja3_hash": "6c0d41dcfea31116172c9b462c06967b", "ja3_variant_count": 1, "ja3_variants": [ "6c0d41dcfea31116172c9b462c06967b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_451efbc968e6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "451efbc968e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-23-16-45-18-13-11-27-5-17613-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790202403, "last_seen": 1790202403, "transport": "t", "ja3_hash": "c8081d6c2d5f544ba83e310e5fbeba5e", "ja3_variant_count": 1, "ja3_variants": [ "c8081d6c2d5f544ba83e310e5fbeba5e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_46542c49e17c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "46542c49e17c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-10-13-17613-23-5-35-11-45-27-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789750659, "last_seen": 1789750659, "transport": "t", "ja3_hash": "9951cb0ac30b6a07e78edbc9601e3ac1", "ja3_variant_count": 1, "ja3_variants": [ "9951cb0ac30b6a07e78edbc9601e3ac1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_8c32e6731cf9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "8c32e6731cf9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-65281-16-13-5-10-27-17613-45-18-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791251111, "last_seen": 1791251111, "transport": "t", "ja3_hash": "f0760444fae03ca07bfea80e01ac114c", "ja3_variant_count": 1, "ja3_variants": [ "f0760444fae03ca07bfea80e01ac114c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_a4c022edbcae", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "a4c022edbcae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-18-11-65281-10-51764-5-35-17613-27-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723894, "last_seen": 1788723894, "transport": "t", "ja3_hash": "6f78a6951af85a37da6ee04e203d75a5", "ja3_variant_count": 1, "ja3_variants": [ "6f78a6951af85a37da6ee04e203d75a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_cfc5794f8f3d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "cfc5794f8f3d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-35-18-23-16-17613-10-51764-5-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789728394, "last_seen": 1789728394, "transport": "t", "ja3_hash": "9f5591f1d5c0e3e2b2693a6dc098511e", "ja3_variant_count": 1, "ja3_variants": [ "9f5591f1d5c0e3e2b2693a6dc098511e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1513h2_8daaf6152771_fc34bed59d22", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1513h2", "b": "8daaf6152771", "c": "fc34bed59d22", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-65037-65281-23-11-35-17613-51764-16-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790107160, "last_seen": 1790107160, "transport": "t", "ja3_hash": "acd3eb7defba91ceba948f6ed18635f5", "ja3_variant_count": 1, "ja3_variants": [ "acd3eb7defba91ceba948f6ed18635f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1514h2_8daaf6152771_bd367129f6ad", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1514h2", "b": "8daaf6152771", "c": "bd367129f6ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51764-16-45-17613-65281-35-10-27-5-11-13-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788512321, "last_seen": 1788512321, "transport": "t", "ja3_hash": "ce3a1f75f17c72bfb5cb39f68d4372ae", "ja3_variant_count": 1, "ja3_variants": [ "ce3a1f75f17c72bfb5cb39f68d4372ae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1515h2_8daaf6152771_5873aad116a0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i1515h2", "b": "8daaf6152771", "c": "5873aad116a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-17613-65281-35-10-11-45-27-51764-65037-18-23-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790532666, "last_seen": 1790532666, "transport": "t", "ja3_hash": "2aa98001b63a73f51d10e63f7baeec8e", "ja3_variant_count": 1, "ja3_variants": [ "2aa98001b63a73f51d10e63f7baeec8e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i2108ht_76e208dd3e22_09f609c8facd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i2108ht", "b": "76e208dd3e22", "c": "09f609c8facd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 21, "extension_count": 8, "alpn": "ht" } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,5-10-11-13-35-16-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787475198, "last_seen": 1790874996, "transport": "t", "ja3_hash": "e62a5f4d538cbf169c2af71bec2399b4", "ja3_variant_count": 1, "ja3_variants": [ "e62a5f4d538cbf169c2af71bec2399b4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i4905ht_730fb1b0ac6a_8cd38e60fdc3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t12i4905ht", "b": "730fb1b0ac6a", "c": "8cd38e60fdc3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 49, "extension_count": 5, "alpn": "ht" } }, "ja3_string": "771,49200-49196-49199-49195-159-158-49202-49198-49201-49197-165-161-164-160-49192-49188-49172-49162-49194-49190-49167-49157-49191-49187-49171-49161-49193-49189-49166-49156-107-105-104-57-55-54-103-63-62-51-49-48-157-156-61-53-60-47-255,11-10-13-15-16,23-25-24-22,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 22, "name": "22 (0x0016)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 75, "first_seen": 1788475169, "last_seen": 1790786483, "transport": "t", "ja3_hash": "872afe5bfa5995245e58609aa23f6a0d", "ja3_variant_count": 1, "ja3_variants": [ "872afe5bfa5995245e58609aa23f6a0d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d000500_e3b0c44298fc_7f4491e7bc3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d000500", "b": "e3b0c44298fc", "c": "7f4491e7bc3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 0, "extension_count": 5, "alpn": null } }, "ja3_string": "771,,10-0-13-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790234013, "last_seen": 1790316719, "transport": "t", "ja3_hash": "af412cf0203c2e94f8e85c491ff6ead8", "ja3_variant_count": 1, "ja3_variants": [ "af412cf0203c2e94f8e85c491ff6ead8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d010500_a21e9f97bdf3_7f4491e7bc3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d010500", "b": "a21e9f97bdf3", "c": "7f4491e7bc3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 5, "alpn": null } }, "ja3_string": "771,61132,10-0-13-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 61132, "name": "61132 (0xeecc)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790233952, "last_seen": 1790233952, "transport": "t", "ja3_hash": "23ef7216e15210894102e4903f1690bf", "ja3_variant_count": 1, "ja3_variants": [ "23ef7216e15210894102e4903f1690bf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d010600_a21e9f97bdf3_ec5015a3aa28", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d010600", "b": "a21e9f97bdf3", "c": "ec5015a3aa28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 6, "alpn": null } }, "ja3_string": "771,61132,10-0-13-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 61132, "name": "61132 (0xeecc)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 15, "first_seen": 1790161510, "last_seen": 1790678671, "transport": "t", "ja3_hash": "37b2579e422d4641b853e502d5bfc387", "ja3_variant_count": 1, "ja3_variants": [ "37b2579e422d4641b853e502d5bfc387" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0107h2_019185d5a21d_e2515e582fb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0107h2", "b": "019185d5a21d", "c": "e2515e582fb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,198,0-43-10-51-13-45-16,514,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 198, "name": "198 (0x00c6)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [] }, "observed": { "count": 149, "first_seen": 1791292464, "last_seen": 1791363210, "transport": "t", "ja3_hash": "6ca00fbc233879fc300ab17641256653", "ja3_variant_count": 3, "ja3_variants": [ "6ca00fbc233879fc300ab17641256653", "3f78db0f1d984def2e34dc429a6a651a", "06446f2c11ad2cb140ada81f814e7e43" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0107h2_0f2cb44170f4_e2515e582fb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0107h2", "b": "0f2cb44170f4", "c": "e2515e582fb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865,0-43-10-51-13-45-16,514,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [] }, "observed": { "count": 149, "first_seen": 1791292465, "last_seen": 1791363210, "transport": "t", "ja3_hash": "64b1032f8df96dcac988151f1c0f41b9", "ja3_variant_count": 3, "ja3_variants": [ "64b1032f8df96dcac988151f1c0f41b9", "1c949053b50a6a213d39926e29124f64", "1d668c1ebe79f63c301ba486c142adaf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0107h2_58070c528ac8_e2515e582fb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0107h2", "b": "58070c528ac8", "c": "e2515e582fb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4867,0-43-10-51-13-45-16,514,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [] }, "observed": { "count": 285, "first_seen": 1791292464, "last_seen": 1791363210, "transport": "t", "ja3_hash": "4311919f5803a1bfd38f887e7ac3dead", "ja3_variant_count": 3, "ja3_variants": [ "4311919f5803a1bfd38f887e7ac3dead", "d3dc7098a8da5d939f5ce30c73da1e1e", "d136adddda4f174330769f7ad8c15641" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0107h2_8ecb5bcd8cd8_e2515e582fb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0107h2", "b": "8ecb5bcd8cd8", "c": "e2515e582fb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4868,0-43-10-51-13-45-16,514,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [] }, "observed": { "count": 149, "first_seen": 1791292464, "last_seen": 1791363210, "transport": "t", "ja3_hash": "cdaa2f3de8fe3974cc9d5061246e339a", "ja3_variant_count": 3, "ja3_variants": [ "cdaa2f3de8fe3974cc9d5061246e339a", "b8b70f8897aa21fd559dd5edd0ebf7c4", "edc6231a0bce33961d26c770f788cbf6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0107h2_b870aa68d133_e2515e582fb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0107h2", "b": "b870aa68d133", "c": "e2515e582fb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,199,0-43-10-51-13-45-16,514,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [] }, "observed": { "count": 149, "first_seen": 1791292464, "last_seen": 1791363210, "transport": "t", "ja3_hash": "949fef35d1615fd6d0edc233f81bbf09", "ja3_variant_count": 3, "ja3_variants": [ "949fef35d1615fd6d0edc233f81bbf09", "f53152a28ca0bd2febfa6d2c7d1d5ec4", "5c7588d151988a1da0a0efdc97c7214e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0107h2_c7f4f146491d_e2515e582fb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0107h2", "b": "c7f4f146491d", "c": "e2515e582fb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4869,0-43-10-51-13-45-16,514,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [] }, "observed": { "count": 149, "first_seen": 1791292464, "last_seen": 1791363210, "transport": "t", "ja3_hash": "260893d930525b9311da10d486ef3dee", "ja3_variant_count": 3, "ja3_variants": [ "260893d930525b9311da10d486ef3dee", "88e64d21f3e81fbe0504109e450a0d4f", "9bb9877935340e1468b9faa89b847008" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0107h2_ee47968ec53b_e2515e582fb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0107h2", "b": "ee47968ec53b", "c": "e2515e582fb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4866,0-43-10-51-13-45-16,514,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [] }, "observed": { "count": 161, "first_seen": 1791292464, "last_seen": 1791363210, "transport": "t", "ja3_hash": "4d220186fe716b17f82d27d9678ea454", "ja3_variant_count": 3, "ja3_variants": [ "4d220186fe716b17f82d27d9678ea454", "b4dc4400467a0b4be667c0968bf1919b", "364cce6162daf1b4d4248afe1b9e7ccb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d011000_ee47968ec53b_b3d208934f58", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d011000", "b": "ee47968ec53b", "c": "b3d208934f58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866,0-10-35-22-23-13-43-45-51-27,514-4589-4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791318538, "last_seen": 1791318538, "transport": "t", "ja3_hash": "6e9ee0dae6b59374fdde937740004a3d", "ja3_variant_count": 1, "ja3_variants": [ "6e9ee0dae6b59374fdde937740004a3d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d011100_0f2cb44170f4_aeb2b64a872a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d011100", "b": "0f2cb44170f4", "c": "aeb2b64a872a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791206532, "last_seen": 1791206532, "transport": "t", "ja3_hash": "1bb5b30ecaadbe40a7790f049a83b5fb", "ja3_variant_count": 1, "ja3_variants": [ "1bb5b30ecaadbe40a7790f049a83b5fb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d011100_58070c528ac8_aeb2b64a872a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d011100", "b": "58070c528ac8", "c": "aeb2b64a872a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4867,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791206532, "last_seen": 1791206532, "transport": "t", "ja3_hash": "d933e3bb12e791f8c4092d861c6a4ffc", "ja3_variant_count": 1, "ja3_variants": [ "d933e3bb12e791f8c4092d861c6a4ffc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d011100_ee47968ec53b_aeb2b64a872a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d011100", "b": "ee47968ec53b", "c": "aeb2b64a872a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 1, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791206532, "last_seen": 1791206532, "transport": "t", "ja3_hash": "d96cc035c0a53322464a1cf376b9f44c", "ja3_variant_count": 1, "ja3_variants": [ "d96cc035c0a53322464a1cf376b9f44c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0207h2_fffbd61365f3_e2515e582fb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0207h2", "b": "fffbd61365f3", "c": "e2515e582fb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 2, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4866-4867,0-43-10-51-13-45-16,514,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [] }, "observed": { "count": 148, "first_seen": 1791294438, "last_seen": 1791363210, "transport": "t", "ja3_hash": "74626a706c56abbb29454639bd26a1c3", "ja3_variant_count": 5, "ja3_variants": [ "74626a706c56abbb29454639bd26a1c3", "95d1364e6a74d65bf9f654819c295921", "0c8bb028ea7476fe26f885610d4989b3", "722596e5ab1ea65390b4cc4fdb46e7f7", "50b540fe3d6e8d55782c7eef36d0d4a2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0307h2_55b375c5d22e_2b813b6b2cb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0307h2", "b": "55b375c5d22e", "c": "2b813b6b2cb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867,0-43-10-51-13-45-16,4588-29-23-30-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789488953, "last_seen": 1789489035, "transport": "t", "ja3_hash": "19d049360355b96a5be9770eedbe3f36", "ja3_variant_count": 1, "ja3_variants": [ "19d049360355b96a5be9770eedbe3f36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d030900_55b375c5d22e_3fb7e35edb64", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d030900", "b": "55b375c5d22e", "c": "3fb7e35edb64", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867,0-18-65037-5-10-13-50-43-51,29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 22, "first_seen": 1787480191, "last_seen": 1791181171, "transport": "t", "ja3_hash": "02429cee3f7e112df5fbd7b72066c80a", "ja3_variant_count": 1, "ja3_variants": [ "02429cee3f7e112df5fbd7b72066c80a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d030900_55b375c5d22e_dce569508a71", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d030900", "b": "55b375c5d22e", "c": "dce569508a71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865,0-10-35-22-23-13-43-45-51,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788838592, "last_seen": 1791319585, "transport": "t", "ja3_hash": "6f97bb9ec3a3e42646cad6fa2e5b88b9", "ja3_variant_count": 5, "ja3_variants": [ "6f97bb9ec3a3e42646cad6fa2e5b88b9", "0b143b076a3ebbc7b62cc09cc16ba4c9", "cfbf4ed81afd4f615c635ae7399e395b", "a945eda45a4b5ed7ea4f9807014796f6", "fce3470a4b99a660ad2b38536031e197" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d031000_55b375c5d22e_b5f1502c64c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d031000", "b": "55b375c5d22e", "c": "b5f1502c64c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865,0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 44, "first_seen": 1788710029, "last_seen": 1791319585, "transport": "t", "ja3_hash": "f5c2d6c1503bcf489bc6027b73c55e95", "ja3_variant_count": 5, "ja3_variants": [ "f5c2d6c1503bcf489bc6027b73c55e95", "09f54c71a63b6b1441bd0d025213f201", "1b75737858c6effb61324cae4d8a609d", "e5a1fa621451cd58d650a2fed8044585", "36f0db3d48644ae9f5b45f887d77f8a7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d031000_55b375c5d22e_c99e22d5336f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d031000", "b": "55b375c5d22e", "c": "c99e22d5336f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865,0-10-35-22-23-13-43-45-51-27,4589,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4589, "name": "4589 (0x11ed)", "known": false } ], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1790269599, "last_seen": 1790273484, "transport": "t", "ja3_hash": "ad34d569c58ef8113efbbeff1086e654", "ja3_variant_count": 3, "ja3_variants": [ "ad34d569c58ef8113efbbeff1086e654", "044e39c5a5360dd23f2eafc84d5f86c9", "3915cb7b77041fc4165e7aef461f9ac7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d031000_5d5efb78cdb0_b5f1502c64c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d031000", "b": "5d5efb78cdb0", "c": "b5f1502c64c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4868-4869,0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791319683, "last_seen": 1791319683, "transport": "t", "ja3_hash": "8ef731df3af60d690e9603d8df2cdddf", "ja3_variant_count": 1, "ja3_variants": [ "8ef731df3af60d690e9603d8df2cdddf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d031100_55b375c5d22e_635104d325f0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d031100", "b": "55b375c5d22e", "c": "635104d325f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 44, "first_seen": 1787464620, "last_seen": 1791289941, "transport": "t", "ja3_hash": "bf8552b4338989802acb9315f00dbbe7", "ja3_variant_count": 1, "ja3_variants": [ "bf8552b4338989802acb9315f00dbbe7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d031100_55b375c5d22e_6f9e2867e4b9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d031100", "b": "55b375c5d22e", "c": "6f9e2867e4b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865,0-11-10-35-22-23-13-43-45-51-27,4588-4589-29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 148, "first_seen": 1791294438, "last_seen": 1791363210, "transport": "t", "ja3_hash": "eba678ee84b55915b89ff1924a97d5d7", "ja3_variant_count": 1, "ja3_variants": [ "eba678ee84b55915b89ff1924a97d5d7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d031100_55b375c5d22e_aeb2b64a872a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d031100", "b": "55b375c5d22e", "c": "aeb2b64a872a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865,0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 119, "first_seen": 1788525327, "last_seen": 1791317666, "transport": "t", "ja3_hash": "7c5d0596cedb9c086e8bebef099e73dc", "ja3_variant_count": 5, "ja3_variants": [ "7c5d0596cedb9c086e8bebef099e73dc", "4e2c06ee8efc88ac876ccc99282311df", "55c573e924485d33041ae400987255f3", "3d279aaddb78527e9210e5d9282bc229", "3d622dc951bc68a4653b5ae99e6e2dda" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0312h2_55b375c5d22e_16d5fd281d0e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0312h2", "b": "55b375c5d22e", "c": "16d5fd281d0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 100, "first_seen": 1789064655, "last_seen": 1789137434, "transport": "t", "ja3_hash": "597039baddf9dd436734cebbf9847496", "ja3_variant_count": 2, "ja3_variants": [ "597039baddf9dd436734cebbf9847496", "1bcbceb7d6c06f583eeb65246997739f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d040600_f03b13587ee1_827bd6fd5353", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d040600", "b": "f03b13587ee1", "c": "827bd6fd5353", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4868-4869-255,0-10-11-13-43-51,29-23-24-25-30-256-257-4588-4587-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-26-27-28-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509863, "last_seen": 1791290842, "transport": "t", "ja3_hash": "4727c3a5fbcb61a92bb997698e5a846e", "ja3_variant_count": 1, "ja3_variants": [ "4727c3a5fbcb61a92bb997698e5a846e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d041000_ed60d9558351_b5f1502c64c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d041000", "b": "ed60d9558351", "c": "b5f1502c64c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4867-4868-4869,0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791319683, "last_seen": 1791319683, "transport": "t", "ja3_hash": "4e10e5671d4bbd89adeb294e3d50678a", "ja3_variant_count": 1, "ja3_variants": [ "4e10e5671d4bbd89adeb294e3d50678a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d041100_16476d049b0b_73702258a521", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d041100", "b": "16476d049b0b", "c": "73702258a521", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-35-5-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 62, "first_seen": 1787509865, "last_seen": 1791319589, "transport": "t", "ja3_hash": "80700cb88113eb45240dab69aadf2826", "ja3_variant_count": 1, "ja3_variants": [ "80700cb88113eb45240dab69aadf2826" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0411h2_16476d049b0b_a78b9a7aa7a1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0411h2", "b": "16476d049b0b", "c": "a78b9a7aa7a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 168, "first_seen": 1787509863, "last_seen": 1791290847, "transport": "t", "ja3_hash": "8a90cbcdd6c3024b17337525922f12b9", "ja3_variant_count": 1, "ja3_variants": [ "8a90cbcdd6c3024b17337525922f12b9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d050600_13f69f63e3fe_83fe30743d85", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d050600", "b": "13f69f63e3fe", "c": "83fe30743d85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 6, "alpn": null } }, "ja3_string": "771,198-199-4865-4868-4869,10-0-13-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 26, "first_seen": 1789653174, "last_seen": 1790678621, "transport": "t", "ja3_hash": "1336e65066ae4b2c24d74c96a29e2b4c", "ja3_variant_count": 1, "ja3_variants": [ "1336e65066ae4b2c24d74c96a29e2b4c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d050600_75d938f10e26_827bd6fd5353", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d050600", "b": "75d938f10e26", "c": "827bd6fd5353", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4867-4868-4869-255,0-10-11-13-43-51,29-23-24-25-30-256-257-4588-4587-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-26-27-28-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509856, "last_seen": 1791290842, "transport": "t", "ja3_hash": "1291c5bcb2f6101dc99f62ea2d53d768", "ja3_variant_count": 1, "ja3_variants": [ "1291c5bcb2f6101dc99f62ea2d53d768" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d050700_fe8b0b18143e_2f3d4148c47a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d050700", "b": "fe8b0b18143e", "c": "2f3d4148c47a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869,0-11-35-13-43-10-51,256,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 46, "first_seen": 1791319683, "last_seen": 1791319686, "transport": "t", "ja3_hash": "2ab3feea80b5507e93f995a2bd056a2f", "ja3_variant_count": 46, "ja3_variants": [ "2ab3feea80b5507e93f995a2bd056a2f", "2736d7d4ceb50d02a9d8be75129a09b7", "4d001cf4fed76e11f64cc554c127c1c2", "2575baa429d73f3a1ef79616ff134fc1", "7fea0fa347730fbbf4716d744474bbe6", "dd7fe923444f8bee84ab45bec299ad2e", "85b0cf15f152518ab9aea9f97fc15487", "3e04a33522e602de5067c5cd02581e6b", "0e840575e82dfc1da1f83ad567f966c8", "ba7496c0e229adecb0f342cb3624d896", "bc43a7ec86e0cc17455efe9075c60cc1", "9578b62a339d47d1423388b4b08fd242" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d051000_d55e91d5c3b2_cc96517400c0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d051000", "b": "d55e91d5c3b2", "c": "cc96517400c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788706831, "last_seen": 1789364194, "transport": "t", "ja3_hash": "624fc9c483a36be55313ea2630717fbc", "ja3_variant_count": 1, "ja3_variants": [ "624fc9c483a36be55313ea2630717fbc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d051000_fe8b0b18143e_b5f1502c64c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d051000", "b": "fe8b0b18143e", "c": "b5f1502c64c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 5, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869,0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791319683, "last_seen": 1791319683, "transport": "t", "ja3_hash": "2362f9d64a89efe6ee1d3d87091a12a9", "ja3_variant_count": 1, "ja3_variants": [ "2362f9d64a89efe6ee1d3d87091a12a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d060500_a6485224f4b1_7f4491e7bc3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d060500", "b": "a6485224f4b1", "c": "7f4491e7bc3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 5, "alpn": null } }, "ja3_string": "771,198-199-4865-4867-4868-4869,10-0-13-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790316707, "last_seen": 1790316707, "transport": "t", "ja3_hash": "c368e595c4e84988db51849c3b218cd9", "ja3_variant_count": 1, "ja3_variants": [ "c368e595c4e84988db51849c3b218cd9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d060600_a150a9413979_827bd6fd5353", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d060600", "b": "a150a9413979", "c": "827bd6fd5353", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4868-4869-4867-255,0-10-11-13-43-51,1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-25-26-27-28-29-30-256-257-258-259-260-4588-4587,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 350, "first_seen": 1787509858, "last_seen": 1791290843, "transport": "t", "ja3_hash": "b0a5ff463e446f01d3f968c1d72fe8f3", "ja3_variant_count": 8, "ja3_variants": [ "b0a5ff463e446f01d3f968c1d72fe8f3", "723f132a5f8e4df6d3b3cffc6a0adb8c", "877398420ef17eb88990074c65f5b91c", "bfde521bffcc510f3d5515a743683698", "54faf2f91fbbb069efec488ae341918e", "67564387362c3d70f818f02a65dd43c9", "bcd23381143ed2c32b8c7f3440a641e5", "052ff46d15b3b39f7cb7b38bb2ca792f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d060600_a6485224f4b1_83fe30743d85", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d060600", "b": "a6485224f4b1", "c": "83fe30743d85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 6, "alpn": null } }, "ja3_string": "771,198-199-4865-4867-4868-4869,10-0-13-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 21, "first_seen": 1789653174, "last_seen": 1790678619, "transport": "t", "ja3_hash": "da26f2c40e1f4c0812b5bd573f347edf", "ja3_variant_count": 1, "ja3_variants": [ "da26f2c40e1f4c0812b5bd573f347edf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d060700_a150a9413979_241b3681de17", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d060700", "b": "a150a9413979", "c": "241b3681de17", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 7, "alpn": null } }, "ja3_string": "771,255-4866-4865-4867-4868-4869,51-11-43-0-50-10-13,29-30-25-24-23-33-32-31,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 27, "first_seen": 1787710530, "last_seen": 1791284223, "transport": "t", "ja3_hash": "2f8ab4e846536235e3a043f3c5635ac8", "ja3_variant_count": 7, "ja3_variants": [ "2f8ab4e846536235e3a043f3c5635ac8", "343624f5dcfa001bfe9c82bd02b79c12", "292a23d18e391ecdb06c8dccedd524d2", "8c0f69fcea584e69b655512d0961c4a0", "cf111b18dad9aafdabb04e2d5cbf2983", "a5c511e872d7b937bb510525c4d7c8e8", "a95c1f4324bd5a6262ff98669c0d9f36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d061100_a150a9413979_ce3af45f0a37", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d061100", "b": "a150a9413979", "c": "ce3af45f0a37", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4869-4868-255,0-11-10-35-22-23-13-43-45-51-41,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509873, "last_seen": 1791290858, "transport": "t", "ja3_hash": "8a5045bb4bff4ea43f73711399d0e5a8", "ja3_variant_count": 1, "ja3_variants": [ "8a5045bb4bff4ea43f73711399d0e5a8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d061100_da75d768228b_408777b7afc8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d061100", "b": "da75d768228b", "c": "408777b7afc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 6, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-4865-4866,0-11-65281-23-18-5-10-13-50-43-51,4588-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788881622, "last_seen": 1788881622, "transport": "t", "ja3_hash": "5e8ac5c73ac325743464fa03c7d4d809", "ja3_variant_count": 1, "ja3_variants": [ "5e8ac5c73ac325743464fa03c7d4d809" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070400_c2f3549b8eb7_d8799e1c6a2a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070400", "b": "c2f3549b8eb7", "c": "d8799e1c6a2a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1790232484, "last_seen": 1790233955, "transport": "t", "ja3_hash": "45551a4c747b2ae4f8241c264c4d28ef", "ja3_variant_count": 1, "ja3_variants": [ "45551a4c747b2ae4f8241c264c4d28ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070500_c2f3549b8eb7_7f4491e7bc3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070500", "b": "c2f3549b8eb7", "c": "7f4491e7bc3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 5, "alpn": null } }, "ja3_string": "773,4865-4866-4867-4868-4869-198-199,10-0-13-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 773, "name": "773 (0x0305)" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 13, "first_seen": 1790232672, "last_seen": 1790678632, "transport": "t", "ja3_hash": "e4bc38472d8c8965bfffc8427bf93449", "ja3_variant_count": 9, "ja3_variants": [ "e4bc38472d8c8965bfffc8427bf93449", "68c7a55f0a7e37b9d42cbadac046329c", "a8446cbe96aeeb553b6209465f51006e", "e1ce80bf2a7366d8268484507ad4f3b9", "6ea5022a10982208b4281e39236439fc", "640c7bda281a7fecc0f490d35d9f9fce", "da753a34eff695846569c953656066c7", "4157a82bad35b70514d3a9e9fa363269", "8c39eeb3ded959986690b5e2e4c762f7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070600_c2f3549b8eb7_4043a812f115", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070600", "b": "c2f3549b8eb7", "c": "4043a812f115", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-43-51-65281-13,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 12, "first_seen": 1790161505, "last_seen": 1790678672, "transport": "t", "ja3_hash": "76cee820dc11ece78652812d217fed23", "ja3_variant_count": 1, "ja3_variants": [ "76cee820dc11ece78652812d217fed23" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070600_c2f3549b8eb7_83fe30743d85", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070600", "b": "c2f3549b8eb7", "c": "83fe30743d85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-65281,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 241, "first_seen": 1789653166, "last_seen": 1790678637, "transport": "t", "ja3_hash": "5c06a6e140b4d06398861b4043ed281c", "ja3_variant_count": 8, "ja3_variants": [ "5c06a6e140b4d06398861b4043ed281c", "5a835cb56fd547cb9b2e475447d21645", "dd50834fa61add78a8c00db7ea3f2925", "a914c792418d079720527c7acd7e09e4", "188ee2d33a9648c1382ec8bb325897fd", "518dae58aac755998789b2d634d0871a", "6ac3f2f3f61c9a013fe62af2a6232da5", "9accfbbb7b67c37aca0bef37fe7f8979" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070600_c2f3549b8eb7_b3482a6e6e3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070600", "b": "c2f3549b8eb7", "c": "b3482a6e6e3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-65281,23-24-25-29-30-31-32-33-41,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false } ], "point_formats": [] }, "observed": { "count": 63, "first_seen": 1789653178, "last_seen": 1790678623, "transport": "t", "ja3_hash": "d668ef29ed3a180c2282c4eb40d7cce8", "ja3_variant_count": 1, "ja3_variants": [ "d668ef29ed3a180c2282c4eb40d7cce8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070600_c2f3549b8eb7_ec5015a3aa28", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070600", "b": "c2f3549b8eb7", "c": "ec5015a3aa28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-65281,4589,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4589, "name": "4589 (0x11ed)", "known": false } ], "point_formats": [] }, "observed": { "count": 71, "first_seen": 1790161485, "last_seen": 1790678636, "transport": "t", "ja3_hash": "9904f911c5a6806a257f08daab9b9d94", "ja3_variant_count": 9, "ja3_variants": [ "9904f911c5a6806a257f08daab9b9d94", "c6e9dd800d34ec47bf48dcc54f5bc48e", "02ba65684e626aa45c26075b84ca9df6", "5d92fdaa9f503950afd01307fa7f1776", "7a92ed42890b9d3e9302a59bdd030456", "bef96667b4bb48fbf2277286638d0542", "329826403acc2f1ad0fe21c0e8ca5da8", "d82793894278deb0dcd3a3375feed2cf", "8dc375311e62da252163462c9d262681" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070700_c2f3549b8eb7_042c22f55c40", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070700", "b": "c2f3549b8eb7", "c": "042c22f55c40", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-50-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789654761, "last_seen": 1789654762, "transport": "t", "ja3_hash": "c78b462a8ef5805740b412bf4bb51976", "ja3_variant_count": 1, "ja3_variants": [ "c78b462a8ef5805740b412bf4bb51976" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070700_c2f3549b8eb7_41917e49ace6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070700", "b": "c2f3549b8eb7", "c": "41917e49ace6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-65281-23,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1790161501, "last_seen": 1790678657, "transport": "t", "ja3_hash": "6ea20a2ed54c3257040d15410a9c248b", "ja3_variant_count": 1, "ja3_variants": [ "6ea20a2ed54c3257040d15410a9c248b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070700_c2f3549b8eb7_789c7f32381e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070700", "b": "c2f3549b8eb7", "c": "789c7f32381e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-21-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1790161497, "last_seen": 1790678651, "transport": "t", "ja3_hash": "17b3128a45b4ff42e0e9767bed36f3d8", "ja3_variant_count": 1, "ja3_variants": [ "17b3128a45b4ff42e0e9767bed36f3d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070700_c2f3549b8eb7_78f1cb93ff72", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070700", "b": "c2f3549b8eb7", "c": "78f1cb93ff72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-65281-771,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 771, "name": "771 (0x0303)", "known": false } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 9, "first_seen": 1790232436, "last_seen": 1790678617, "transport": "t", "ja3_hash": "84ae88d36524467218a396c35c5b677c", "ja3_variant_count": 1, "ja3_variants": [ "84ae88d36524467218a396c35c5b677c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070700_c2f3549b8eb7_f704dab46ad1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070700", "b": "c2f3549b8eb7", "c": "f704dab46ad1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-65281-24,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 24, "name": "24 (0x0018)", "known": false } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 107, "first_seen": 1790161537, "last_seen": 1790678630, "transport": "t", "ja3_hash": "fb9d2629e8752ab313eb3c6b232a6abf", "ja3_variant_count": 1, "ja3_variants": [ "fb9d2629e8752ab313eb3c6b232a6abf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0707h2_c2f3549b8eb7_e2515e582fb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0707h2", "b": "c2f3549b8eb7", "c": "e2515e582fb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-4869-198-199,0-43-10-51-13-45-16,24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 10482, "first_seen": 1791292464, "last_seen": 1791363210, "transport": "t", "ja3_hash": "0e907d009872132e8a0b4daeab45c270", "ja3_variant_count": 82, "ja3_variants": [ "0e907d009872132e8a0b4daeab45c270", "008442a7dc93fa577e338961e563d304", "52d921b10e9501887beec5a22548fb25", "f6232bb3346ae88f1003f2fb16b5c0d9", "c0d25f5684d12abb72ca86994f2e25ed", "f82602be1895276ff9a2e745e66ad2de", "9c4cef733473d6d3797d6fbba80a87c1", "af690fd47a8254b4eb1bdffeda707c6a", "074015ef09d8586934045ad23d7e2ff4", "b565acdea9097306e240b4b7b68f7c84", "b3a52a06eb410ec7aece697cb49b95a7", "35746fefe5f8607d0ce4573db9ed9247" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070800_c2f3549b8eb7_f9f33d96b593", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070800", "b": "c2f3549b8eb7", "c": "f9f33d96b593", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-45-65281-41,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1790234002, "last_seen": 1790316737, "transport": "t", "ja3_hash": "abecd8dab75133c082470ada1c973e19", "ja3_variant_count": 1, "ja3_variants": [ "abecd8dab75133c082470ada1c973e19" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070900_c2f3549b8eb7_94c5e2e22320", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070900", "b": "c2f3549b8eb7", "c": "94c5e2e22320", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-42-45-65281-41,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 42, "name": "early_data", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790234007, "last_seen": 1790316738, "transport": "t", "ja3_hash": "78db91bf24586ba283a581dad244b87b", "ja3_variant_count": 1, "ja3_variants": [ "78db91bf24586ba283a581dad244b87b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d070900_c2f3549b8eb7_bf114986101a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d070900", "b": "c2f3549b8eb7", "c": "bf114986101a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 7, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-198-199,10-0-13-43-51-45-35-65281-41,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 2823, "first_seen": 1790234017, "last_seen": 1790316747, "transport": "t", "ja3_hash": "7b9d4797c6a17d5d8330e66ecba6b057", "ja3_variant_count": 1, "ja3_variants": [ "7b9d4797c6a17d5d8330e66ecba6b057" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d080500_9a5205a0092a_7f4491e7bc3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d080500", "b": "9a5205a0092a", "c": "7f4491e7bc3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 8, "extension_count": 5, "alpn": null } }, "ja3_string": "771,5071-43521-4866-4867-4868-4869-198-199,10-0-13-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5071, "name": "5071 (0x13cf)", "known": false }, { "value": 43521, "name": "43521 (0xaa01)", "known": false }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790678625, "last_seen": 1790678625, "transport": "t", "ja3_hash": "0dd56e806112dfec0bb0e443b01ddd0c", "ja3_variant_count": 1, "ja3_variants": [ "0dd56e806112dfec0bb0e443b01ddd0c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d080600_9a5205a0092a_ec5015a3aa28", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d080600", "b": "9a5205a0092a", "c": "ec5015a3aa28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 8, "extension_count": 6, "alpn": null } }, "ja3_string": "771,5071-43521-4866-4867-4868-4869-198-199,10-0-13-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5071, "name": "5071 (0x13cf)", "known": false }, { "value": 43521, "name": "43521 (0xaa01)", "known": false }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1790161478, "last_seen": 1790336042, "transport": "t", "ja3_hash": "cb5bfea9830b641c0ac1503e777fc3ad", "ja3_variant_count": 1, "ja3_variants": [ "cb5bfea9830b641c0ac1503e777fc3ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d090900_f91f431d341e_543460421724", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d090900", "b": "f91f431d341e", "c": "543460421724", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392,51-11-0-13-10-45-43-23-5,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 43, "first_seen": 1788453332, "last_seen": 1789412577, "transport": "t", "ja3_hash": "5d9d54599020a6ea3921d3fe9cb1870e", "ja3_variant_count": 43, "ja3_variants": [ "5d9d54599020a6ea3921d3fe9cb1870e", "67602f2dccd28912f9cb056155efe167", "6e06136f8db80d64fa1a1f2884598b23", "fd400e4614c87a40535e78a81da76bb5", "bb5290198f0dcfab4df7cf33e6701e93", "3ac1a4cf21907a597cb6d0303496d26f", "44ac68d1b2984d6f19fbf4cc714681ce", "021577f57230895e49a17a2ac161e7e8", "56a5347cc9311746e2b3a066bf2f502f", "e43c06e707a7ff35fb58bf6bfadd6955", "75e8cc8b665cc6ecd78bdef8cba15fe7", "333ae22f861edc6956f42fa37629f6e4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d091000_f91f431d341e_0e0b92dd4b31", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d091000", "b": "f91f431d341e", "c": "0e0b92dd4b31", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392,51-11-43-13-23-0-5-10-45-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1791312906, "last_seen": 1791314954, "transport": "t", "ja3_hash": "7e494e88d0adb040e70af7b5ad9a8599", "ja3_variant_count": 7, "ja3_variants": [ "7e494e88d0adb040e70af7b5ad9a8599", "46a5ccd976e965289c17fdaa9712b00d", "8fd3dab060e08967b41b766618a54019", "3ee964538a1da05f4f8f89b297895ce2", "9c42f65ed2a111c3ba6d87725cc9a913", "3c4a41bd6bea04108e0ad451fd6b0258", "1d84b3bb876380c346ed62a2d6b2f99c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d091000_f91f431d341e_978abd8b448c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d091000", "b": "f91f431d341e", "c": "978abd8b448c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392,23-45-43-10-5-27-0-13-51-11,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 69, "first_seen": 1789442430, "last_seen": 1789928296, "transport": "t", "ja3_hash": "cb744cb411795143e72c65cd6f8c91b7", "ja3_variant_count": 69, "ja3_variants": [ "cb744cb411795143e72c65cd6f8c91b7", "e23204efd255ce484efa2b98ea754ed8", "2df5f07453a4c7d69a451391acc7e279", "516fa70a7d4edd87606da686b890e8cc", "0529cab7a42735ed49bacc6900b75c4a", "f5413729c324a92e0c50ea0a8b429096", "4f5ab700728b34c3962fe9d500295274", "00959fa3d1e9dc6d8f1afa9d99cc6994", "96d7c755e86181f8730b6adc47ed6a87", "412649d6b14f74fd5b58e26a4bd2f87b", "12522f859d9564b52377ae54bf49d852", "67707526aab7c9fbbd69ab1c9408fd8d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d091000_f91f431d341e_f6d7ce0f4a3c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d091000", "b": "f91f431d341e", "c": "f6d7ce0f4a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392,0-13-5-11-27-23-43-10-45-51,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 80, "first_seen": 1789935705, "last_seen": 1791337016, "transport": "t", "ja3_hash": "1f2e2a49de731f9a25599fe46dc2f2e9", "ja3_variant_count": 80, "ja3_variants": [ "1f2e2a49de731f9a25599fe46dc2f2e9", "ba358274c9f669eab40d86b73a095a0f", "5e5b7a1e973cd90116b4058e5177eac3", "8db2805d318e32d4c3c45e080445dba7", "2e5c814e46be6a118f2b294c04bd165a", "40a45a14405b643f7bfd298a26ae75a9", "6cbf5f5649e6fa40bd3db782f632b376", "89c863fe36df85f659837eecf5e88f8d", "19309a3de2bce401caff38e32a2c4158", "445c81099121d3e1e022393a338a4995", "091846064021e19d06457db0f2d36c02", "3d1cd8afec3aec57fbc3ef6cca409487" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d0911h1_f91f431d341e_fe5d0254026e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d0911h1", "b": "f91f431d341e", "c": "fe5d0254026e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392,11-0-13-45-10-23-16-5-51-43-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 77, "first_seen": 1791316720, "last_seen": 1791363210, "transport": "t", "ja3_hash": "823caed64b5017e1494f7e722abf6fb8", "ja3_variant_count": 77, "ja3_variants": [ "823caed64b5017e1494f7e722abf6fb8", "2ad88e7b12961673873868c07cc20910", "0ce4f111df2efdd7d03602e830d3b53e", "a76bdc3818cc66858db5ac1d431c92e1", "dfef18037ca742f8326723bd6a3d3260", "76bc09ccf1eeb9ce480d84d522ed3680", "f771348c9ba8d828edf67495cbc17bc9", "e2c1976a13b3ead0d82d7fcd86f20309", "8be3165c05b858d8b5b042640e9f8c83", "a0cfaa5b41ebade4212c74ea09fd08c6", "a87d8cba82836bc5475a502190803796", "ee9acc9411518a5eff76da9e02fce51d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1010h1_61a7ad8aa9b6_9984e387be52", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1010h1", "b": "61a7ad8aa9b6", "c": "9984e387be52", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-13-11-45-10-0-5-16-43-51,29-23-24-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791225824, "last_seen": 1791225824, "transport": "t", "ja3_hash": "2524819cf211e9a85e6a26852bc440b4", "ja3_variant_count": 1, "ja3_variants": [ "2524819cf211e9a85e6a26852bc440b4" ], "user_agents": { "Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1011h2_61a7ad8aa9b6_3d90412d0a0b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "3d90412d0a0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-10-45-23-51-16-0-11-35-43-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 26, "first_seen": 1789041383, "last_seen": 1790880826, "transport": "t", "ja3_hash": "180a1a762216aa8b963f06a9c6b98e49", "ja3_variant_count": 26, "ja3_variants": [ "180a1a762216aa8b963f06a9c6b98e49", "87f3e807eb8e58c206ca7242325c12a7", "c2ccafc0dcbb27ba36455207b6f9973d", "f78bbfe402d2ccde266837abd0c42cba", "3d995ac73330e46539db0c93d3d51dbf", "c8e25d748bd55607b86096b9ac915764", "2399700715bbb5d3783ba29daf762d99", "f84dcce384b13c65b11611c113eb38a8", "8d31ac9caab20f71771102a4a4c609b9", "a2ab2fad49b97092a0631fbfca840a0c", "f47f638109c2d9544edf6906f7fffe4b", "b1a601feab6037d4fddeca6ffebef073" ], "user_agents": { "tphotobot/0.1 (+https://crawler.estidraft.com/bot)": 26, "tphotobot/0.1 (+https://CHANGE-ME.example/tphotobot)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1012h1_61a7ad8aa9b6_5461484b2bee", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1012h1", "b": "61a7ad8aa9b6", "c": "5461484b2bee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-45-0-43-51-13-35-10-11-16-27-23,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 108, "first_seen": 1790500801, "last_seen": 1791112104, "transport": "t", "ja3_hash": "57466c83b95e6d7663b437f8cfd35987", "ja3_variant_count": 108, "ja3_variants": [ "57466c83b95e6d7663b437f8cfd35987", "88dbf2df3afaba1b5970dd5b07816b14", "4db4ecc3256187ecb656b9d645fee780", "6e0dc67ab4c65f514f3a85725a9e5dcc", "8c2f2e2981e1b7d498a0493cbb9218ae", "e78f6c17a4385d48ce5022c4de5b12ca", "cfd57bd71c79e0af96ec6f33c033df9e", "79c49b05260ac56f5f5cb052d1e749ab", "6414b4fdfdc6f51ce4e8c44872f600ff", "57131b60479a34a7a5f84d6c50182a6a", "bb97ee98f90bc04f949447e163a1012f", "1e61ad18048b2eed4b41467009408321" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1012h1_61a7ad8aa9b6_8f8fab9fb325", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1012h1", "b": "61a7ad8aa9b6", "c": "8f8fab9fb325", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-45-23-13-11-0-27-51-10-16-43-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791050641, "last_seen": 1791050641, "transport": "t", "ja3_hash": "647896ac1504f2a81c10c020d77fadf2", "ja3_variant_count": 1, "ja3_variants": [ "647896ac1504f2a81c10c020d77fadf2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d111300_c5d436628c5c_d0a5066ca47b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d111300", "b": "c5d436628c5c", "c": "d0a5066ca47b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788897539, "last_seen": 1788897539, "transport": "t", "ja3_hash": "64c862715cd74388f17dbc77b5249d86", "ja3_variant_count": 1, "ja3_variants": [ "64c862715cd74388f17dbc77b5249d86" ], "user_agents": { "Observer/1.0 (+https://obsrvr.net/about; crawler@obsrvr.net)": 2 }, "ua_disagreement": false } }, { "hash": "t13d1115h2_c5d436628c5c_9d2f91cd20f0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1115h2", "b": "c5d436628c5c", "c": "9d2f91cd20f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191,65281-0-11-10-35-5-16-22-23-13-43-45-51-27-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 52, "first_seen": 1789401822, "last_seen": 1791223585, "transport": "t", "ja3_hash": "c4ae0642545df6d0ee7359453e2471c7", "ja3_variant_count": 1, "ja3_variants": [ "c4ae0642545df6d0ee7359453e2471c7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 2385 }, "ua_disagreement": false } }, { "hash": "t13d121100_2fc95311a792_408777b7afc8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d121100", "b": "2fc95311a792", "c": "408777b7afc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-49171-49172-47-53-10-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788788786, "last_seen": 1788788786, "transport": "t", "ja3_hash": "73f713fd529a67370b19e19e3168ac2c", "ja3_variant_count": 1, "ja3_variants": [ "73f713fd529a67370b19e19e3168ac2c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1213ht_a538d02d76d5_768ed6726269", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1213ht", "b": "a538d02d76d5", "c": "768ed6726269", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49195-49200-49199-49188-49187-49192-49191-255,0-11-10-35-5-16-22-23-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2388, "first_seen": 1787940494, "last_seen": 1791184848, "transport": "t", "ja3_hash": "6b085700712ac68dd995a3f0b513f185", "ja3_variant_count": 1, "ja3_variants": [ "6b085700712ac68dd995a3f0b513f185" ], "user_agents": { "Mozilla/5.0": 2, "Mozilla/5.0 (compatible; DataForSeoBot/1.0; +https://dataforseo.com/dataforseo-bot)": 2368, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 675 }, "ua_disagreement": false } }, { "hash": "t13d130600_f6a34bea2645_910bb7675965", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d130600", "b": "f6a34bea2645", "c": "910bb7675965", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4869-4868-4865-4866-4867-49332-49333-199-198-49330-49328-49331-49329,10-0-43-11-13-51,23-24-25-29-256-41,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49332, "name": "49332 (0xc0b4)", "known": false }, { "value": 49333, "name": "49333 (0xc0b5)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020293, "last_seen": 1791020293, "transport": "t", "ja3_hash": "50b61122e6287de96b9f33c76419b4ff", "ja3_variant_count": 1, "ja3_variants": [ "50b61122e6287de96b9f33c76419b4ff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d130900_be732f438736_53d4e768415e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d130900", "b": "be732f438736", "c": "53d4e768415e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49200-49195-49199-157-156-49172-49171-53-47-255,0-11-10-23-13-43-45-51-21,23-24-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789727176, "last_seen": 1789727176, "transport": "t", "ja3_hash": "e754f4d9b0b5aca3cc6e4818f88cfa39", "ja3_variant_count": 1, "ja3_variants": [ "e754f4d9b0b5aca3cc6e4818f88cfa39" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1311h2_a44d0ee8b3cc_480c14b18160", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1311h2", "b": "a44d0ee8b3cc", "c": "480c14b18160", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49196-49199-49200-49171-156-157-47-53-10,0-23-65281-10-11-35-16-13-51-45-43,4588-29-23-24-25-65074-25497,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 65074, "name": "65074 (0xfe32)", "known": false }, { "value": 25497, "name": "X25519Kyber768Draft00", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788334617, "last_seen": 1788603215, "transport": "t", "ja3_hash": "9487cf6d722f282c94e174ea24ffe7c0", "ja3_variant_count": 1, "ja3_variants": [ "9487cf6d722f282c94e174ea24ffe7c0" ], "user_agents": { "siteradar/0.1 contact: ops@example.com": 2 }, "ua_disagreement": false } }, { "hash": "t13d1312h2_f57a46bbacb6_a986e7d46cbf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1312h2", "b": "f57a46bbacb6", "c": "a986e7d46cbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,4588-29,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790930331, "last_seen": 1790930331, "transport": "t", "ja3_hash": "aca899d3e38a370e31d1592db0824d98", "ja3_variant_count": 1, "ja3_variants": [ "aca899d3e38a370e31d1592db0824d98" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1314h2_f57a46bbacb6_80a565061df8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1314h2", "b": "f57a46bbacb6", "c": "80a565061df8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-16-43-51-45,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791123184, "last_seen": 1791123184, "transport": "t", "ja3_hash": "5e5bffde665bbbb5c4f56219e3566e3c", "ja3_variant_count": 1, "ja3_variants": [ "5e5bffde665bbbb5c4f56219e3566e3c" ], "user_agents": { "authorized-exposure-audit/6": 1 }, "ua_disagreement": false } }, { "hash": "t13d1410h2_f98f5dc5c741_ee7d08cce510", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1410h2", "b": "f98f5dc5c741", "c": "ee7d08cce510", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 14, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-49171-49172-156-157-47-53-255,0-11-10-35-16-23-13-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789581457, "last_seen": 1789633811, "transport": "t", "ja3_hash": "f1e6885be7c9fe76beed9bc9f54f24f7", "ja3_variant_count": 1, "ja3_variants": [ "f1e6885be7c9fe76beed9bc9f54f24f7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150400_8daaf6152771_3bd6c5ce4416", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150400", "b": "8daaf6152771", "c": "3bd6c5ce4416", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790708631, "last_seen": 1790708631, "transport": "t", "ja3_hash": "0db548af4a1c701b31b0805563b9c2dc", "ja3_variant_count": 1, "ja3_variants": [ "0db548af4a1c701b31b0805563b9c2dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150400_8daaf6152771_4c3dd6207bcf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150400", "b": "8daaf6152771", "c": "4c3dd6207bcf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790230730, "last_seen": 1790230730, "transport": "t", "ja3_hash": "746282f1295945eaa0b65035ab4102dc", "ja3_variant_count": 1, "ja3_variants": [ "746282f1295945eaa0b65035ab4102dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_1bb5de40f69a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "1bb5de40f69a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789882717, "last_seen": 1789882717, "transport": "t", "ja3_hash": "e60fcce209a1d73bd98e5b7477ac311f", "ja3_variant_count": 1, "ja3_variants": [ "e60fcce209a1d73bd98e5b7477ac311f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_391ba1f0e679", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "391ba1f0e679", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-51764-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788499345, "last_seen": 1788499345, "transport": "t", "ja3_hash": "ff148da51a3b03b36797e11f3eee07a2", "ja3_variant_count": 1, "ja3_variants": [ "ff148da51a3b03b36797e11f3eee07a2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_5e21bc867bec", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "5e21bc867bec", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788838534, "last_seen": 1788838534, "transport": "t", "ja3_hash": "d0c2f304e4dfa5aea24dcbfced638da8", "ja3_variant_count": 1, "ja3_variants": [ "d0c2f304e4dfa5aea24dcbfced638da8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_6057223aca2e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "6057223aca2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-43-45-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197013, "last_seen": 1790197013, "transport": "t", "ja3_hash": "4d948770f6987df4e6f2784bd195e2df", "ja3_variant_count": 1, "ja3_variants": [ "4d948770f6987df4e6f2784bd195e2df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_a5981f5ff601", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "a5981f5ff601", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-43-18-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790192505, "last_seen": 1790192505, "transport": "t", "ja3_hash": "a2db6fc391da159031ba292499141218", "ja3_variant_count": 1, "ja3_variants": [ "a2db6fc391da159031ba292499141218" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_aa7ad8ad0bef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "aa7ad8ad0bef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-0-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791247249, "last_seen": 1791247249, "transport": "t", "ja3_hash": "aa977f1685f8b6eceaf7f5b484c79b6b", "ja3_variant_count": 1, "ja3_variants": [ "aa977f1685f8b6eceaf7f5b484c79b6b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150500_8daaf6152771_ffa773eb06e4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150500", "b": "8daaf6152771", "c": "ffa773eb06e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-17613-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790402641, "last_seen": 1790402641, "transport": "t", "ja3_hash": "cc23eab4657db8f61751a1d982288f65", "ja3_variant_count": 1, "ja3_variants": [ "cc23eab4657db8f61751a1d982288f65" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1505h2_8daaf6152771_7cf1c60686f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1505h2", "b": "8daaf6152771", "c": "7cf1c60686f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790729876, "last_seen": 1790729876, "transport": "t", "ja3_hash": "f1c2a882ac40e82f90e209ee4933239b", "ja3_variant_count": 1, "ja3_variants": [ "f1c2a882ac40e82f90e209ee4933239b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_411f8ac64ede", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "411f8ac64ede", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-18-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790955769, "last_seen": 1790955769, "transport": "t", "ja3_hash": "f2cb4572fe7d53bb59e6c981fbe07db6", "ja3_variant_count": 1, "ja3_variants": [ "f2cb4572fe7d53bb59e6c981fbe07db6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_58b6c6ce6ae2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "58b6c6ce6ae2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-51-0-45-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788678115, "last_seen": 1788678115, "transport": "t", "ja3_hash": "c1018277019fefdc080d998d0e43caa0", "ja3_variant_count": 1, "ja3_variants": [ "c1018277019fefdc080d998d0e43caa0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_688629f82b44", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "688629f82b44", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-43-51-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789463335, "last_seen": 1789463335, "transport": "t", "ja3_hash": "195a6e3073a9456c76ad6861552d4578", "ja3_variant_count": 1, "ja3_variants": [ "195a6e3073a9456c76ad6861552d4578" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_76c7973ea616", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "76c7973ea616", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-0-51-13-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789680985, "last_seen": 1789680985, "transport": "t", "ja3_hash": "e6c1fecdc31e3a94043643c22848b796", "ja3_variant_count": 1, "ja3_variants": [ "e6c1fecdc31e3a94043643c22848b796" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_7fbae1976b3c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "7fbae1976b3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-18-5-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790192509, "last_seen": 1790192509, "transport": "t", "ja3_hash": "ab40feaca397bc16c48ce0381d266c78", "ja3_variant_count": 1, "ja3_variants": [ "ab40feaca397bc16c48ce0381d266c78" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_94a2796ae212", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "94a2796ae212", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-11-43-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790091149, "last_seen": 1790091149, "transport": "t", "ja3_hash": "9a1d291275a14c08a019cf902dcef1df", "ja3_variant_count": 1, "ja3_variants": [ "9a1d291275a14c08a019cf902dcef1df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_d56370aaf737", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "d56370aaf737", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-0-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790533498, "last_seen": 1790533498, "transport": "t", "ja3_hash": "a55f52c83fe4dcf9a0c3967803c46a74", "ja3_variant_count": 1, "ja3_variants": [ "a55f52c83fe4dcf9a0c3967803c46a74" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_d88e2aa8351a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "d88e2aa8351a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-35-51-13-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790219903, "last_seen": 1790219903, "transport": "t", "ja3_hash": "a2f07d481998d539852f76926b28695d", "ja3_variant_count": 1, "ja3_variants": [ "a2f07d481998d539852f76926b28695d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_ddc3546c1667", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "ddc3546c1667", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-23-43-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790400254, "last_seen": 1790400254, "transport": "t", "ja3_hash": "dd73a93fe605077396cdb2c5c8b76c59", "ja3_variant_count": 1, "ja3_variants": [ "dd73a93fe605077396cdb2c5c8b76c59" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150600_8daaf6152771_fc0dbf8bd3da", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150600", "b": "8daaf6152771", "c": "fc0dbf8bd3da", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-43-10-11-27,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790232571, "last_seen": 1790232571, "transport": "t", "ja3_hash": "d2f2fce8ae5bf3414ff88c84002a6f85", "ja3_variant_count": 1, "ja3_variants": [ "d2f2fce8ae5bf3414ff88c84002a6f85" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_7a3cf4f1c66e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "7a3cf4f1c66e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-43-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788891715, "last_seen": 1788891715, "transport": "t", "ja3_hash": "cc528d8f57cec9f565673adc449273f9", "ja3_variant_count": 1, "ja3_variants": [ "cc528d8f57cec9f565673adc449273f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_a9e04bb141e9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "a9e04bb141e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-16-18-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776180, "last_seen": 1789776180, "transport": "t", "ja3_hash": "70a8475aefe753c03ae6228f5f98ec6b", "ja3_variant_count": 1, "ja3_variants": [ "70a8475aefe753c03ae6228f5f98ec6b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1506h2_8daaf6152771_b8c5baf5bfc8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1506h2", "b": "8daaf6152771", "c": "b8c5baf5bfc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-17613-43-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788530079, "last_seen": 1788530079, "transport": "t", "ja3_hash": "cfce3947af030b91332806b5c6783aad", "ja3_variant_count": 1, "ja3_variants": [ "cfce3947af030b91332806b5c6783aad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_268c334f7201", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "268c334f7201", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-43-0-18-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789980353, "last_seen": 1789980353, "transport": "t", "ja3_hash": "b9468c5e16017882752d0a2eb472fc2a", "ja3_variant_count": 1, "ja3_variants": [ "b9468c5e16017882752d0a2eb472fc2a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_36825d3488d7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "36825d3488d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-0-5-13-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790708627, "last_seen": 1790708627, "transport": "t", "ja3_hash": "0f12ff92dfff54d59d215a64e77f2b02", "ja3_variant_count": 1, "ja3_variants": [ "0f12ff92dfff54d59d215a64e77f2b02" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_423a721297e2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "423a721297e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-23-18-0-51-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790166898, "last_seen": 1790166898, "transport": "t", "ja3_hash": "a53752a05ca22ad5424f00c2864c3a85", "ja3_variant_count": 1, "ja3_variants": [ "a53752a05ca22ad5424f00c2864c3a85" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_6c17e5da15d3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "6c17e5da15d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-27-51-43-45-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788774712, "last_seen": 1788774712, "transport": "t", "ja3_hash": "893ef1b131b4f6984aab5e2fab7ed74a", "ja3_variant_count": 1, "ja3_variants": [ "893ef1b131b4f6984aab5e2fab7ed74a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_b0ca107e30de", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "b0ca107e30de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-45-51-5-0-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789366304, "last_seen": 1789366304, "transport": "t", "ja3_hash": "8e3d2c48a40644c3701788a354107b52", "ja3_variant_count": 1, "ja3_variants": [ "8e3d2c48a40644c3701788a354107b52" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_ba26d0319553", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "ba26d0319553", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-27-0-45-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789630816, "last_seen": 1789630816, "transport": "t", "ja3_hash": "3bee5a02755f20c8cc515486a4e2524b", "ja3_variant_count": 1, "ja3_variants": [ "3bee5a02755f20c8cc515486a4e2524b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_c56da6ed1177", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "c56da6ed1177", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-17613-0-43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790478367, "last_seen": 1790478367, "transport": "t", "ja3_hash": "29196369e18e28b7ed3904f85cf654ae", "ja3_variant_count": 1, "ja3_variants": [ "29196369e18e28b7ed3904f85cf654ae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_d392a8dd072a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "d392a8dd072a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-18-45-27-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790675937, "last_seen": 1790675937, "transport": "t", "ja3_hash": "e5c08290abf7cf9e3d16ece10413bcc7", "ja3_variant_count": 1, "ja3_variants": [ "e5c08290abf7cf9e3d16ece10413bcc7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_dc3a3a0b5a7f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "dc3a3a0b5a7f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-0-27-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791312111, "last_seen": 1791312111, "transport": "t", "ja3_hash": "e344777825aa346990a28d9c721ffd72", "ja3_variant_count": 1, "ja3_variants": [ "e344777825aa346990a28d9c721ffd72" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_e05705feb738", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "e05705feb738", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-45-27-51-0-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789566956, "last_seen": 1789566956, "transport": "t", "ja3_hash": "1ada8f5bef1e83492fdc0c69053cccf1", "ja3_variant_count": 1, "ja3_variants": [ "1ada8f5bef1e83492fdc0c69053cccf1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_e5ee23aa29f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "e5ee23aa29f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-0-5-18-43-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791254083, "last_seen": 1791254083, "transport": "t", "ja3_hash": "b81372b86d7d7ed5550c2b11a9e82cb1", "ja3_variant_count": 1, "ja3_variants": [ "b81372b86d7d7ed5550c2b11a9e82cb1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_edb6d158e77e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "edb6d158e77e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51764-5-65037-43-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790095005, "last_seen": 1790095005, "transport": "t", "ja3_hash": "7c50a2856ee2349be9dfbd86d518e554", "ja3_variant_count": 1, "ja3_variants": [ "7c50a2856ee2349be9dfbd86d518e554" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_efc7250c9e21", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "efc7250c9e21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-23-35-0-43-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015032, "last_seen": 1789015032, "transport": "t", "ja3_hash": "02d103a112d90e613d84db4820896260", "ja3_variant_count": 1, "ja3_variants": [ "02d103a112d90e613d84db4820896260" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150700_8daaf6152771_f8af4d62aa55", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "f8af4d62aa55", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-13-0-65281-43-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789476158, "last_seen": 1789476158, "transport": "t", "ja3_hash": "e2904a5b5486b46979294dab6e7dc2d3", "ja3_variant_count": 1, "ja3_variants": [ "e2904a5b5486b46979294dab6e7dc2d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_c3b091230374", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "c3b091230374", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-43-18-13-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789929107, "last_seen": 1789929107, "transport": "t", "ja3_hash": "2889f3d1b903d420885258a843c4ae12", "ja3_variant_count": 1, "ja3_variants": [ "2889f3d1b903d420885258a843c4ae12" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1507h2_8daaf6152771_e1a23b84ec1a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1507h2", "b": "8daaf6152771", "c": "e1a23b84ec1a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-16-23-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791022137, "last_seen": 1791022137, "transport": "t", "ja3_hash": "5aacc65920bd15e13cbefcde92b86566", "ja3_variant_count": 1, "ja3_variants": [ "5aacc65920bd15e13cbefcde92b86566" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_0cfd05a34fd9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "0cfd05a34fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-18-65037-43-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790530633, "last_seen": 1790530633, "transport": "t", "ja3_hash": "75bdee018b3d0f2f3c8eb38a4965e65d", "ja3_variant_count": 1, "ja3_variants": [ "75bdee018b3d0f2f3c8eb38a4965e65d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_13ae44bcdc75", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "13ae44bcdc75", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-0-17613-35-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015034, "last_seen": 1789015034, "transport": "t", "ja3_hash": "ffeed6dfec4411d08f927d3d246f5fe7", "ja3_variant_count": 1, "ja3_variants": [ "ffeed6dfec4411d08f927d3d246f5fe7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_1c2c98c00e3f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "1c2c98c00e3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-45-43-27-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791146876, "last_seen": 1791146876, "transport": "t", "ja3_hash": "b7e048aab076125a36a31d00b7c76859", "ja3_variant_count": 1, "ja3_variants": [ "b7e048aab076125a36a31d00b7c76859" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_1c5713a275e4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "1c5713a275e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51764-43-11-10-0-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790928565, "last_seen": 1790928565, "transport": "t", "ja3_hash": "b88ff08f8a4fb4771df4cfdbea5edd68", "ja3_variant_count": 1, "ja3_variants": [ "b88ff08f8a4fb4771df4cfdbea5edd68" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_1f77f064d4ae", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "1f77f064d4ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-0-17613-10-43-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788459810, "last_seen": 1790931426, "transport": "t", "ja3_hash": "8ddcd59c54566660794b2fec508bef49", "ja3_variant_count": 2, "ja3_variants": [ "8ddcd59c54566660794b2fec508bef49", "f04dded14998de1a8e5862c3d618986a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_57d98d96ec12", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "57d98d96ec12", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-18-43-45-35-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197015, "last_seen": 1790197015, "transport": "t", "ja3_hash": "a77a842d5f928ec72e0a5bf93fc13976", "ja3_variant_count": 1, "ja3_variants": [ "a77a842d5f928ec72e0a5bf93fc13976" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_64fc35769d5a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "64fc35769d5a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-18-43-5-45-27-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730569, "last_seen": 1789730569, "transport": "t", "ja3_hash": "3a8460dc10000dca9ae3eab1d3012db2", "ja3_variant_count": 1, "ja3_variants": [ "3a8460dc10000dca9ae3eab1d3012db2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_6708b298cf60", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "6708b298cf60", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-43-27-35-23-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789680301, "last_seen": 1789680301, "transport": "t", "ja3_hash": "a6014cf179325009c349fc2cb14703f0", "ja3_variant_count": 1, "ja3_variants": [ "a6014cf179325009c349fc2cb14703f0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_78f613382105", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "78f613382105", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-5-0-18-23-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197014, "last_seen": 1790197014, "transport": "t", "ja3_hash": "df42da49d13589e67c1ba8e6a8f8fd36", "ja3_variant_count": 1, "ja3_variants": [ "df42da49d13589e67c1ba8e6a8f8fd36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_7ba901eaf87a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "7ba901eaf87a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-43-0-18-5-17613-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197944, "last_seen": 1790197944, "transport": "t", "ja3_hash": "dfe9e2075e435f92846ce80c8276b323", "ja3_variant_count": 1, "ja3_variants": [ "dfe9e2075e435f92846ce80c8276b323" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_88eda335ef98", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "88eda335ef98", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-27-23-43-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789907730, "last_seen": 1789907730, "transport": "t", "ja3_hash": "aca0a5dad6e335a8f149db0543f3ea20", "ja3_variant_count": 1, "ja3_variants": [ "aca0a5dad6e335a8f149db0543f3ea20" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_8a37b957b889", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "8a37b957b889", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-13-10-43-0-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790249322, "last_seen": 1790249322, "transport": "t", "ja3_hash": "4a3d902e0a0f796e63d3b51ca3024ede", "ja3_variant_count": 1, "ja3_variants": [ "4a3d902e0a0f796e63d3b51ca3024ede" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_9c70dff70ad7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "9c70dff70ad7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-18-23-5-45-17613-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789929107, "last_seen": 1789929107, "transport": "t", "ja3_hash": "849d3413e4875e4c573fe01b2dbaf639", "ja3_variant_count": 1, "ja3_variants": [ "849d3413e4875e4c573fe01b2dbaf639" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_bddb109a14b3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "bddb109a14b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-51-23-65281-0-45-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790197058, "last_seen": 1790197058, "transport": "t", "ja3_hash": "1e5f118e31f88ec37b5466db3e5b1b44", "ja3_variant_count": 1, "ja3_variants": [ "1e5f118e31f88ec37b5466db3e5b1b44" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_c242ac1e87e3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "c242ac1e87e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-11-51-0-10-5-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789543664, "last_seen": 1789543664, "transport": "t", "ja3_hash": "9de629515528bba6be021b318157a6d1", "ja3_variant_count": 1, "ja3_variants": [ "9de629515528bba6be021b318157a6d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_c993c39c97c1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "c993c39c97c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-43-17613-10-18-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790329404, "last_seen": 1790329404, "transport": "t", "ja3_hash": "b289064630ceb1a1b01eea151312dcf3", "ja3_variant_count": 1, "ja3_variants": [ "b289064630ceb1a1b01eea151312dcf3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_ca647619ac85", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "ca647619ac85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51764-23-18-43-65037-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789292865, "last_seen": 1789292865, "transport": "t", "ja3_hash": "7a1cd816199187fb9c313d778f4e751a", "ja3_variant_count": 1, "ja3_variants": [ "7a1cd816199187fb9c313d778f4e751a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_ca8957053193", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "ca8957053193", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-43-13-5-0-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789381654, "last_seen": 1789381654, "transport": "t", "ja3_hash": "c5906447b452c43460413947d04e7ff3", "ja3_variant_count": 1, "ja3_variants": [ "c5906447b452c43460413947d04e7ff3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_da85ae28538d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "da85ae28538d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-43-45-0-51-35-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790865599, "last_seen": 1790865599, "transport": "t", "ja3_hash": "2d33a06a2e99dcf8b6240aedb10b9621", "ja3_variant_count": 1, "ja3_variants": [ "2d33a06a2e99dcf8b6240aedb10b9621" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_fa186366442a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "fa186366442a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-27-17513-65281-0-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791116982, "last_seen": 1791116982, "transport": "t", "ja3_hash": "0ab272d82533ce215b7b374631755e6f", "ja3_variant_count": 1, "ja3_variants": [ "0ab272d82533ce215b7b374631755e6f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150800_8daaf6152771_fa57fbbcd37a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "fa57fbbcd37a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-13-65037-43-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788904020, "last_seen": 1788904020, "transport": "t", "ja3_hash": "33f00025c53884c729e39bda1283440d", "ja3_variant_count": 1, "ja3_variants": [ "33f00025c53884c729e39bda1283440d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_1214eb944469", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "1214eb944469", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-65281-43-10-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790434312, "last_seen": 1790434312, "transport": "t", "ja3_hash": "e3d579eed63c0efc5d20e3711ff4d2b2", "ja3_variant_count": 1, "ja3_variants": [ "e3d579eed63c0efc5d20e3711ff4d2b2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_253f0937bbf1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "253f0937bbf1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-43-27-13-65037-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790166898, "last_seen": 1790166898, "transport": "t", "ja3_hash": "2db23e48682d0375fa9cc6e94c43d2ff", "ja3_variant_count": 1, "ja3_variants": [ "2db23e48682d0375fa9cc6e94c43d2ff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_8d9d045ea997", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "8d9d045ea997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-13-18-0-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197012, "last_seen": 1790197012, "transport": "t", "ja3_hash": "1e627c48620ea6070a533b7f70baf12a", "ja3_variant_count": 1, "ja3_variants": [ "1e627c48620ea6070a533b7f70baf12a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_928dd4ca2c01", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "928dd4ca2c01", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-10-35-51764-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789552173, "last_seen": 1789552173, "transport": "t", "ja3_hash": "6e1eabfdb44b82e464240c68a50b4cd1", "ja3_variant_count": 1, "ja3_variants": [ "6e1eabfdb44b82e464240c68a50b4cd1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_a83686010035", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "a83686010035", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-0-16-45-65037-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788839896, "last_seen": 1788839896, "transport": "t", "ja3_hash": "b1d936460839fc17c4e43ef6e0df3c39", "ja3_variant_count": 1, "ja3_variants": [ "b1d936460839fc17c4e43ef6e0df3c39" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_bfcf4fcc05a2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "bfcf4fcc05a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-17613-43-23-16-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790483306, "last_seen": 1790483306, "transport": "t", "ja3_hash": "31b8834c76ef55725cd5959b019a35d8", "ja3_variant_count": 1, "ja3_variants": [ "31b8834c76ef55725cd5959b019a35d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_c360eb80a271", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "c360eb80a271", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-10-0-27-23-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791229394, "last_seen": 1791229394, "transport": "t", "ja3_hash": "f18d708e353757eafb98d858767119d0", "ja3_variant_count": 1, "ja3_variants": [ "f18d708e353757eafb98d858767119d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_d3f7b721fcff", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "d3f7b721fcff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-51764-17613-43-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730594, "last_seen": 1789730594, "transport": "t", "ja3_hash": "a808455f047d2badc53c9f257f22ebf6", "ja3_variant_count": 1, "ja3_variants": [ "a808455f047d2badc53c9f257f22ebf6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_e148657b8c0f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "e148657b8c0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-65037-16-18-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790520858, "last_seen": 1790520858, "transport": "t", "ja3_hash": "e770a9f6830d326056e0b01ae29f89ae", "ja3_variant_count": 1, "ja3_variants": [ "e770a9f6830d326056e0b01ae29f89ae" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_ee9ac659b15e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "ee9ac659b15e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-10-16-5-0-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788934365, "last_seen": 1788934365, "transport": "t", "ja3_hash": "bac2099d64acdcbbea551e004512908e", "ja3_variant_count": 1, "ja3_variants": [ "bac2099d64acdcbbea551e004512908e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_f1d1ccabec35", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "f1d1ccabec35", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-45-0-13-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788711050, "last_seen": 1788711050, "transport": "t", "ja3_hash": "2c6d3fcb4c1efe555d8176da252b049a", "ja3_variant_count": 1, "ja3_variants": [ "2c6d3fcb4c1efe555d8176da252b049a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_f58d3033c247", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "f58d3033c247", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-43-5-13-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789531346, "last_seen": 1789531346, "transport": "t", "ja3_hash": "47dd8ecca2e83ccc47de1ca2ebab38c6", "ja3_variant_count": 1, "ja3_variants": [ "47dd8ecca2e83ccc47de1ca2ebab38c6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_f7b5054de528", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "f7b5054de528", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-16-0-13-35-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790286984, "last_seen": 1790286984, "transport": "t", "ja3_hash": "2a46c72b30a91a8900a2b4db731a1987", "ja3_variant_count": 1, "ja3_variants": [ "2a46c72b30a91a8900a2b4db731a1987" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1508h2_8daaf6152771_f9dc5ead649b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "f9dc5ead649b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-43-17613-65281-0-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789358507, "last_seen": 1789358507, "transport": "t", "ja3_hash": "03d5a6ac624c45ffb5750a4248259292", "ja3_variant_count": 1, "ja3_variants": [ "03d5a6ac624c45ffb5750a4248259292" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_04e1e7841ed8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "04e1e7841ed8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-35-0-65281-45-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791247233, "last_seen": 1791247233, "transport": "t", "ja3_hash": "b6ce906a59b09d6e55c743e40d18d49c", "ja3_variant_count": 1, "ja3_variants": [ "b6ce906a59b09d6e55c743e40d18d49c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_09a211d467cd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "09a211d467cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-35-0-43-18-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790625443, "last_seen": 1790625443, "transport": "t", "ja3_hash": "1c429e81ab7d3844c7e88d830c3e0feb", "ja3_variant_count": 1, "ja3_variants": [ "1c429e81ab7d3844c7e88d830c3e0feb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_0a99ec2bb17c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "0a99ec2bb17c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-18-23-43-13-65037-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789583993, "last_seen": 1789583993, "transport": "t", "ja3_hash": "3c149b64ccd00e169ef15490699f70dc", "ja3_variant_count": 1, "ja3_variants": [ "3c149b64ccd00e169ef15490699f70dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_1a8725738396", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "1a8725738396", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-13-5-0-65037-45-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791251438, "last_seen": 1791251438, "transport": "t", "ja3_hash": "b58a25dceb14dec23da9b07f73ccfc17", "ja3_variant_count": 1, "ja3_variants": [ "b58a25dceb14dec23da9b07f73ccfc17" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_49bf9091f779", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "49bf9091f779", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-35-51-0-18-51764-23-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789989583, "last_seen": 1789989583, "transport": "t", "ja3_hash": "7d0ef7b48cb7d05b40ca6cd9ce3ae585", "ja3_variant_count": 1, "ja3_variants": [ "7d0ef7b48cb7d05b40ca6cd9ce3ae585" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_6cee435b32e2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "6cee435b32e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-11-35-13-23-43-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788836929, "last_seen": 1788836929, "transport": "t", "ja3_hash": "674f2efa77f02f7dad47dacd724e8bba", "ja3_variant_count": 1, "ja3_variants": [ "674f2efa77f02f7dad47dacd724e8bba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_781902cdd3f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "781902cdd3f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-13-43-35-5-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789050369, "last_seen": 1789050369, "transport": "t", "ja3_hash": "2f1219e2d72493a979ae6c8e246bdddd", "ja3_variant_count": 1, "ja3_variants": [ "2f1219e2d72493a979ae6c8e246bdddd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_7ef11ff0d4eb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "7ef11ff0d4eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-51-17613-23-5-65281-0-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789430687, "last_seen": 1789430687, "transport": "t", "ja3_hash": "6a8713b70d9cbeab19045f829ed7f56a", "ja3_variant_count": 1, "ja3_variants": [ "6a8713b70d9cbeab19045f829ed7f56a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_85a223e0ede9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "85a223e0ede9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-10-65037-45-23-0-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790605457, "last_seen": 1790605457, "transport": "t", "ja3_hash": "f5ccc4258167ef3cce2c268689af5bd3", "ja3_variant_count": 1, "ja3_variants": [ "f5ccc4258167ef3cce2c268689af5bd3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_8ef2b19d7288", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "8ef2b19d7288", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-11-17513-51-65037-35-43-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790957190, "last_seen": 1790957190, "transport": "t", "ja3_hash": "e003c15256d53a28c47e91b5a813b526", "ja3_variant_count": 1, "ja3_variants": [ "e003c15256d53a28c47e91b5a813b526" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_910c8546aa24", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "910c8546aa24", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-51764-17613-43-27-0-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790079923, "last_seen": 1790079923, "transport": "t", "ja3_hash": "f0b59c5b1eaf353592421841892966a2", "ja3_variant_count": 1, "ja3_variants": [ "f0b59c5b1eaf353592421841892966a2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_a0132305141e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "a0132305141e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-51764-10-0-5-43-13-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788950148, "last_seen": 1788950148, "transport": "t", "ja3_hash": "67882d33b9b1d5952547e9add6df1d6d", "ja3_variant_count": 1, "ja3_variants": [ "67882d33b9b1d5952547e9add6df1d6d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_acbea7050229", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "acbea7050229", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-65281-43-65037-13-23-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790004402, "last_seen": 1790004402, "transport": "t", "ja3_hash": "4a56afeeed67877083bccfddd20adad0", "ja3_variant_count": 1, "ja3_variants": [ "4a56afeeed67877083bccfddd20adad0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_b2ae65a2d86d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "b2ae65a2d86d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-43-65037-17613-27-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788892609, "last_seen": 1788892609, "transport": "t", "ja3_hash": "cbd1477981c67bbfff3e5cc4fc71530e", "ja3_variant_count": 1, "ja3_variants": [ "cbd1477981c67bbfff3e5cc4fc71530e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_ba18e643a479", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "ba18e643a479", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-5-0-11-43-17613-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790623645, "last_seen": 1790623645, "transport": "t", "ja3_hash": "2edb074cd31ad9326f7d3849f5dc13cb", "ja3_variant_count": 1, "ja3_variants": [ "2edb074cd31ad9326f7d3849f5dc13cb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_d61c0358000e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "d61c0358000e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-45-0-35-43-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790594780, "last_seen": 1790594780, "transport": "t", "ja3_hash": "d433c7f4d38472c11675174723159290", "ja3_variant_count": 1, "ja3_variants": [ "d433c7f4d38472c11675174723159290" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_df6ead1e8e09", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "df6ead1e8e09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-11-45-65037-18-0-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790245006, "last_seen": 1790245006, "transport": "t", "ja3_hash": "9cb15ecafc4153971d6fd8e0c358241c", "ja3_variant_count": 1, "ja3_variants": [ "9cb15ecafc4153971d6fd8e0c358241c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_e57ce5eab10f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "e57ce5eab10f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-23-5-13-43-11-17613-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791192307, "last_seen": 1791192307, "transport": "t", "ja3_hash": "899fc2b47b0b942ee09f65540d8b6e10", "ja3_variant_count": 1, "ja3_variants": [ "899fc2b47b0b942ee09f65540d8b6e10" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_e95d50394e65", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "e95d50394e65", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-17613-23-51-0-18-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790234295, "last_seen": 1790234295, "transport": "t", "ja3_hash": "6dd67ba7185a16806798e40c4e25a624", "ja3_variant_count": 1, "ja3_variants": [ "6dd67ba7185a16806798e40c4e25a624" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_e981e889a607", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "e981e889a607", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-11-65037-27-13-5-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790609734, "last_seen": 1790609734, "transport": "t", "ja3_hash": "06b7e79a0a6f1c85394a07b33508a700", "ja3_variant_count": 1, "ja3_variants": [ "06b7e79a0a6f1c85394a07b33508a700" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_ea24298fc73d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "ea24298fc73d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-0-11-27-18-23-51-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790273616, "last_seen": 1790273616, "transport": "t", "ja3_hash": "73f9b84c689291c950efe8bb6ec947a3", "ja3_variant_count": 1, "ja3_variants": [ "73f9b84c689291c950efe8bb6ec947a3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d150900_8daaf6152771_fbb4afc97a63", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "fbb4afc97a63", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-10-35-0-11-23-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790931496, "last_seen": 1790931496, "transport": "t", "ja3_hash": "33a52b4548e12a9a9842f3e0fe4c396c", "ja3_variant_count": 1, "ja3_variants": [ "33a52b4548e12a9a9842f3e0fe4c396c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_179fc0541afe", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "179fc0541afe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-17613-0-11-43-27-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791006026, "last_seen": 1791006026, "transport": "t", "ja3_hash": "47e34d8578c124b912ea23f768a49e50", "ja3_variant_count": 1, "ja3_variants": [ "47e34d8578c124b912ea23f768a49e50" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_33d2d331751f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "33d2d331751f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-5-11-43-18-16-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790955768, "last_seen": 1790955768, "transport": "t", "ja3_hash": "29dca6e9b937c0ef0b3c8589ffd13575", "ja3_variant_count": 1, "ja3_variants": [ "29dca6e9b937c0ef0b3c8589ffd13575" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_3eab5a009a3e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "3eab5a009a3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-11-65037-45-13-0-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791046329, "last_seen": 1791046329, "transport": "t", "ja3_hash": "91f65394640a5bc61bf270c2ba2dfc65", "ja3_variant_count": 1, "ja3_variants": [ "91f65394640a5bc61bf270c2ba2dfc65" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_43de51e3bc02", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "43de51e3bc02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-23-10-27-43-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790267394, "last_seen": 1790267394, "transport": "t", "ja3_hash": "9c7cf76b7d4d39da0212d883b25d3fcd", "ja3_variant_count": 1, "ja3_variants": [ "9c7cf76b7d4d39da0212d883b25d3fcd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_49dd8ddb6c6e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "49dd8ddb6c6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-17613-51764-13-16-5-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789469867, "last_seen": 1789469867, "transport": "t", "ja3_hash": "c7e7f006d4cb36c47d982cad22c8aca5", "ja3_variant_count": 1, "ja3_variants": [ "c7e7f006d4cb36c47d982cad22c8aca5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_4fb15f2b8b0b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "4fb15f2b8b0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-13-10-35-0-16-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790864599, "last_seen": 1790864599, "transport": "t", "ja3_hash": "1a65a6dbcccf3611f8e5ef71b1fc007e", "ja3_variant_count": 1, "ja3_variants": [ "1a65a6dbcccf3611f8e5ef71b1fc007e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_5f115f407b3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "5f115f407b3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-11-0-27-16-35-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027383, "last_seen": 1789027383, "transport": "t", "ja3_hash": "01012904d6d56767adef338a705f1ad0", "ja3_variant_count": 1, "ja3_variants": [ "01012904d6d56767adef338a705f1ad0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_651cdd5e940d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "651cdd5e940d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-17513-16-65037-0-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791102881, "last_seen": 1791102881, "transport": "t", "ja3_hash": "eaa9a739d2fbacd6003d33c8625f9610", "ja3_variant_count": 1, "ja3_variants": [ "eaa9a739d2fbacd6003d33c8625f9610" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_714d12727d48", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "714d12727d48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-65281-35-43-23-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791022065, "last_seen": 1791022065, "transport": "t", "ja3_hash": "ed55fb935c12c51b41cfd40c9382291c", "ja3_variant_count": 1, "ja3_variants": [ "ed55fb935c12c51b41cfd40c9382291c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_a2ba6fba1165", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "a2ba6fba1165", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-43-5-17613-10-27-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790715329, "last_seen": 1790715329, "transport": "t", "ja3_hash": "5f2fd0a10dea993efbd01901e679e446", "ja3_variant_count": 1, "ja3_variants": [ "5f2fd0a10dea993efbd01901e679e446" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_a473abd0a37b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "a473abd0a37b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-0-18-43-10-16-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791213907, "last_seen": 1791213907, "transport": "t", "ja3_hash": "49081a16c6fced3c7362c0b0f05ddaee", "ja3_variant_count": 1, "ja3_variants": [ "49081a16c6fced3c7362c0b0f05ddaee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_c2c99b7a7d0b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "c2c99b7a7d0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-45-17613-16-23-0-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790218769, "last_seen": 1790218769, "transport": "t", "ja3_hash": "371f65c07b7be7cae4f42198504a265e", "ja3_variant_count": 1, "ja3_variants": [ "371f65c07b7be7cae4f42198504a265e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_d3bea339f1d8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "d3bea339f1d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-17613-23-65281-16-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789865331, "last_seen": 1789865331, "transport": "t", "ja3_hash": "a006318e05dc01b24105913572664ad9", "ja3_variant_count": 1, "ja3_variants": [ "a006318e05dc01b24105913572664ad9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_db58677ef8ca", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "db58677ef8ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-43-65281-16-0-23-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789456847, "last_seen": 1789456847, "transport": "t", "ja3_hash": "59dafca99a02f08c7af010d80b673462", "ja3_variant_count": 1, "ja3_variants": [ "59dafca99a02f08c7af010d80b673462" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_dd085a1aca66", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "dd085a1aca66", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-51764-5-16-65281-0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791121986, "last_seen": 1791121986, "transport": "t", "ja3_hash": "812c96ed0a9b39381288b243959ccbe7", "ja3_variant_count": 1, "ja3_variants": [ "812c96ed0a9b39381288b243959ccbe7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1509h2_8daaf6152771_eda74fd8242d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "eda74fd8242d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-43-65281-27-11-23-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790936724, "last_seen": 1790936724, "transport": "t", "ja3_hash": "09b471ab4b9d342921c56141e6fa3e10", "ja3_variant_count": 1, "ja3_variants": [ "09b471ab4b9d342921c56141e6fa3e10" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_10ea8800c16b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "10ea8800c16b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-43-18-11-23-65281-17613-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790927428, "last_seen": 1790927428, "transport": "t", "ja3_hash": "1d1a97c60658ad22dc5719d18986c781", "ja3_variant_count": 1, "ja3_variants": [ "1d1a97c60658ad22dc5719d18986c781" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_13c6fdb1fde0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "13c6fdb1fde0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-43-10-0-35-18-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790160091, "last_seen": 1790160091, "transport": "t", "ja3_hash": "964c53743fda048d91364fe4321dce07", "ja3_variant_count": 1, "ja3_variants": [ "964c53743fda048d91364fe4321dce07" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_1a0c9462b5c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "1a0c9462b5c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-0-18-35-51764-13-5-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789913176, "last_seen": 1789913176, "transport": "t", "ja3_hash": "2b082689dfe80e8e8d90e7d85e83d324", "ja3_variant_count": 1, "ja3_variants": [ "2b082689dfe80e8e8d90e7d85e83d324" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_1ebaf19f5e05", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "1ebaf19f5e05", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-43-11-0-17613-5-18-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791253685, "last_seen": 1791253685, "transport": "t", "ja3_hash": "cc3f685a478ed2c3614e45b4fdffdcc1", "ja3_variant_count": 1, "ja3_variants": [ "cc3f685a478ed2c3614e45b4fdffdcc1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_2ae3386779b7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "2ae3386779b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-0-51764-5-13-45-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730570, "last_seen": 1789730570, "transport": "t", "ja3_hash": "1bb84dc433c77169e6a5ddc664a1b7ca", "ja3_variant_count": 1, "ja3_variants": [ "1bb84dc433c77169e6a5ddc664a1b7ca" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_435ed3c6afa3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "435ed3c6afa3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-18-23-45-65281-0-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789931631, "last_seen": 1789931631, "transport": "t", "ja3_hash": "635a09076052a1b7c23d5aea2952fe80", "ja3_variant_count": 1, "ja3_variants": [ "635a09076052a1b7c23d5aea2952fe80" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_448343c25ae9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "448343c25ae9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-23-11-17613-10-0-5-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791192307, "last_seen": 1791192307, "transport": "t", "ja3_hash": "6b7a4fc938b61a788b9b667a9f033996", "ja3_variant_count": 1, "ja3_variants": [ "6b7a4fc938b61a788b9b667a9f033996" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_59fb22968731", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "59fb22968731", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-43-51-13-65281-45-0-35-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1788518816, "last_seen": 1788518818, "transport": "t", "ja3_hash": "79fd3ef8f20c4eb0a929d7b74d3592b9", "ja3_variant_count": 4, "ja3_variants": [ "79fd3ef8f20c4eb0a929d7b74d3592b9", "8d34efc93b12554fa97d700fb471c0fa", "a31853a69288a2e0789a958ac88d0b35", "44aec5bf4c326a7c81ac103f11e320ff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_76104fdb3d87", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "76104fdb3d87", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-43-51764-65281-45-18-35-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791225970, "last_seen": 1791225970, "transport": "t", "ja3_hash": "b8e2fa294df7b644de9dddc244335a21", "ja3_variant_count": 1, "ja3_variants": [ "b8e2fa294df7b644de9dddc244335a21" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_800dd2937db2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "800dd2937db2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-18-65281-10-13-17613-43-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789438946, "last_seen": 1789438946, "transport": "t", "ja3_hash": "a427eacb3f1c98661e8ab835588d3aee", "ja3_variant_count": 1, "ja3_variants": [ "a427eacb3f1c98661e8ab835588d3aee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_805a45483b10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "805a45483b10", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-17613-23-27-65281-5-65037-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790777247, "last_seen": 1790777247, "transport": "t", "ja3_hash": "3458d4a91cc02c1b493bb0bb497a158f", "ja3_variant_count": 1, "ja3_variants": [ "3458d4a91cc02c1b493bb0bb497a158f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_82bd1a16550e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "82bd1a16550e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-0-10-35-13-65281-43-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790207557, "last_seen": 1790207557, "transport": "t", "ja3_hash": "da464e32dd5f83e03d52e5918a230023", "ja3_variant_count": 1, "ja3_variants": [ "da464e32dd5f83e03d52e5918a230023" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_8641d88eff01", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "8641d88eff01", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-45-0-35-13-17613-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791240700, "last_seen": 1791240700, "transport": "t", "ja3_hash": "b8fa57ab1767c00509cb94ee8d51bf5f", "ja3_variant_count": 1, "ja3_variants": [ "b8fa57ab1767c00509cb94ee8d51bf5f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_91942a7273fb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "91942a7273fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-5-65281-35-18-13-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790747903, "last_seen": 1790747903, "transport": "t", "ja3_hash": "de50c426a48c127d60a7ad8e45ad8c08", "ja3_variant_count": 1, "ja3_variants": [ "de50c426a48c127d60a7ad8e45ad8c08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_986373b11f57", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "986373b11f57", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-65281-13-0-51764-35-10-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789034177, "last_seen": 1789034177, "transport": "t", "ja3_hash": "1078db92cfba9e1d5d97db2979678cdf", "ja3_variant_count": 1, "ja3_variants": [ "1078db92cfba9e1d5d97db2979678cdf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_aaa9936b53d7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "aaa9936b53d7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-23-18-10-13-43-0-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790327593, "last_seen": 1790327593, "transport": "t", "ja3_hash": "8cddb76db3127ba335f7737c50ded3d1", "ja3_variant_count": 1, "ja3_variants": [ "8cddb76db3127ba335f7737c50ded3d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_ac37cb4332d0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "ac37cb4332d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-43-5-65281-0-23-17613-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788461773, "last_seen": 1788461773, "transport": "t", "ja3_hash": "3bcf512b8b160d6f34e6fe82525c180e", "ja3_variant_count": 1, "ja3_variants": [ "3bcf512b8b160d6f34e6fe82525c180e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_cda23304f498", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "cda23304f498", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-0-11-35-45-43-23-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791312063, "last_seen": 1791312063, "transport": "t", "ja3_hash": "154fcbf75c10f86133d1122574bfbfe8", "ja3_variant_count": 1, "ja3_variants": [ "154fcbf75c10f86133d1122574bfbfe8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_d99eca616f54", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "d99eca616f54", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-5-65281-0-11-10-43-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788912384, "last_seen": 1788912384, "transport": "t", "ja3_hash": "c28f5a39cd25d32094bdbd588adbf390", "ja3_variant_count": 1, "ja3_variants": [ "c28f5a39cd25d32094bdbd588adbf390" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_f1660c9ae6b1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "f1660c9ae6b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-65281-43-45-65037-11-5-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791250813, "last_seen": 1791250813, "transport": "t", "ja3_hash": "4caaad4765df590e66b2fbd3719a801c", "ja3_variant_count": 1, "ja3_variants": [ "4caaad4765df590e66b2fbd3719a801c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_f44a4d8a25c9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "f44a4d8a25c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-45-51764-43-27-65281-5-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790457835, "last_seen": 1790457835, "transport": "t", "ja3_hash": "7757d8016e2a9f2366977868a441e1de", "ja3_variant_count": 1, "ja3_variants": [ "7757d8016e2a9f2366977868a441e1de" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151000_8daaf6152771_fd80867c616c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "fd80867c616c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-27-35-0-13-43-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790273615, "last_seen": 1790273615, "transport": "t", "ja3_hash": "aa72dc18905f237f3f16bb7cd147326c", "ja3_variant_count": 1, "ja3_variants": [ "aa72dc18905f237f3f16bb7cd147326c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_0552c71aaefa", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "0552c71aaefa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-65281-11-27-43-0-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790240650, "last_seen": 1790240650, "transport": "t", "ja3_hash": "7e0919a07a6309b05fd4848aeb271567", "ja3_variant_count": 1, "ja3_variants": [ "7e0919a07a6309b05fd4848aeb271567" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_05af334b7620", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "05af334b7620", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-65281-51764-16-11-13-18-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790224567, "last_seen": 1790224567, "transport": "t", "ja3_hash": "79d7ac968040a433c0cd1d86b3eac16f", "ja3_variant_count": 1, "ja3_variants": [ "79d7ac968040a433c0cd1d86b3eac16f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_2882a6a13f08", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "2882a6a13f08", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-16-0-17613-23-65037-45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790998775, "last_seen": 1790998775, "transport": "t", "ja3_hash": "4baad88d7cb16b15cf656599c426e245", "ja3_variant_count": 1, "ja3_variants": [ "4baad88d7cb16b15cf656599c426e245" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_3ddf928fca99", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3ddf928fca99", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-0-16-65037-45-5-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788948619, "last_seen": 1788948619, "transport": "t", "ja3_hash": "b2f89e652493d082541e6324650b65ea", "ja3_variant_count": 1, "ja3_variants": [ "b2f89e652493d082541e6324650b65ea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_714032178be2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "714032178be2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-45-23-10-43-65037-0-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790688142, "last_seen": 1790688142, "transport": "t", "ja3_hash": "e1b1d218933885b0a058b29ef14cba8a", "ja3_variant_count": 1, "ja3_variants": [ "e1b1d218933885b0a058b29ef14cba8a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_8834a1f9d2eb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "8834a1f9d2eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-18-16-5-10-45-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791247095, "last_seen": 1791247095, "transport": "t", "ja3_hash": "957305516be949c9468ec6d073a06415", "ja3_variant_count": 1, "ja3_variants": [ "957305516be949c9468ec6d073a06415" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_aa17011fb22d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "aa17011fb22d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-16-65281-18-11-45-35-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790640711, "last_seen": 1790640711, "transport": "t", "ja3_hash": "ac8c8619ff98aaf25a39a27298d821fb", "ja3_variant_count": 1, "ja3_variants": [ "ac8c8619ff98aaf25a39a27298d821fb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_ba29d6c99247", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "ba29d6c99247", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-10-65281-11-13-16-65037-27-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106710, "last_seen": 1791106710, "transport": "t", "ja3_hash": "e487a05bc63d422b7a51f213210bb746", "ja3_variant_count": 1, "ja3_variants": [ "e487a05bc63d422b7a51f213210bb746" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_cc40c3ad3c84", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "cc40c3ad3c84", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-17613-43-11-16-23-35-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791089161, "last_seen": 1791089161, "transport": "t", "ja3_hash": "d71933e9f20db62cfb2fcc25f595dfc7", "ja3_variant_count": 1, "ja3_variants": [ "d71933e9f20db62cfb2fcc25f595dfc7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_d248ad41802c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "d248ad41802c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51764-45-5-0-35-43-11-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791202683, "last_seen": 1791202683, "transport": "t", "ja3_hash": "c4cdaf69e03357855d928a3baeb9d381", "ja3_variant_count": 1, "ja3_variants": [ "c4cdaf69e03357855d928a3baeb9d381" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_d6f19408ed51", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "d6f19408ed51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-13-10-18-0-23-17613-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789552182, "last_seen": 1789552182, "transport": "t", "ja3_hash": "f7bc42263b6847e320e68b14a7d1095a", "ja3_variant_count": 1, "ja3_variants": [ "f7bc42263b6847e320e68b14a7d1095a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_df6062a0dc39", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "df6062a0dc39", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17513-51-13-10-16-43-27-11-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791269834, "last_seen": 1791269834, "transport": "t", "ja3_hash": "fea2eb66d214b0a61161301a01a13d82", "ja3_variant_count": 1, "ja3_variants": [ "fea2eb66d214b0a61161301a01a13d82" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_e1fb9fad21c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "e1fb9fad21c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-43-65281-65037-27-45-16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790237745, "last_seen": 1790237745, "transport": "t", "ja3_hash": "ba03aa362aa57214c9bfd0064c31cd1a", "ja3_variant_count": 1, "ja3_variants": [ "ba03aa362aa57214c9bfd0064c31cd1a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_e2360b6160ac", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "e2360b6160ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-0-10-43-18-16-45-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790446147, "last_seen": 1790446147, "transport": "t", "ja3_hash": "9d8b30433dd3da24e81883f8306d272e", "ja3_variant_count": 1, "ja3_variants": [ "9d8b30433dd3da24e81883f8306d272e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_0cc3a87d2d11", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "0cc3a87d2d11", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-17613-18-0-43-23-5-65281-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790348976, "last_seen": 1790348976, "transport": "t", "ja3_hash": "b35f1c63286fe0445b13c1d5af982c5b", "ja3_variant_count": 1, "ja3_variants": [ "b35f1c63286fe0445b13c1d5af982c5b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_163eb9cda1e3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "163eb9cda1e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-35-27-0-5-18-23-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788901906, "last_seen": 1788901906, "transport": "t", "ja3_hash": "d7e424e384dc0acf63f43e8be5092c3c", "ja3_variant_count": 1, "ja3_variants": [ "d7e424e384dc0acf63f43e8be5092c3c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_2e756f2d424c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "2e756f2d424c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-13-27-65281-45-0-51764-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790860251, "last_seen": 1790860251, "transport": "t", "ja3_hash": "d7f0c909d9da340efb5a2e25794774ac", "ja3_variant_count": 1, "ja3_variants": [ "d7f0c909d9da340efb5a2e25794774ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_32b815e58942", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "32b815e58942", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-23-65037-18-0-43-13-17613-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788875890, "last_seen": 1788875890, "transport": "t", "ja3_hash": "54d13db90ac767aa58cba97ef84f757c", "ja3_variant_count": 1, "ja3_variants": [ "54d13db90ac767aa58cba97ef84f757c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_4401f719082f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "4401f719082f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-35-43-23-0-45-10-13-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788836930, "last_seen": 1788836930, "transport": "t", "ja3_hash": "07d1cdf128df734560a3d1aef3ddd4b0", "ja3_variant_count": 1, "ja3_variants": [ "07d1cdf128df734560a3d1aef3ddd4b0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_47d795a8546a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "47d795a8546a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-17613-13-65281-35-18-43-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788816025, "last_seen": 1788816025, "transport": "t", "ja3_hash": "75541c1682cbd88f1940c61ec7ee2c12", "ja3_variant_count": 1, "ja3_variants": [ "75541c1682cbd88f1940c61ec7ee2c12" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_4e701523cb0c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "4e701523cb0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-17613-65281-11-13-5-0-43-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789415558, "last_seen": 1789415558, "transport": "t", "ja3_hash": "4f2c5d5b55a0ff21f9cd1251d27abe2d", "ja3_variant_count": 1, "ja3_variants": [ "4f2c5d5b55a0ff21f9cd1251d27abe2d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_584a54e4db61", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "584a54e4db61", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-52393-52392-49195-49199-49172-49171-157-156-53-47,65281-0-11-10-35-22-23-13-43-45-51,29-23-30-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 11, "first_seen": 1790245860, "last_seen": 1790861401, "transport": "t", "ja3_hash": "ebbd1873b4df543c2fb76e4d03d69d27", "ja3_variant_count": 1, "ja3_variants": [ "ebbd1873b4df543c2fb76e4d03d69d27" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_73c4a74ab5cf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "73c4a74ab5cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-23-10-0-65037-51764-27-45-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788873362, "last_seen": 1788873362, "transport": "t", "ja3_hash": "b0cd5d5138cd6030c6d0eaecaad5009f", "ja3_variant_count": 1, "ja3_variants": [ "b0cd5d5138cd6030c6d0eaecaad5009f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_763f4fed420c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "763f4fed420c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-23-65037-43-0-5-65281-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790086698, "last_seen": 1790086698, "transport": "t", "ja3_hash": "2aa94439b404395e26256a9719062187", "ja3_variant_count": 1, "ja3_variants": [ "2aa94439b404395e26256a9719062187" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_975bda0b22cd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "975bda0b22cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-10-11-43-17613-0-45-35-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689008, "last_seen": 1789689008, "transport": "t", "ja3_hash": "12e3176bac0139ba50d3c1223b46270c", "ja3_variant_count": 1, "ja3_variants": [ "12e3176bac0139ba50d3c1223b46270c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_aa74d5d2c696", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "aa74d5d2c696", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-43-51764-45-65281-17613-13-0-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791246183, "last_seen": 1791246183, "transport": "t", "ja3_hash": "cfdc0496fdf3d856877ab5629bb897f1", "ja3_variant_count": 1, "ja3_variants": [ "cfdc0496fdf3d856877ab5629bb897f1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_b14eee72512c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "b14eee72512c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-5-43-45-10-27-11-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791161230, "last_seen": 1791161230, "transport": "t", "ja3_hash": "942e9d6f32b9e89d8329798f6ade3325", "ja3_variant_count": 1, "ja3_variants": [ "942e9d6f32b9e89d8329798f6ade3325" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_b3ce508ea461", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "b3ce508ea461", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-17613-43-27-10-0-13-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790891013, "last_seen": 1790891013, "transport": "t", "ja3_hash": "43d946ad9e0c58e8c1e8864c38bd59cf", "ja3_variant_count": 1, "ja3_variants": [ "43d946ad9e0c58e8c1e8864c38bd59cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_b64f7db23026", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "b64f7db23026", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-23-35-0-45-27-43-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789204851, "last_seen": 1789204851, "transport": "t", "ja3_hash": "a588d2fccb2e1826e7b81ea6b0008f9b", "ja3_variant_count": 1, "ja3_variants": [ "a588d2fccb2e1826e7b81ea6b0008f9b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_bfacd96d2833", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "bfacd96d2833", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-65281-35-11-10-23-43-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788668148, "last_seen": 1788668148, "transport": "t", "ja3_hash": "d30524bb7e4f84de969d0d8149c9dd49", "ja3_variant_count": 1, "ja3_variants": [ "d30524bb7e4f84de969d0d8149c9dd49" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151100_8daaf6152771_ce1da4580fd1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151100", "b": "8daaf6152771", "c": "ce1da4580fd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-23-65281-10-35-43-5-45-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791022136, "last_seen": 1791022136, "transport": "t", "ja3_hash": "7e3015e370a45fec9b380938707c6694", "ja3_variant_count": 1, "ja3_variants": [ "7e3015e370a45fec9b380938707c6694" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_02d7f89ffd8b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "02d7f89ffd8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-27-5-17613-0-51764-13-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790066251, "last_seen": 1790066251, "transport": "t", "ja3_hash": "4a5750fd0790e00f92d868aa7ca04f90", "ja3_variant_count": 1, "ja3_variants": [ "4a5750fd0790e00f92d868aa7ca04f90" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_05557ea985e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "05557ea985e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-17613-0-43-27-16-13-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790219064, "last_seen": 1790219064, "transport": "t", "ja3_hash": "8b7087d8dab1bce12cddf4609573d87c", "ja3_variant_count": 1, "ja3_variants": [ "8b7087d8dab1bce12cddf4609573d87c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_184e20697a0b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "184e20697a0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-43-10-5-16-23-17613-35-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790269784, "last_seen": 1790269784, "transport": "t", "ja3_hash": "4f542c5c744de1156fc25b0a7223ddb4", "ja3_variant_count": 1, "ja3_variants": [ "4f542c5c744de1156fc25b0a7223ddb4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_213d5f32bcef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "213d5f32bcef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-11-13-10-65281-5-18-16-43-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789582324, "last_seen": 1789582324, "transport": "t", "ja3_hash": "d083575c63e3ad0048049ff66deb5f65", "ja3_variant_count": 1, "ja3_variants": [ "d083575c63e3ad0048049ff66deb5f65" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_21a2cd80f436", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "21a2cd80f436", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-65037-11-27-43-16-45-18-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788711046, "last_seen": 1788711046, "transport": "t", "ja3_hash": "2e4ff41f1f6f7731b73e59089324b714", "ja3_variant_count": 1, "ja3_variants": [ "2e4ff41f1f6f7731b73e59089324b714" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_26954d8b0923", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "26954d8b0923", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-17613-18-35-43-16-0-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790242202, "last_seen": 1790242202, "transport": "t", "ja3_hash": "3b179a028c155f4f91b47c1516bf7aa6", "ja3_variant_count": 1, "ja3_variants": [ "3b179a028c155f4f91b47c1516bf7aa6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_29dfc5bf3bf4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "29dfc5bf3bf4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-0-16-65281-27-45-35-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791040362, "last_seen": 1791040362, "transport": "t", "ja3_hash": "1087716825b5cc1c94a40cde199e44d3", "ja3_variant_count": 1, "ja3_variants": [ "1087716825b5cc1c94a40cde199e44d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_352981d24067", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "352981d24067", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-51-35-23-18-10-65037-17513-43-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790949694, "last_seen": 1790949694, "transport": "t", "ja3_hash": "aeb62f97fc75da51a869db17762f0fb8", "ja3_variant_count": 1, "ja3_variants": [ "aeb62f97fc75da51a869db17762f0fb8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_3a416395808d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "3a416395808d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-65037-18-0-11-5-43-16-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791243416, "last_seen": 1791243416, "transport": "t", "ja3_hash": "c29da2d9183c43b646d821baa3b0849a", "ja3_variant_count": 1, "ja3_variants": [ "c29da2d9183c43b646d821baa3b0849a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_3a92bed9df33", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "3a92bed9df33", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-45-5-65037-11-16-35-13-0-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106874, "last_seen": 1791106874, "transport": "t", "ja3_hash": "28aa41c19d7b1a15f776c30b102b62af", "ja3_variant_count": 1, "ja3_variants": [ "28aa41c19d7b1a15f776c30b102b62af" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_3b1aafaf8d1c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "3b1aafaf8d1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-43-45-0-65037-16-27-23-4832-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789654593, "last_seen": 1789654593, "transport": "t", "ja3_hash": "672ed8fda8d5eabdadeb48e291b42df4", "ja3_variant_count": 1, "ja3_variants": [ "672ed8fda8d5eabdadeb48e291b42df4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_3dcd372f1072", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "3dcd372f1072", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-10-65037-65281-35-23-0-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790215459, "last_seen": 1790215459, "transport": "t", "ja3_hash": "ea1524df2daf722462a6e5d8bd4e4f5e", "ja3_variant_count": 1, "ja3_variants": [ "ea1524df2daf722462a6e5d8bd4e4f5e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_48ee921a22b0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "48ee921a22b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-27-51764-65037-65281-16-23-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789462095, "last_seen": 1789462095, "transport": "t", "ja3_hash": "6c76cf51e1c3cc45e8d2e09074e07d78", "ja3_variant_count": 1, "ja3_variants": [ "6c76cf51e1c3cc45e8d2e09074e07d78" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_4b7221fd724e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "4b7221fd724e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-10-0-43-13-18-27-11-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788813782, "last_seen": 1788813782, "transport": "t", "ja3_hash": "4d5894c5d60ca7e4a5132a2f13f7c27f", "ja3_variant_count": 1, "ja3_variants": [ "4d5894c5d60ca7e4a5132a2f13f7c27f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_6166132ca356", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "6166132ca356", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-43-0-16-23-35-5-13-27-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791106742, "last_seen": 1791106742, "transport": "t", "ja3_hash": "88d7304e458c687eccbf3e1f636e6fa6", "ja3_variant_count": 1, "ja3_variants": [ "88d7304e458c687eccbf3e1f636e6fa6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_66b24f65b8b8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "66b24f65b8b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-17613-5-43-23-13-65037-0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790106272, "last_seen": 1790106272, "transport": "t", "ja3_hash": "56481ca522b8a72a73d8a3c2b9a9d78f", "ja3_variant_count": 1, "ja3_variants": [ "56481ca522b8a72a73d8a3c2b9a9d78f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_6bca67dfc71c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "6bca67dfc71c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-10-51764-16-0-17613-27-43-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790008485, "last_seen": 1790008485, "transport": "t", "ja3_hash": "16f57d2c9ecedd7704e410a9c4c3be02", "ja3_variant_count": 1, "ja3_variants": [ "16f57d2c9ecedd7704e410a9c4c3be02" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_6fa848af73b9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "6fa848af73b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-13-11-27-0-16-65037-17513-43-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790946716, "last_seen": 1790946716, "transport": "t", "ja3_hash": "d0a913057c0381864a57e2d70963105c", "ja3_variant_count": 1, "ja3_variants": [ "d0a913057c0381864a57e2d70963105c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_70a30adbd2ef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "70a30adbd2ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-0-17613-11-10-45-35-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790862348, "last_seen": 1790862348, "transport": "t", "ja3_hash": "9cbb8e05fe9e8dab24a2e49833e7b74b", "ja3_variant_count": 1, "ja3_variants": [ "9cbb8e05fe9e8dab24a2e49833e7b74b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_758e65e843e9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "758e65e843e9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-51764-65281-43-10-11-16-0-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791209004, "last_seen": 1791209004, "transport": "t", "ja3_hash": "8c5ffd5a8b9d6828d267a0ad493c8fe8", "ja3_variant_count": 1, "ja3_variants": [ "8c5ffd5a8b9d6828d267a0ad493c8fe8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_836bd2becbed", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "836bd2becbed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,13-0-51764-17613-45-43-5-16-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789843144, "last_seen": 1789843144, "transport": "t", "ja3_hash": "57faa88cdb57c164d4283bf581f66bc1", "ja3_variant_count": 1, "ja3_variants": [ "57faa88cdb57c164d4283bf581f66bc1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_849a128ff5b2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "849a128ff5b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-23-17613-16-43-35-65037-45-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790824537, "last_seen": 1790824537, "transport": "t", "ja3_hash": "44258c78d00a8b5573f6595e8abe62b5", "ja3_variant_count": 1, "ja3_variants": [ "44258c78d00a8b5573f6595e8abe62b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_868e917fd754", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "868e917fd754", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-11-0-18-13-35-16-23-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790083139, "last_seen": 1790083139, "transport": "t", "ja3_hash": "7e046440cd0804742c16c79293f5a8f4", "ja3_variant_count": 1, "ja3_variants": [ "7e046440cd0804742c16c79293f5a8f4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_9ada67b579d1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "9ada67b579d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-43-16-10-17613-0-13-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790591323, "last_seen": 1790591323, "transport": "t", "ja3_hash": "ade1f2c75097a4103200a93b2c476cf0", "ja3_variant_count": 1, "ja3_variants": [ "ade1f2c75097a4103200a93b2c476cf0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_9d3793aa2292", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "9d3793aa2292", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-11-23-0-13-45-5-16-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790222309, "last_seen": 1790222309, "transport": "t", "ja3_hash": "98f903bf403902b9cfa7838a251c72c2", "ja3_variant_count": 1, "ja3_variants": [ "98f903bf403902b9cfa7838a251c72c2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_9f26c159d45d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "9f26c159d45d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-0-5-65037-23-16-43-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789381652, "last_seen": 1789381652, "transport": "t", "ja3_hash": "83ece8647c3a2885c0394c415607b133", "ja3_variant_count": 1, "ja3_variants": [ "83ece8647c3a2885c0394c415607b133" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_b4e1ba942af3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "b4e1ba942af3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-65281-65037-27-11-51764-43-35-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790055350, "last_seen": 1790055350, "transport": "t", "ja3_hash": "631b4cd2faaa1d6965311954f41572c7", "ja3_variant_count": 1, "ja3_variants": [ "631b4cd2faaa1d6965311954f41572c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_b79ef46a1117", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "b79ef46a1117", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-43-23-45-0-65281-16-18-27-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790632268, "last_seen": 1790632268, "transport": "t", "ja3_hash": "3c22c306f7a65c5d9793ba644d40e322", "ja3_variant_count": 1, "ja3_variants": [ "3c22c306f7a65c5d9793ba644d40e322" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c64f1edf7cd4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c64f1edf7cd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-45-27-43-11-35-23-18-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789766886, "last_seen": 1789766886, "transport": "t", "ja3_hash": "d3306d0ef3168be1c5e526b2161a79be", "ja3_variant_count": 1, "ja3_variants": [ "d3306d0ef3168be1c5e526b2161a79be" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_c9e65406e5c9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "c9e65406e5c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,4832-43-10-45-65281-11-16-17613-0-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587737, "last_seen": 1789587737, "transport": "t", "ja3_hash": "13e461acf335a118e1d005f195686cbf", "ja3_variant_count": 1, "ja3_variants": [ "13e461acf335a118e1d005f195686cbf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_ca5b200c9169", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "ca5b200c9169", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-11-43-18-17613-5-65037-35-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790188055, "last_seen": 1790188055, "transport": "t", "ja3_hash": "3f66cb9cde56f1c8af474e6883c0de9d", "ja3_variant_count": 1, "ja3_variants": [ "3f66cb9cde56f1c8af474e6883c0de9d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_cdd30d2dc529", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "cdd30d2dc529", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-43-45-16-18-13-0-65281-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790728504, "last_seen": 1790728504, "transport": "t", "ja3_hash": "f1a4fe5124a324e9937c7ebc5fac20f1", "ja3_variant_count": 1, "ja3_variants": [ "f1a4fe5124a324e9937c7ebc5fac20f1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_d7a12cdc9f94", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "d7a12cdc9f94", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-65037-11-17613-43-18-16-5-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788741782, "last_seen": 1788741782, "transport": "t", "ja3_hash": "85722338cd8584e98869067595d8b86f", "ja3_variant_count": 1, "ja3_variants": [ "85722338cd8584e98869067595d8b86f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_db5064062296", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "db5064062296", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-16-65281-18-17613-43-0-23-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790068780, "last_seen": 1790068780, "transport": "t", "ja3_hash": "dcbdbdb0f6aff3c46159671ba8738ae9", "ja3_variant_count": 1, "ja3_variants": [ "dcbdbdb0f6aff3c46159671ba8738ae9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_e7899880c6d5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "e7899880c6d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-13-16-27-45-18-23-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789456850, "last_seen": 1789456850, "transport": "t", "ja3_hash": "a8f53f1e0be9ecf9dab6f1f079f8d646", "ja3_variant_count": 1, "ja3_variants": [ "a8f53f1e0be9ecf9dab6f1f079f8d646" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_ead6a52b9889", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "ead6a52b9889", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,43-11-10-65281-0-5-16-13-23-45-51,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1788895969, "last_seen": 1790026041, "transport": "t", "ja3_hash": "cc67d4b30aae1317d35ce5bf02dccf0f", "ja3_variant_count": 1, "ja3_variants": [ "cc67d4b30aae1317d35ce5bf02dccf0f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_efa3c7fc24c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "efa3c7fc24c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-35-5-10-0-16-45-65281-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790994618, "last_seen": 1790994618, "transport": "t", "ja3_hash": "f421e6e97e69a8a127258564fc2fc1dc", "ja3_variant_count": 1, "ja3_variants": [ "f421e6e97e69a8a127258564fc2fc1dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_f2ae8f25dd0d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "f2ae8f25dd0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-16-45-27-43-65037-0-23-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790147261, "last_seen": 1790147261, "transport": "t", "ja3_hash": "3373ad3b9815390d33c060f62d972461", "ja3_variant_count": 1, "ja3_variants": [ "3373ad3b9815390d33c060f62d972461" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1511h2_8daaf6152771_fba77d5d62a5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1511h2", "b": "8daaf6152771", "c": "fba77d5d62a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-27-45-5-43-10-65037-13-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790964379, "last_seen": 1790964379, "transport": "t", "ja3_hash": "a82a249dd24e3ec01925ed1fcf84d443", "ja3_variant_count": 1, "ja3_variants": [ "a82a249dd24e3ec01925ed1fcf84d443" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_09219f55faf1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "09219f55faf1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-10-23-17613-51764-11-43-65281-18-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788526333, "last_seen": 1788526333, "transport": "t", "ja3_hash": "846b06c15cafddf8dee8cebb24acb14e", "ja3_variant_count": 1, "ja3_variants": [ "846b06c15cafddf8dee8cebb24acb14e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_1bf4156aaf90", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "1bf4156aaf90", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-45-17613-27-65281-18-65037-11-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791309839, "last_seen": 1791309839, "transport": "t", "ja3_hash": "506e5da51592a11b735e716f1b48ca26", "ja3_variant_count": 1, "ja3_variants": [ "506e5da51592a11b735e716f1b48ca26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_20cfc9ee8534", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "20cfc9ee8534", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-23-65281-65037-11-0-5-35-43-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790553839, "last_seen": 1790553839, "transport": "t", "ja3_hash": "36c591ad598ecd052bf642951a6c5d1a", "ja3_variant_count": 1, "ja3_variants": [ "36c591ad598ecd052bf642951a6c5d1a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_314cf4ba87b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "314cf4ba87b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-27-43-13-65281-17613-0-11-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790954004, "last_seen": 1790954004, "transport": "t", "ja3_hash": "574979ca38ce311988be391438c6e8d5", "ja3_variant_count": 1, "ja3_variants": [ "574979ca38ce311988be391438c6e8d5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_360cf19b7d4b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "360cf19b7d4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-35-17613-51764-5-11-45-43-0-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790820598, "last_seen": 1790820598, "transport": "t", "ja3_hash": "66b9d4aa134c31fb222c9203ee6cb0c9", "ja3_variant_count": 1, "ja3_variants": [ "66b9d4aa134c31fb222c9203ee6cb0c9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_45035db2b220", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "45035db2b220", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-51764-10-65281-65037-5-11-35-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791077859, "last_seen": 1791077859, "transport": "t", "ja3_hash": "09c076b9812298dcc87e802ec295ccf2", "ja3_variant_count": 1, "ja3_variants": [ "09c076b9812298dcc87e802ec295ccf2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_4a1a041143b8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "4a1a041143b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-45-23-11-5-0-65281-43-18-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790211131, "last_seen": 1790211131, "transport": "t", "ja3_hash": "9946be4ddf4f129fe07cc309b95798e3", "ja3_variant_count": 1, "ja3_variants": [ "9946be4ddf4f129fe07cc309b95798e3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_50e4b6d50a96", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "50e4b6d50a96", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-13-11-0-17613-43-5-23-35-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791303614, "last_seen": 1791303614, "transport": "t", "ja3_hash": "804113fe7dbe1f335eb03e6ae33d7e2c", "ja3_variant_count": 1, "ja3_variants": [ "804113fe7dbe1f335eb03e6ae33d7e2c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_58214524deae", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "58214524deae", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-13-35-5-45-11-10-27-0-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791286652, "last_seen": 1791286652, "transport": "t", "ja3_hash": "266a3ec7d879642e3250ad34643b92cb", "ja3_variant_count": 1, "ja3_variants": [ "266a3ec7d879642e3250ad34643b92cb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_84551aecd81a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "84551aecd81a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-17613-11-35-10-65037-23-43-45-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790249321, "last_seen": 1790249321, "transport": "t", "ja3_hash": "9d993ec8d7d5bdc947cf886573c9bacb", "ja3_variant_count": 1, "ja3_variants": [ "9d993ec8d7d5bdc947cf886573c9bacb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_b1c923a9b66f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "b1c923a9b66f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-35-0-18-51764-23-65281-5-17613-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789999564, "last_seen": 1789999564, "transport": "t", "ja3_hash": "c2a1af2b474d73ac132dba8e856dbd9f", "ja3_variant_count": 1, "ja3_variants": [ "c2a1af2b474d73ac132dba8e856dbd9f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_b8f7fe64ec68", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "b8f7fe64ec68", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-0-17613-43-51764-45-65281-35-65037-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790780269, "last_seen": 1790780269, "transport": "t", "ja3_hash": "90d12a4ca9a89f305384a421a5abe721", "ja3_variant_count": 1, "ja3_variants": [ "90d12a4ca9a89f305384a421a5abe721" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_c6043fc63584", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "c6043fc63584", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-51764-17613-65281-18-43-23-5-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789672085, "last_seen": 1789672085, "transport": "t", "ja3_hash": "3533f7eaa61569045dcccec108cd7375", "ja3_variant_count": 1, "ja3_variants": [ "3533f7eaa61569045dcccec108cd7375" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_cc65ec8652e1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "cc65ec8652e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-18-5-51764-23-0-65037-43-35-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789744519, "last_seen": 1789744519, "transport": "t", "ja3_hash": "9848b1e45e053fb97525a44bc4e2fa4a", "ja3_variant_count": 1, "ja3_variants": [ "9848b1e45e053fb97525a44bc4e2fa4a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_d6ff17b606eb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "d6ff17b606eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-10-45-0-23-11-27-65037-13-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791089387, "last_seen": 1791089387, "transport": "t", "ja3_hash": "4618d4196ece8006df40505d6285c0fc", "ja3_variant_count": 1, "ja3_variants": [ "4618d4196ece8006df40505d6285c0fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151200_8daaf6152771_e801203e12ab", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "e801203e12ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-17613-27-65037-11-43-5-65281-45-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789989775, "last_seen": 1789989775, "transport": "t", "ja3_hash": "eebd86a7ebce085229c3cefe549b4f17", "ja3_variant_count": 1, "ja3_variants": [ "eebd86a7ebce085229c3cefe549b4f17" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_09153a371cb9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "09153a371cb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-27-13-23-18-11-0-16-17613-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790147261, "last_seen": 1790147261, "transport": "t", "ja3_hash": "608ca4b0a3cb56fd2663ee139802eeab", "ja3_variant_count": 1, "ja3_variants": [ "608ca4b0a3cb56fd2663ee139802eeab" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_0d1e97442bbf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "0d1e97442bbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-16-27-43-51764-65281-11-23-18-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789980966, "last_seen": 1789980966, "transport": "t", "ja3_hash": "05e9a70529ef578a47209de098fa9e4e", "ja3_variant_count": 1, "ja3_variants": [ "05e9a70529ef578a47209de098fa9e4e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_12a9dbb38ebc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "12a9dbb38ebc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-5-11-17613-43-13-45-0-10-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790910323, "last_seen": 1790910323, "transport": "t", "ja3_hash": "7709bb310ad15d69eb443667271fa287", "ja3_variant_count": 1, "ja3_variants": [ "7709bb310ad15d69eb443667271fa287" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_1a07e476609b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "1a07e476609b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-27-45-43-0-10-16-23-18-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790219068, "last_seen": 1790219068, "transport": "t", "ja3_hash": "5f38498735f2fa459aeb9d7809059772", "ja3_variant_count": 1, "ja3_variants": [ "5f38498735f2fa459aeb9d7809059772" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_2594cb905598", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "2594cb905598", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-35-17613-23-0-16-43-13-5-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790307907, "last_seen": 1790307907, "transport": "t", "ja3_hash": "869f777cde4b820990132014642848c6", "ja3_variant_count": 1, "ja3_variants": [ "869f777cde4b820990132014642848c6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_29812bd3918f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "29812bd3918f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-13-5-16-0-35-27-45-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791176886, "last_seen": 1791176886, "transport": "t", "ja3_hash": "c0f8daab586f2e64194ccd57322cf57b", "ja3_variant_count": 1, "ja3_variants": [ "c0f8daab586f2e64194ccd57322cf57b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_2ed44e6734c4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "2ed44e6734c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-13-11-0-16-5-65281-65037-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791022170, "last_seen": 1791022170, "transport": "t", "ja3_hash": "15b1de054439b607a92920df25594d0b", "ja3_variant_count": 1, "ja3_variants": [ "15b1de054439b607a92920df25594d0b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_30bdf8b60e28", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "30bdf8b60e28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-17613-27-23-45-16-5-13-43-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789720574, "last_seen": 1789720574, "transport": "t", "ja3_hash": "9ec98de40de8a7c25d6d077a9b5e2e47", "ja3_variant_count": 1, "ja3_variants": [ "9ec98de40de8a7c25d6d077a9b5e2e47" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_33cc98934cda", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "33cc98934cda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-23-45-11-35-65281-27-43-13-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791022202, "last_seen": 1791022202, "transport": "t", "ja3_hash": "106a62c8c7067f71b9978dac722d43b9", "ja3_variant_count": 1, "ja3_variants": [ "106a62c8c7067f71b9978dac722d43b9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_3760b00c52d9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "3760b00c52d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-65037-16-11-17613-43-51764-65281-5-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791242196, "last_seen": 1791242196, "transport": "t", "ja3_hash": "a04ecce9a4f893ced0664b7ca753ab76", "ja3_variant_count": 1, "ja3_variants": [ "a04ecce9a4f893ced0664b7ca753ab76" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_3bcaeea63215", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "3bcaeea63215", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-16-11-17613-0-51764-13-45-18-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789912446, "last_seen": 1789912446, "transport": "t", "ja3_hash": "bab2aae0e79bfb65a3fdcaae5deb0c1c", "ja3_variant_count": 1, "ja3_variants": [ "bab2aae0e79bfb65a3fdcaae5deb0c1c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4ae5a7857b3f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4ae5a7857b3f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-65037-35-0-65281-43-23-45-17613-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776181, "last_seen": 1789776181, "transport": "t", "ja3_hash": "e3ab72b92e7844d18fa75aa603406ed2", "ja3_variant_count": 1, "ja3_variants": [ "e3ab72b92e7844d18fa75aa603406ed2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_4f7a18387677", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "4f7a18387677", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-13-5-23-10-11-45-65281-17613-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789523575, "last_seen": 1789523575, "transport": "t", "ja3_hash": "c575c33b1cb13534ec51ff48e17a2441", "ja3_variant_count": 1, "ja3_variants": [ "c575c33b1cb13534ec51ff48e17a2441" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_5a415f903d87", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "5a415f903d87", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-35-5-65281-16-45-0-27-43-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788894963, "last_seen": 1788894963, "transport": "t", "ja3_hash": "226a0e0249487dfbcbf177e5b91a224d", "ja3_variant_count": 1, "ja3_variants": [ "226a0e0249487dfbcbf177e5b91a224d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_69246b9177b2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "69246b9177b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-65281-5-0-35-11-27-43-65037-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789578768, "last_seen": 1789578768, "transport": "t", "ja3_hash": "aabd02d0ba07072bc621068a5ff6995e", "ja3_variant_count": 1, "ja3_variants": [ "aabd02d0ba07072bc621068a5ff6995e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_6d26050cdaea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "6d26050cdaea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-65281-65037-43-23-10-5-18-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788457607, "last_seen": 1788457607, "transport": "t", "ja3_hash": "d867db732c96afef2e5fc49664db4e25", "ja3_variant_count": 1, "ja3_variants": [ "d867db732c96afef2e5fc49664db4e25" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_6fbe34c1acfd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "6fbe34c1acfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-27-5-0-13-43-65281-18-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790716584, "last_seen": 1790716584, "transport": "t", "ja3_hash": "09140a159b1a2338b4d724f11d96487b", "ja3_variant_count": 1, "ja3_variants": [ "09140a159b1a2338b4d724f11d96487b" ], "user_agents": { "WyngmanReader/1.0 (+https://wyngman.agency)": 6 }, "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_7fb00e9fe513", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "7fb00e9fe513", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-0-18-43-27-23-16-17613-45-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790717333, "last_seen": 1790717333, "transport": "t", "ja3_hash": "3a5eaca8f677295c2dd49210c17249da", "ja3_variant_count": 1, "ja3_variants": [ "3a5eaca8f677295c2dd49210c17249da" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_804c960ca71a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "804c960ca71a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-16-65281-11-0-17613-43-23-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791309379, "last_seen": 1791309379, "transport": "t", "ja3_hash": "31387b68d71db44c53edab7af9208baa", "ja3_variant_count": 1, "ja3_variants": [ "31387b68d71db44c53edab7af9208baa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_8440df823685", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "8440df823685", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-16-0-23-51764-17613-43-35-5-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789034262, "last_seen": 1789034262, "transport": "t", "ja3_hash": "ab4a6d89ed01f566cbb539c9b0557690", "ja3_variant_count": 1, "ja3_variants": [ "ab4a6d89ed01f566cbb539c9b0557690" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_9935525ff374", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "9935525ff374", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-23-11-16-27-43-65037-0-13-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790967443, "last_seen": 1790967443, "transport": "t", "ja3_hash": "613571725db1d1972c1a8572796bed48", "ja3_variant_count": 1, "ja3_variants": [ "613571725db1d1972c1a8572796bed48" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_a19a424f63ee", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "a19a424f63ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-13-0-11-17613-43-23-16-65281-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791165258, "last_seen": 1791165258, "transport": "t", "ja3_hash": "280b84aadb38b07f711dae4a3c230a3e", "ja3_variant_count": 1, "ja3_variants": [ "280b84aadb38b07f711dae4a3c230a3e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_a5de9422fa47", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "a5de9422fa47", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-18-51764-43-13-10-5-17613-65281-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790091147, "last_seen": 1790091147, "transport": "t", "ja3_hash": "4c900b06f88cca04761781ec9f38238c", "ja3_variant_count": 1, "ja3_variants": [ "4c900b06f88cca04761781ec9f38238c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_a71492b5696b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "a71492b5696b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-16-51764-18-65281-45-43-65037-35-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790245351, "last_seen": 1790245351, "transport": "t", "ja3_hash": "3ee694ec0fc1cc979c45733e3877c72d", "ja3_variant_count": 1, "ja3_variants": [ "3ee694ec0fc1cc979c45733e3877c72d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_aee53cadf675", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "aee53cadf675", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-0-43-10-18-65281-16-51764-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788647896, "last_seen": 1788647896, "transport": "t", "ja3_hash": "3b84b1c619785eb3c2ca4fe25ad93f02", "ja3_variant_count": 1, "ja3_variants": [ "3b84b1c619785eb3c2ca4fe25ad93f02" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_bb441081aa5e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "bb441081aa5e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-65037-35-13-43-65281-10-27-16-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790457837, "last_seen": 1790729352, "transport": "t", "ja3_hash": "698749e3e3d7e7bdacb53921348100db", "ja3_variant_count": 2, "ja3_variants": [ "698749e3e3d7e7bdacb53921348100db", "17bc9a4903ba853cfcfbb24dbe1c95d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_bd45082d1033", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "bd45082d1033", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-45-11-5-16-65281-23-0-17513-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789124462, "last_seen": 1789124462, "transport": "t", "ja3_hash": "0541041878c1ef4201950d4df1232ecf", "ja3_variant_count": 1, "ja3_variants": [ "0541041878c1ef4201950d4df1232ecf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_be227514bd13", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "be227514bd13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51764-11-0-16-35-43-65281-23-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790597759, "last_seen": 1790597759, "transport": "t", "ja3_hash": "db27f2945edee29f239e3a025af9f45b", "ja3_variant_count": 1, "ja3_variants": [ "db27f2945edee29f239e3a025af9f45b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c01db1d521db", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c01db1d521db", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-0-27-65037-43-16-23-13-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788678200, "last_seen": 1788678200, "transport": "t", "ja3_hash": "e11c8e619e5d68cb5f6c0d5c9bb3a02d", "ja3_variant_count": 1, "ja3_variants": [ "e11c8e619e5d68cb5f6c0d5c9bb3a02d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c0fd8175705a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c0fd8175705a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-13-35-18-27-11-16-17613-23-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791192514, "last_seen": 1791192514, "transport": "t", "ja3_hash": "12f9bf3ff70fac0d4a013debd7cb113d", "ja3_variant_count": 1, "ja3_variants": [ "12f9bf3ff70fac0d4a013debd7cb113d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_c7baa7822bb8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "c7baa7822bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-65037-23-5-65281-17613-0-18-35-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791037181, "last_seen": 1791037181, "transport": "t", "ja3_hash": "30a799989a659159c01d97ccb7ead8ad", "ja3_variant_count": 1, "ja3_variants": [ "30a799989a659159c01d97ccb7ead8ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_cb08d5a7b0e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "cb08d5a7b0e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-65281-45-35-23-51764-11-43-27-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791094028, "last_seen": 1791094028, "transport": "t", "ja3_hash": "bfd6943b5a8f09375315d6cb0a5aaeaa", "ja3_variant_count": 1, "ja3_variants": [ "bfd6943b5a8f09375315d6cb0a5aaeaa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_d930c2e1b39e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "d930c2e1b39e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-65037-16-27-51764-65281-10-45-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790584677, "last_seen": 1790584677, "transport": "t", "ja3_hash": "02749179c7c7c711f12d2be7080e8acb", "ja3_variant_count": 1, "ja3_variants": [ "02749179c7c7c711f12d2be7080e8acb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_e6e29218be51", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "e6e29218be51", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-43-18-0-13-17613-35-65037-5-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790222307, "last_seen": 1790222307, "transport": "t", "ja3_hash": "dd608c7bbac68c6358f053d3541deed0", "ja3_variant_count": 1, "ja3_variants": [ "dd608c7bbac68c6358f053d3541deed0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f25f363ac0af", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f25f363ac0af", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-43-17613-65037-18-13-0-10-23-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789565928, "last_seen": 1789565928, "transport": "t", "ja3_hash": "28008d46ad580c8bed193a09eb979257", "ja3_variant_count": 1, "ja3_variants": [ "28008d46ad580c8bed193a09eb979257" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f428ebd3c10f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f428ebd3c10f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-43-10-17613-13-5-11-45-27-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791251116, "last_seen": 1791251116, "transport": "t", "ja3_hash": "36868f924fad48d0069a50228fecd64c", "ja3_variant_count": 1, "ja3_variants": [ "36868f924fad48d0069a50228fecd64c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f65758e190dc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f65758e190dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-51764-43-5-65281-17613-13-23-45-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791197787, "last_seen": 1791197787, "transport": "t", "ja3_hash": "767ff13b388d4a02f02c167c9ceb5fd8", "ja3_variant_count": 1, "ja3_variants": [ "767ff13b388d4a02f02c167c9ceb5fd8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1512h2_8daaf6152771_f66a660c0717", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "f66a660c0717", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-43-65281-16-23-17613-65037-0-27-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788469381, "last_seen": 1788469381, "transport": "t", "ja3_hash": "25131338264305c8b599e10b601d882a", "ja3_variant_count": 1, "ja3_variants": [ "25131338264305c8b599e10b601d882a" ], "user_agents": { "slack/26.09.10.0.90016132 (samsung SM-S931U1; Android 16; store com.android.vending)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_01328193b9a6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "01328193b9a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-43-13-17613-10-45-65037-35-27-0-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789595472, "last_seen": 1789595472, "transport": "t", "ja3_hash": "596fc4530ace7494bed8de035a45f82c", "ja3_variant_count": 1, "ja3_variants": [ "596fc4530ace7494bed8de035a45f82c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_0a4375ee5e06", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "0a4375ee5e06", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-11-45-0-17613-65037-4832-13-65281-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788625354, "last_seen": 1788625354, "transport": "t", "ja3_hash": "34d19e71e8fb9a2cffc80c0025a528c1", "ja3_variant_count": 1, "ja3_variants": [ "34d19e71e8fb9a2cffc80c0025a528c1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_0d655e8d227e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "0d655e8d227e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-35-13-45-5-17613-11-43-65037-18-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788881845, "last_seen": 1788881845, "transport": "t", "ja3_hash": "8d42716b81b3250c39cc336690021ad8", "ja3_variant_count": 1, "ja3_variants": [ "8d42716b81b3250c39cc336690021ad8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_37fcc8874765", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "37fcc8874765", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-43-11-45-10-17613-65281-65037-5-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791230190, "last_seen": 1791230190, "transport": "t", "ja3_hash": "a36e58f1fe9aeb626d00a2c4e85cb102", "ja3_variant_count": 1, "ja3_variants": [ "a36e58f1fe9aeb626d00a2c4e85cb102" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_43ff45d779ab", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "43ff45d779ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-45-65037-0-27-11-23-35-65281-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790775703, "last_seen": 1790775703, "transport": "t", "ja3_hash": "b12c55594f3c689fc4b121f521e1ef2b", "ja3_variant_count": 1, "ja3_variants": [ "b12c55594f3c689fc4b121f521e1ef2b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_57714f41eb6a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "57714f41eb6a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-23-5-45-10-18-17613-65281-35-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791241414, "last_seen": 1791241414, "transport": "t", "ja3_hash": "0b0a065d8a0e0f14cd2d9279f01a0a87", "ja3_variant_count": 1, "ja3_variants": [ "0b0a065d8a0e0f14cd2d9279f01a0a87" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_62849d7b598e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "62849d7b598e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-51764-17613-5-65037-35-10-45-65281-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788867962, "last_seen": 1788867962, "transport": "t", "ja3_hash": "a1bf27e296beda7deccf9484ef71090a", "ja3_variant_count": 1, "ja3_variants": [ "a1bf27e296beda7deccf9484ef71090a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_674734105b11", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "674734105b11", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51764-43-65037-13-0-27-10-23-11-45-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790605457, "last_seen": 1790605457, "transport": "t", "ja3_hash": "d8d81afb60bd3ee4cf9bb5873d40537c", "ja3_variant_count": 1, "ja3_variants": [ "d8d81afb60bd3ee4cf9bb5873d40537c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151300_8daaf6152771_8bb3bd8e047d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151300", "b": "8daaf6152771", "c": "8bb3bd8e047d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-65037-11-45-17613-0-18-51764-23-5-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587733, "last_seen": 1789587733, "transport": "t", "ja3_hash": "b64e9e4b9a08632f96478d814ecc541d", "ja3_variant_count": 1, "ja3_variants": [ "b64e9e4b9a08632f96478d814ecc541d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h1_8daaf6152771_53c10a979e33", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h1", "b": "8daaf6152771", "c": "53c10a979e33", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-27-0-23-35-11-45-43-10-18-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790542228, "last_seen": 1790542228, "transport": "t", "ja3_hash": "6b7a8572fab4e5655860f00153622eaf", "ja3_variant_count": 1, "ja3_variants": [ "6b7a8572fab4e5655860f00153622eaf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_00d42c2875f9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "00d42c2875f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-5-45-65037-35-27-16-10-18-0-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791103447, "last_seen": 1791103447, "transport": "t", "ja3_hash": "47794fcfef551e0c9b5935028ced135c", "ja3_variant_count": 1, "ja3_variants": [ "47794fcfef551e0c9b5935028ced135c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_068cde9bf35a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "068cde9bf35a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-65281-65037-13-11-23-5-35-43-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788934412, "last_seen": 1788934412, "transport": "t", "ja3_hash": "e4ab10c0cd4d9cbf96a6d5085c56ec8b", "ja3_variant_count": 1, "ja3_variants": [ "e4ab10c0cd4d9cbf96a6d5085c56ec8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_0a5575733548", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "0a5575733548", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-27-51764-35-65281-65037-17613-45-5-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835365, "last_seen": 1788835365, "transport": "t", "ja3_hash": "57fda7124aa8e0e34d3d6978cf27704c", "ja3_variant_count": 1, "ja3_variants": [ "57fda7124aa8e0e34d3d6978cf27704c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_10d1ef184d7a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "10d1ef184d7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-10-65281-23-27-13-11-35-45-43-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789280479, "last_seen": 1789280479, "transport": "t", "ja3_hash": "5328db301f9f6b4da0cb0242d7a31508", "ja3_variant_count": 1, "ja3_variants": [ "5328db301f9f6b4da0cb0242d7a31508" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_122f37b7d0da", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "122f37b7d0da", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51764-10-35-23-45-13-65281-43-27-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790015668, "last_seen": 1790015668, "transport": "t", "ja3_hash": "5a5f04e418432d6eda20f23cde9d22be", "ja3_variant_count": 1, "ja3_variants": [ "5a5f04e418432d6eda20f23cde9d22be" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_1f15a2f366ce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "1f15a2f366ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-0-35-51764-10-43-23-65281-16-27-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790263463, "last_seen": 1790263463, "transport": "t", "ja3_hash": "7b5f2e615f44f211c1cd374c8bd74ef2", "ja3_variant_count": 1, "ja3_variants": [ "7b5f2e615f44f211c1cd374c8bd74ef2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_1f80e2ffbb11", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "1f80e2ffbb11", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-65037-0-13-45-16-17613-23-5-43-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790340577, "last_seen": 1790340577, "transport": "t", "ja3_hash": "b65e6acc59a2ec5ccf14bcd045268929", "ja3_variant_count": 1, "ja3_variants": [ "b65e6acc59a2ec5ccf14bcd045268929" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_21993be0489e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "21993be0489e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-10-35-43-17613-16-23-5-0-18-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788560341, "last_seen": 1788560341, "transport": "t", "ja3_hash": "cc880a2e9a83dc4b4e2296027d045608", "ja3_variant_count": 1, "ja3_variants": [ "cc880a2e9a83dc4b4e2296027d045608" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_2230ef5936ce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "2230ef5936ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-23-51764-5-43-27-4832-65037-0-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789701008, "last_seen": 1789701008, "transport": "t", "ja3_hash": "aafc813c68e5ca87b7e3631da99eba84", "ja3_variant_count": 1, "ja3_variants": [ "aafc813c68e5ca87b7e3631da99eba84" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_2a8c770be80b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "2a8c770be80b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-0-5-45-23-65281-10-16-65037-35-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791303608, "last_seen": 1791303608, "transport": "t", "ja3_hash": "874ea9ff83c1c3b217787f41d75cdcf3", "ja3_variant_count": 1, "ja3_variants": [ "874ea9ff83c1c3b217787f41d75cdcf3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_2ad79bace647", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "2ad79bace647", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-45-5-51764-35-43-0-16-10-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789749996, "last_seen": 1789749996, "transport": "t", "ja3_hash": "c6c1e14821d4c3ddb107acb309de19b5", "ja3_variant_count": 1, "ja3_variants": [ "c6c1e14821d4c3ddb107acb309de19b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_2bc18b8a38f2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "2bc18b8a38f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-10-23-16-17613-0-5-65281-11-35-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790239288, "last_seen": 1790239288, "transport": "t", "ja3_hash": "0ff80e06ef3f62dc084a2353c6eb94a1", "ja3_variant_count": 1, "ja3_variants": [ "0ff80e06ef3f62dc084a2353c6eb94a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_2ffb8507abbc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "2ffb8507abbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-35-43-16-18-65281-17613-0-13-11-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789869196, "last_seen": 1789869196, "transport": "t", "ja3_hash": "df6eeb37aa341970518ccdd977e67550", "ja3_variant_count": 1, "ja3_variants": [ "df6eeb37aa341970518ccdd977e67550" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_31b45bfc656d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "31b45bfc656d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-0-11-45-65281-43-10-18-5-13-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789004728, "last_seen": 1789004728, "transport": "t", "ja3_hash": "3c5face0595dd3348bd82c5d9ee72073", "ja3_variant_count": 1, "ja3_variants": [ "3c5face0595dd3348bd82c5d9ee72073" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_3e6a6200e4fc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "3e6a6200e4fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-23-17613-0-10-65281-65037-18-35-45-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791213934, "last_seen": 1791213934, "transport": "t", "ja3_hash": "45c7267469384afc87853cbbc044c21c", "ja3_variant_count": 1, "ja3_variants": [ "45c7267469384afc87853cbbc044c21c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_3ec8dad22576", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "3ec8dad22576", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-43-27-17613-18-65037-10-16-5-11-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790042169, "last_seen": 1790042169, "transport": "t", "ja3_hash": "80896df2ee6940a121f78335572cc382", "ja3_variant_count": 1, "ja3_variants": [ "80896df2ee6940a121f78335572cc382" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_3fc315e4bc1c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "3fc315e4bc1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-13-0-43-10-65037-65281-11-5-16-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789658156, "last_seen": 1789658156, "transport": "t", "ja3_hash": "e6d607261b638ff030f66502e7b0535c", "ja3_variant_count": 1, "ja3_variants": [ "e6d607261b638ff030f66502e7b0535c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_476f68342dd8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "476f68342dd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-23-43-35-45-5-17513-51-16-65281-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790949542, "last_seen": 1790949542, "transport": "t", "ja3_hash": "c7dfc95f319f70b7e2b7606a2a69ab81", "ja3_variant_count": 1, "ja3_variants": [ "c7dfc95f319f70b7e2b7606a2a69ab81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_4c655465a530", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "4c655465a530", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-16-5-65037-35-65281-45-18-13-11-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790230194, "last_seen": 1790230194, "transport": "t", "ja3_hash": "51af8f987fc9ff7a905e4824b803804e", "ja3_variant_count": 1, "ja3_variants": [ "51af8f987fc9ff7a905e4824b803804e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_53c10a979e33", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "53c10a979e33", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-13-10-16-23-27-11-43-65281-18-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790779006, "last_seen": 1790779006, "transport": "t", "ja3_hash": "68f54b2789df631c3168de0b39217401", "ja3_variant_count": 1, "ja3_variants": [ "68f54b2789df631c3168de0b39217401" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_5486a096c1ff", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "5486a096c1ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-16-5-45-35-43-13-17613-65281-65037-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790936056, "last_seen": 1790936056, "transport": "t", "ja3_hash": "a67d65c8fc972936e429db0ea605fa66", "ja3_variant_count": 1, "ja3_variants": [ "a67d65c8fc972936e429db0ea605fa66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_5c9fde24ac23", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "5c9fde24ac23", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-23-65281-13-16-11-0-65037-18-35-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790722106, "last_seen": 1790722106, "transport": "t", "ja3_hash": "4ea2426f1f17c637b7044abd20ee64bd", "ja3_variant_count": 1, "ja3_variants": [ "4ea2426f1f17c637b7044abd20ee64bd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_5d1f5ba895ca", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "5d1f5ba895ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-5-17613-23-10-16-35-27-45-65281-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790079764, "last_seen": 1790079764, "transport": "t", "ja3_hash": "8ede0f7ad0ae83b8094c48eafd7c2b27", "ja3_variant_count": 1, "ja3_variants": [ "8ede0f7ad0ae83b8094c48eafd7c2b27" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_6eceb7bc6142", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "6eceb7bc6142", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51764-45-17613-65281-18-11-0-23-27-16-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790197014, "last_seen": 1790197014, "transport": "t", "ja3_hash": "ddc6b3fcf507f48f6273762b93d6d9f6", "ja3_variant_count": 1, "ja3_variants": [ "ddc6b3fcf507f48f6273762b93d6d9f6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_721588076027", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "721588076027", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-43-65037-13-11-18-16-27-0-45-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789792137, "last_seen": 1789792137, "transport": "t", "ja3_hash": "da9637aec25962882eb23be42e3e73ca", "ja3_variant_count": 1, "ja3_variants": [ "da9637aec25962882eb23be42e3e73ca" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_872b9934ebb9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "872b9934ebb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-23-17613-0-43-35-13-10-11-18-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790202834, "last_seen": 1790202834, "transport": "t", "ja3_hash": "9f62b98435ac28e3caef9fcd8d01b34d", "ja3_variant_count": 1, "ja3_variants": [ "9f62b98435ac28e3caef9fcd8d01b34d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_8a0e6fd4ad7e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "8a0e6fd4ad7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-18-0-45-10-17613-51764-65037-43-65281-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790596705, "last_seen": 1790596705, "transport": "t", "ja3_hash": "389ba56d1975ef9e481ac8e928f30faf", "ja3_variant_count": 1, "ja3_variants": [ "389ba56d1975ef9e481ac8e928f30faf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_9420bc7b8960", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "9420bc7b8960", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-0-18-5-65037-13-65281-35-10-43-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789122521, "last_seen": 1789122521, "transport": "t", "ja3_hash": "c02dde219a52f2a9750b1da451342147", "ja3_variant_count": 1, "ja3_variants": [ "c02dde219a52f2a9750b1da451342147" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_94e6b60455fb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "94e6b60455fb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-0-35-27-18-5-43-16-45-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789901946, "last_seen": 1789901946, "transport": "t", "ja3_hash": "1e4a5683f46b5a874ea099b6a07fb18c", "ja3_variant_count": 1, "ja3_variants": [ "1e4a5683f46b5a874ea099b6a07fb18c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a3828233643d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a3828233643d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51764-43-11-17613-10-65281-35-16-45-0-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788824570, "last_seen": 1788824570, "transport": "t", "ja3_hash": "1837ee8a1955490e997c449e5b0b2010", "ja3_variant_count": 1, "ja3_variants": [ "1837ee8a1955490e997c449e5b0b2010" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a48629524374", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a48629524374", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-10-27-5-65037-35-17613-43-0-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788630789, "last_seen": 1788630789, "transport": "t", "ja3_hash": "c2dfe202f4933fac383b8e05ccfb18e2", "ja3_variant_count": 1, "ja3_variants": [ "c2dfe202f4933fac383b8e05ccfb18e2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a6618a8735e6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a6618a8735e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-45-35-16-43-10-5-23-65037-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790234297, "last_seen": 1790234297, "transport": "t", "ja3_hash": "1ee80ed7659498321928aac6630acc94", "ja3_variant_count": 1, "ja3_variants": [ "1ee80ed7659498321928aac6630acc94" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_abf3d86cf300", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "abf3d86cf300", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-17613-18-45-43-10-23-65037-0-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788533125, "last_seen": 1788533125, "transport": "t", "ja3_hash": "308afd6ad18e2466396f30400fb72b24", "ja3_variant_count": 1, "ja3_variants": [ "308afd6ad18e2466396f30400fb72b24" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_afc567c59ad3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "afc567c59ad3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-27-17613-43-5-65281-0-16-35-45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790488638, "last_seen": 1790488638, "transport": "t", "ja3_hash": "c5e245a01ac40313c0df9c6aebbb2658", "ja3_variant_count": 1, "ja3_variants": [ "c5e245a01ac40313c0df9c6aebbb2658" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_bb01b04abb11", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "bb01b04abb11", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-17613-35-0-51764-10-16-43-65281-27-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790947612, "last_seen": 1790947612, "transport": "t", "ja3_hash": "ddf4dcb5d3ac8d57632dc3b53274dd65", "ja3_variant_count": 1, "ja3_variants": [ "ddf4dcb5d3ac8d57632dc3b53274dd65" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_bb1c65e6d82f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "bb1c65e6d82f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-5-27-23-17613-0-13-43-45-65037-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790876632, "last_seen": 1790876632, "transport": "t", "ja3_hash": "20e59a3fdf5ed28d5fc732b1457eb06b", "ja3_variant_count": 1, "ja3_variants": [ "20e59a3fdf5ed28d5fc732b1457eb06b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_c4af766dfd46", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "c4af766dfd46", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-35-11-18-5-23-65037-45-27-13-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790925441, "last_seen": 1790925441, "transport": "t", "ja3_hash": "064c1b23e4c10a5ecd3fe89e00a0558e", "ja3_variant_count": 1, "ja3_variants": [ "064c1b23e4c10a5ecd3fe89e00a0558e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_cd3755d40a5b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "cd3755d40a5b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-23-51764-65281-18-13-16-35-27-43-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789820709, "last_seen": 1789820709, "transport": "t", "ja3_hash": "fe3a88749a0a148d5eb3e03f1b710a90", "ja3_variant_count": 1, "ja3_variants": [ "fe3a88749a0a148d5eb3e03f1b710a90" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_d244ae6727c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "d244ae6727c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-45-11-43-35-5-65281-10-65037-0-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790860770, "last_seen": 1790860770, "transport": "t", "ja3_hash": "23906f9d8755f928607f7bbf92d244fc", "ja3_variant_count": 1, "ja3_variants": [ "23906f9d8755f928607f7bbf92d244fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_d8c832cb6800", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "d8c832cb6800", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-11-43-65281-23-45-17613-18-13-5-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790556367, "last_seen": 1790556367, "transport": "t", "ja3_hash": "d01f3fd4083273a7400c3291720c7cda", "ja3_variant_count": 1, "ja3_variants": [ "d01f3fd4083273a7400c3291720c7cda" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_e2c5acc2f924", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "e2c5acc2f924", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-10-13-43-35-18-5-0-65281-16-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790153201, "last_seen": 1790153201, "transport": "t", "ja3_hash": "5138d9b40d8eff4f23722829559b7e8e", "ja3_variant_count": 1, "ja3_variants": [ "5138d9b40d8eff4f23722829559b7e8e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_e99adb098657", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "e99adb098657", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-45-27-65281-0-17613-35-16-5-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788911286, "last_seen": 1788911286, "transport": "t", "ja3_hash": "e22e04854306777ac0cf677688ce6982", "ja3_variant_count": 1, "ja3_variants": [ "e22e04854306777ac0cf677688ce6982" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_f506c3f3b897", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "f506c3f3b897", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-65281-10-45-35-17613-27-11-5-43-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790994618, "last_seen": 1790994618, "transport": "t", "ja3_hash": "b05125dd06a14d840a25cb200b23b660", "ja3_variant_count": 1, "ja3_variants": [ "b05125dd06a14d840a25cb200b23b660" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_fcefb0f2f38d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "fcefb0f2f38d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-16-0-17613-13-65281-11-23-18-5-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790794648, "last_seen": 1790794648, "transport": "t", "ja3_hash": "ea643982839dd05e7caf118755728b43", "ja3_variant_count": 1, "ja3_variants": [ "ea643982839dd05e7caf118755728b43" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_084528d10652", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "084528d10652", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-11-18-10-43-0-65281-23-13-17613-27-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789751582, "last_seen": 1789751582, "transport": "t", "ja3_hash": "3afa6ab82aa840c41d80429ac9415682", "ja3_variant_count": 1, "ja3_variants": [ "3afa6ab82aa840c41d80429ac9415682" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_149dc003db50", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "149dc003db50", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-35-27-45-23-65281-65037-0-5-13-43-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789056830, "last_seen": 1789056830, "transport": "t", "ja3_hash": "04e3bb72e884aa5ee8fc6763bd7ff147", "ja3_variant_count": 1, "ja3_variants": [ "04e3bb72e884aa5ee8fc6763bd7ff147" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_1c6ca80a981f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "1c6ca80a981f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-17613-0-65037-51764-13-27-5-35-10-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791170340, "last_seen": 1791170340, "transport": "t", "ja3_hash": "0a723e9fd502d5697802787da3c393d0", "ja3_variant_count": 1, "ja3_variants": [ "0a723e9fd502d5697802787da3c393d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_5236248dd448", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "5236248dd448", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-27-65281-0-43-17613-18-11-45-5-23-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791219044, "last_seen": 1791219044, "transport": "t", "ja3_hash": "cb88349bb0c338a8bafa90de46d4936a", "ja3_variant_count": 1, "ja3_variants": [ "cb88349bb0c338a8bafa90de46d4936a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_590ae4078159", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "590ae4078159", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-11-13-10-65037-5-23-43-27-35-17613-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791259232, "last_seen": 1791259232, "transport": "t", "ja3_hash": "3dfc89d4049b395db01a3d82a3b1961b", "ja3_variant_count": 1, "ja3_variants": [ "3dfc89d4049b395db01a3d82a3b1961b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_b3e6a62c5873", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "b3e6a62c5873", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-23-65281-17613-18-10-35-43-11-0-27-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790595119, "last_seen": 1790595119, "transport": "t", "ja3_hash": "609747701e93e38f4625ee337114186f", "ja3_variant_count": 1, "ja3_variants": [ "609747701e93e38f4625ee337114186f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_b9099a179302", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "b9099a179302", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-45-43-65281-5-13-0-11-17613-10-65037-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788649464, "last_seen": 1788649464, "transport": "t", "ja3_hash": "077759765b50bfb901b2fdc0740ffff4", "ja3_variant_count": 1, "ja3_variants": [ "077759765b50bfb901b2fdc0740ffff4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_bcc0eb56b5e7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "bcc0eb56b5e7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-10-5-17613-35-23-65037-0-43-51764-45-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789657832, "last_seen": 1789657832, "transport": "t", "ja3_hash": "c6eef84c1cee6b51866de8d52863221e", "ja3_variant_count": 1, "ja3_variants": [ "c6eef84c1cee6b51866de8d52863221e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_da48514c4592", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "da48514c4592", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-17613-43-27-23-65037-5-65281-0-35-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790596044, "last_seen": 1790596044, "transport": "t", "ja3_hash": "81d5f39ae82b8b9f94d862c8efd6c0e0", "ja3_variant_count": 1, "ja3_variants": [ "81d5f39ae82b8b9f94d862c8efd6c0e0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_dc122331f557", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "dc122331f557", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-13-43-65037-35-0-17613-18-11-23-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790090075, "last_seen": 1790090075, "transport": "t", "ja3_hash": "1da25d3a1c4ab6cc33463dbacdd748d5", "ja3_variant_count": 1, "ja3_variants": [ "1da25d3a1c4ab6cc33463dbacdd748d5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_de3031f27d8b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "de3031f27d8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-17613-35-65281-23-13-18-5-27-0-51764-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789366307, "last_seen": 1789366307, "transport": "t", "ja3_hash": "eca964132f24206543519b5390f9df19", "ja3_variant_count": 1, "ja3_variants": [ "eca964132f24206543519b5390f9df19" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151400_8daaf6152771_f77074818dd4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151400", "b": "8daaf6152771", "c": "f77074818dd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-18-0-45-11-10-65281-43-13-65037-27-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791213933, "last_seen": 1791213933, "transport": "t", "ja3_hash": "fda1421398ddfd91be6539cb6a8812a4", "ja3_variant_count": 1, "ja3_variants": [ "fda1421398ddfd91be6539cb6a8812a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_00bedd1f76ff", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "00bedd1f76ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-23-0-16-5-35-13-51764-18-10-17613-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790731959, "last_seen": 1790731959, "transport": "t", "ja3_hash": "73a760a03eda15333904c2c3ad93eee4", "ja3_variant_count": 1, "ja3_variants": [ "73a760a03eda15333904c2c3ad93eee4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_019d7df28e7a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "019d7df28e7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-23-65281-18-10-43-51764-45-13-0-35-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791201466, "last_seen": 1791201466, "transport": "t", "ja3_hash": "442afc9f1107b7588112f68aabee7116", "ja3_variant_count": 1, "ja3_variants": [ "442afc9f1107b7588112f68aabee7116" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_0b92f9e8525e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "0b92f9e8525e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-0-16-17613-18-11-5-65281-27-13-65037-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790517903, "last_seen": 1790517903, "transport": "t", "ja3_hash": "b5884fce5c492709f5767e0786a697b6", "ja3_variant_count": 1, "ja3_variants": [ "b5884fce5c492709f5767e0786a697b6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_0d29295bbda6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "0d29295bbda6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-13-51764-23-45-10-35-65281-17613-18-11-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788911289, "last_seen": 1788911289, "transport": "t", "ja3_hash": "4ee5b76290e2390917c76dcf1b4288c4", "ja3_variant_count": 1, "ja3_variants": [ "4ee5b76290e2390917c76dcf1b4288c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_0d4f88983ce4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "0d4f88983ce4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-17613-0-65281-16-35-27-65037-10-13-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789986868, "last_seen": 1789986868, "transport": "t", "ja3_hash": "1242be793876e4b7216211f3a9b7f6fa", "ja3_variant_count": 1, "ja3_variants": [ "1242be793876e4b7216211f3a9b7f6fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_13faa61246a3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "13faa61246a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-0-11-45-23-43-13-17613-65281-16-10-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789963689, "last_seen": 1789963689, "transport": "t", "ja3_hash": "8049ad0433e00b6850698d355f5c66a4", "ja3_variant_count": 1, "ja3_variants": [ "8049ad0433e00b6850698d355f5c66a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_149bbda496cb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "149bbda496cb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-65037-43-5-35-17613-65281-45-13-0-23-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789736891, "last_seen": 1789736891, "transport": "t", "ja3_hash": "c5953ea38d1f5c641f4c56838fba480c", "ja3_variant_count": 1, "ja3_variants": [ "c5953ea38d1f5c641f4c56838fba480c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1d574a431466", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1d574a431466", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-65281-10-27-18-16-13-23-0-17613-51764-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791208413, "last_seen": 1791208413, "transport": "t", "ja3_hash": "8c753ddbf403b7189c0f7117cf775391", "ja3_variant_count": 1, "ja3_variants": [ "8c753ddbf403b7189c0f7117cf775391" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_1de850e75304", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "1de850e75304", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-51764-5-27-65281-11-43-35-0-10-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789923849, "last_seen": 1789923849, "transport": "t", "ja3_hash": "6dbe7b378725a8bf0a667db8e8f05639", "ja3_variant_count": 1, "ja3_variants": [ "6dbe7b378725a8bf0a667db8e8f05639" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_215ce841d4c9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "215ce841d4c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-13-0-65037-18-23-5-11-16-27-43-10-17513-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788899952, "last_seen": 1788899952, "transport": "t", "ja3_hash": "3026c2dd11a37c046e24dad99e2fb7ef", "ja3_variant_count": 1, "ja3_variants": [ "3026c2dd11a37c046e24dad99e2fb7ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_23ba5db65186", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "23ba5db65186", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-17613-18-16-0-5-51764-10-11-65037-65281-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789749891, "last_seen": 1789749891, "transport": "t", "ja3_hash": "7ab486c49aa7173cfeb452d6fd194f24", "ja3_variant_count": 1, "ja3_variants": [ "7ab486c49aa7173cfeb452d6fd194f24" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_28c13fb41427", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "28c13fb41427", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51764-43-65281-4832-65037-17613-10-0-5-27-16-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790350612, "last_seen": 1790350612, "transport": "t", "ja3_hash": "426043a6717db4a4a0e31483d837fc09", "ja3_variant_count": 1, "ja3_variants": [ "426043a6717db4a4a0e31483d837fc09" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_2bfafe4d9e04", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "2bfafe4d9e04", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-35-51-43-10-23-0-17513-16-18-5-45-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791150970, "last_seen": 1791150970, "transport": "t", "ja3_hash": "59b5dad3cd8eaa2ce4213c055fa257ba", "ja3_variant_count": 1, "ja3_variants": [ "59b5dad3cd8eaa2ce4213c055fa257ba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_321241f7cc5c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "321241f7cc5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-18-65037-5-23-13-43-10-17613-16-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790332936, "last_seen": 1790788775, "transport": "t", "ja3_hash": "7a30348fa685c5d14b87277ecdf84ecc", "ja3_variant_count": 2, "ja3_variants": [ "7a30348fa685c5d14b87277ecdf84ecc", "e5d7af2066417f37d4e57794510037ff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_340acb566e5d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "340acb566e5d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-51764-65281-10-23-17613-16-11-43-18-65037-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790812584, "last_seen": 1790812584, "transport": "t", "ja3_hash": "b04e81cc2f46a554832487f679301cd7", "ja3_variant_count": 1, "ja3_variants": [ "b04e81cc2f46a554832487f679301cd7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_35f54e0b1a82", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "35f54e0b1a82", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-35-13-51764-65281-27-43-23-11-16-18-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789577837, "last_seen": 1789577837, "transport": "t", "ja3_hash": "a10d4d2cd9b3f9bd4d16bccbe0185de2", "ja3_variant_count": 1, "ja3_variants": [ "a10d4d2cd9b3f9bd4d16bccbe0185de2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_5a90cfb7f210", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "5a90cfb7f210", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-16-11-10-43-65037-13-27-45-17613-18-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790464287, "last_seen": 1790464287, "transport": "t", "ja3_hash": "570729444598a1a584cb533130fd4fd3", "ja3_variant_count": 1, "ja3_variants": [ "570729444598a1a584cb533130fd4fd3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_5ee4dfa6adcd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "5ee4dfa6adcd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-13-18-23-11-17613-65281-43-10-0-27-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791231531, "last_seen": 1791231531, "transport": "t", "ja3_hash": "2518c87889186cf5abffb9abbac4e901", "ja3_variant_count": 1, "ja3_variants": [ "2518c87889186cf5abffb9abbac4e901" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_603ccdb91e3a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "603ccdb91e3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-27-10-43-45-5-23-17613-11-65037-16-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790004401, "last_seen": 1790004401, "transport": "t", "ja3_hash": "629f4533b5692701bd1263dc98f9f1e3", "ja3_variant_count": 1, "ja3_variants": [ "629f4533b5692701bd1263dc98f9f1e3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_621b498a6771", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "621b498a6771", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-0-65037-43-10-11-5-27-45-13-35-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791035800, "last_seen": 1791035800, "transport": "t", "ja3_hash": "7dddc7d28dd4a7de37af0f6cb2466024", "ja3_variant_count": 1, "ja3_variants": [ "7dddc7d28dd4a7de37af0f6cb2466024" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_62a27464bde7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "62a27464bde7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-23-27-65037-35-10-11-18-45-43-16-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789766889, "last_seen": 1789766889, "transport": "t", "ja3_hash": "fdd2257e95dab08a25cb7aca1fb160ac", "ja3_variant_count": 1, "ja3_variants": [ "fdd2257e95dab08a25cb7aca1fb160ac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_64e6dc6d1f26", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "64e6dc6d1f26", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-17613-0-10-65281-43-35-27-65037-18-5-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789486356, "last_seen": 1789486356, "transport": "t", "ja3_hash": "f0299518db3dbd016b487e5b86fce5a9", "ja3_variant_count": 1, "ja3_variants": [ "f0299518db3dbd016b487e5b86fce5a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_685353bea1f2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "685353bea1f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-5-16-18-35-17613-23-43-13-0-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791122615, "last_seen": 1791122615, "transport": "t", "ja3_hash": "ffeb165a7912aa349fb91035d98cbaac", "ja3_variant_count": 1, "ja3_variants": [ "ffeb165a7912aa349fb91035d98cbaac" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_6e529c80a2a4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "6e529c80a2a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-10-43-45-35-5-11-17613-27-13-18-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790601640, "last_seen": 1790601640, "transport": "t", "ja3_hash": "485ec98105378cedb6508aa6e34d623f", "ja3_variant_count": 1, "ja3_variants": [ "485ec98105378cedb6508aa6e34d623f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_70068f755717", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "70068f755717", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-5-0-16-10-11-43-65037-27-45-65281-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790340578, "last_seen": 1790340578, "transport": "t", "ja3_hash": "e3e99674ed5ece731406b1b4af9a2d60", "ja3_variant_count": 1, "ja3_variants": [ "e3e99674ed5ece731406b1b4af9a2d60" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_71a288ae58df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "71a288ae58df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-4832-0-27-23-16-65037-11-35-43-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789654589, "last_seen": 1789654589, "transport": "t", "ja3_hash": "466a3b91ab87e59630138c6e862b59d1", "ja3_variant_count": 1, "ja3_variants": [ "466a3b91ab87e59630138c6e862b59d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_7f1550c5568a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "7f1550c5568a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-43-5-35-0-13-23-65281-16-10-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789523571, "last_seen": 1789523571, "transport": "t", "ja3_hash": "5ce3bfe5102249d1a66a56016015a410", "ja3_variant_count": 1, "ja3_variants": [ "5ce3bfe5102249d1a66a56016015a410" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_810a15a332c1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "810a15a332c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-18-10-27-16-45-43-13-23-0-65281-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789418192, "last_seen": 1789418192, "transport": "t", "ja3_hash": "ee269934ec327b01fc2e584dd12451a5", "ja3_variant_count": 1, "ja3_variants": [ "ee269934ec327b01fc2e584dd12451a5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_836cd95ea05e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "836cd95ea05e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-11-13-27-51764-23-35-45-0-65281-16-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788967487, "last_seen": 1788967487, "transport": "t", "ja3_hash": "f3cdc3295e35a8c7067194cc4d7cb337", "ja3_variant_count": 1, "ja3_variants": [ "f3cdc3295e35a8c7067194cc4d7cb337" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8468d7ade12c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8468d7ade12c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-10-0-65037-13-65281-11-5-27-23-17613-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789517699, "last_seen": 1789517699, "transport": "t", "ja3_hash": "0e42f89aeef3c425e04f1b5f48fb7914", "ja3_variant_count": 1, "ja3_variants": [ "0e42f89aeef3c425e04f1b5f48fb7914" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8523bacc6fc9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8523bacc6fc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-65281-43-10-17613-16-13-0-11-35-18-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790433201, "last_seen": 1790433201, "transport": "t", "ja3_hash": "ec63cb6fc24f6ece4e1bb405769296b3", "ja3_variant_count": 1, "ja3_variants": [ "ec63cb6fc24f6ece4e1bb405769296b3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_87766c1a4490", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "87766c1a4490", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-51764-0-27-23-17613-65037-35-10-11-65281-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789538320, "last_seen": 1789538320, "transport": "t", "ja3_hash": "3cdb13e81fce4f800e2c8c78d67644e7", "ja3_variant_count": 1, "ja3_variants": [ "3cdb13e81fce4f800e2c8c78d67644e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_87ef4d3fd5a9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "87ef4d3fd5a9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-5-35-13-16-65037-43-27-0-17613-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791049983, "last_seen": 1791049983, "transport": "t", "ja3_hash": "35576d54b68bf9ed8d31fd79fc43385e", "ja3_variant_count": 1, "ja3_variants": [ "35576d54b68bf9ed8d31fd79fc43385e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8bafa0803767", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8bafa0803767", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-27-65037-5-35-16-10-0-13-51764-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789923850, "last_seen": 1789923850, "transport": "t", "ja3_hash": "c686f31454b6e4fb74e61cb115b15099", "ja3_variant_count": 1, "ja3_variants": [ "c686f31454b6e4fb74e61cb115b15099" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8be788a27918", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8be788a27918", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-23-13-18-65037-0-17613-65281-35-10-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789168899, "last_seen": 1790211132, "transport": "t", "ja3_hash": "68f4a97112f2c9232a3d93d939cf94d6", "ja3_variant_count": 3, "ja3_variants": [ "68f4a97112f2c9232a3d93d939cf94d6", "3f5e542f4208e1262af58c68f7aac5e0", "c5c2cbb78e7fde0f711db401fe6f2146" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_8f1a84465d36", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "8f1a84465d36", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-23-10-51764-18-27-45-17613-0-65037-16-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788891160, "last_seen": 1790941893, "transport": "t", "ja3_hash": "e01cbbe3950459829a16360aecb7659e", "ja3_variant_count": 2, "ja3_variants": [ "e01cbbe3950459829a16360aecb7659e", "4a50c8d2570a53ff7318f34f0e29a3f2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_9946448ebb66", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "9946448ebb66", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-13-0-43-23-10-51764-5-65037-16-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790124043, "last_seen": 1790124043, "transport": "t", "ja3_hash": "774426caa5c1a92eeecfe0d0ea5e1e0c", "ja3_variant_count": 1, "ja3_variants": [ "774426caa5c1a92eeecfe0d0ea5e1e0c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_99e3259a919e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "99e3259a919e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-0-13-18-45-16-27-5-23-51764-43-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789552176, "last_seen": 1789552176, "transport": "t", "ja3_hash": "88c81a0f108fad1796100a016ca0086a", "ja3_variant_count": 1, "ja3_variants": [ "88c81a0f108fad1796100a016ca0086a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_9f508d7910ef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "9f508d7910ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-43-18-11-13-10-45-17613-51764-23-65037-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788858759, "last_seen": 1788858759, "transport": "t", "ja3_hash": "2a198cd172f6d487986fdfbc80a32e3b", "ja3_variant_count": 1, "ja3_variants": [ "2a198cd172f6d487986fdfbc80a32e3b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_a0862cad090b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "a0862cad090b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-51764-35-11-0-43-65037-13-65281-27-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791112534, "last_seen": 1791112534, "transport": "t", "ja3_hash": "c8124abfc8e1a042714c1cfc00432db8", "ja3_variant_count": 1, "ja3_variants": [ "c8124abfc8e1a042714c1cfc00432db8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_afe36b7eeadd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "afe36b7eeadd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-65281-0-17613-35-43-51764-5-23-10-13-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788988732, "last_seen": 1788988732, "transport": "t", "ja3_hash": "47732385445f42764b8bc791c3648151", "ja3_variant_count": 1, "ja3_variants": [ "47732385445f42764b8bc791c3648151" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_b163af02e4cd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "b163af02e4cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-17613-5-35-65281-11-65037-0-16-18-43-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790566125, "last_seen": 1790566125, "transport": "t", "ja3_hash": "eeb353b5b9292916731e323da73564e8", "ja3_variant_count": 1, "ja3_variants": [ "eeb353b5b9292916731e323da73564e8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_b4b5c43cb365", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "b4b5c43cb365", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-16-43-0-27-5-18-65281-65037-23-51764-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791082907, "last_seen": 1791082907, "transport": "t", "ja3_hash": "077c5b77022d3031500aa95d2bf4b85c", "ja3_variant_count": 1, "ja3_variants": [ "077c5b77022d3031500aa95d2bf4b85c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_bffd00849e05", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "bffd00849e05", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-5-35-0-43-18-13-11-16-23-17613-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789024342, "last_seen": 1789024342, "transport": "t", "ja3_hash": "b6be7388031f375de36e72c11e26cb92", "ja3_variant_count": 1, "ja3_variants": [ "b6be7388031f375de36e72c11e26cb92" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_c04f800cd16d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "c04f800cd16d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-18-11-16-43-0-10-65281-23-51764-13-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790168246, "last_seen": 1790168246, "transport": "t", "ja3_hash": "cfc303399977970655d4f87badc5d1ec", "ja3_variant_count": 1, "ja3_variants": [ "cfc303399977970655d4f87badc5d1ec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_c654a80abccf", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "c654a80abccf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-13-27-65037-5-10-11-17613-51764-43-65281-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791170600, "last_seen": 1791170600, "transport": "t", "ja3_hash": "441c18bf87b3fd6d6aa98dae2ac75793", "ja3_variant_count": 1, "ja3_variants": [ "441c18bf87b3fd6d6aa98dae2ac75793" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_c86d06dda369", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "c86d06dda369", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-23-65281-10-45-11-16-0-18-5-43-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790566458, "last_seen": 1790566458, "transport": "t", "ja3_hash": "6b6abc68794670b30a6034190fa6562b", "ja3_variant_count": 1, "ja3_variants": [ "6b6abc68794670b30a6034190fa6562b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_cb1e12ca09f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "cb1e12ca09f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-65037-13-27-18-0-16-23-11-35-5-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789336539, "last_seen": 1789336539, "transport": "t", "ja3_hash": "773b2dc526691a413a6c63eac8d051a4", "ja3_variant_count": 1, "ja3_variants": [ "773b2dc526691a413a6c63eac8d051a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_ce2b3b96fb66", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "ce2b3b96fb66", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-13-5-17613-10-18-0-23-45-65037-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790415877, "last_seen": 1790415877, "transport": "t", "ja3_hash": "54a71b94d8dcf32e6dfab60ab537cb5f", "ja3_variant_count": 1, "ja3_variants": [ "54a71b94d8dcf32e6dfab60ab537cb5f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_cebf58402f4f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "cebf58402f4f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-65281-11-0-5-65037-13-27-16-10-17613-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790038967, "last_seen": 1790038967, "transport": "t", "ja3_hash": "6ffe7445d2975dbc085007bbf80ab20d", "ja3_variant_count": 1, "ja3_variants": [ "6ffe7445d2975dbc085007bbf80ab20d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d1ba522d23d4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d1ba522d23d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-11-43-23-45-17613-16-27-65037-51764-10-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788894760, "last_seen": 1788894760, "transport": "t", "ja3_hash": "09546c084fbb1b3958e9701335ed6cdf", "ja3_variant_count": 1, "ja3_variants": [ "09546c084fbb1b3958e9701335ed6cdf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d34fad65fa15", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d34fad65fa15", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-16-11-5-13-45-18-35-17613-10-65037-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789059648, "last_seen": 1789059648, "transport": "t", "ja3_hash": "62c67e239b1c1b5a39f024dfa09f1b07", "ja3_variant_count": 1, "ja3_variants": [ "62c67e239b1c1b5a39f024dfa09f1b07" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_d46c4404ffc6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "d46c4404ffc6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-45-11-35-13-0-16-23-65037-17613-5-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790230193, "last_seen": 1790230193, "transport": "t", "ja3_hash": "13556ae46135518c2a276999e4735c31", "ja3_variant_count": 1, "ja3_variants": [ "13556ae46135518c2a276999e4735c31" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_de538a954cf5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "de538a954cf5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-43-35-51764-5-13-65037-16-0-27-65281-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788931107, "last_seen": 1788931107, "transport": "t", "ja3_hash": "fee47ee8a6acf655e9d9f89ad64f538f", "ja3_variant_count": 1, "ja3_variants": [ "fee47ee8a6acf655e9d9f89ad64f538f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_deb1cd3d2020", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "deb1cd3d2020", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-10-13-0-65281-18-45-27-16-17613-11-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789866422, "last_seen": 1789866422, "transport": "t", "ja3_hash": "443b787e83773e178770e2a4f08fd565", "ja3_variant_count": 1, "ja3_variants": [ "443b787e83773e178770e2a4f08fd565" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_e6e3e4481d07", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "e6e3e4481d07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-35-5-51764-16-43-65037-13-18-65281-17613-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790312934, "last_seen": 1790312934, "transport": "t", "ja3_hash": "c5c2f1b8c6c96b33ed3c558465df03ee", "ja3_variant_count": 1, "ja3_variants": [ "c5c2f1b8c6c96b33ed3c558465df03ee" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_ed8858f9260b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "ed8858f9260b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-18-17613-35-10-13-0-43-16-11-65281-23-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789667830, "last_seen": 1789667830, "transport": "t", "ja3_hash": "3ef960c2733464295667a6a0deed1d66", "ja3_variant_count": 1, "ja3_variants": [ "3ef960c2733464295667a6a0deed1d66" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f3afcba22ba9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f3afcba22ba9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-51764-16-5-65037-43-65281-17613-0-18-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791312111, "last_seen": 1791312111, "transport": "t", "ja3_hash": "15c6a05482f7f01de1a4238ead15d900", "ja3_variant_count": 1, "ja3_variants": [ "15c6a05482f7f01de1a4238ead15d900" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_f97c10cc7c6c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f97c10cc7c6c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-35-0-23-16-65281-27-65037-11-13-5-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790779059, "last_seen": 1790779059, "transport": "t", "ja3_hash": "03a3ff07026ac7abf442ffd87840132d", "ja3_variant_count": 1, "ja3_variants": [ "03a3ff07026ac7abf442ffd87840132d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_fea9d9e3b931", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "fea9d9e3b931", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-10-0-23-51764-5-17613-11-65037-43-16-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789654454, "last_seen": 1789654454, "transport": "t", "ja3_hash": "99a47041d2bb91c8806b4787be1fe4d8", "ja3_variant_count": 1, "ja3_variants": [ "99a47041d2bb91c8806b4787be1fe4d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1514h2_8daaf6152771_ff51abce5dce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "ff51abce5dce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-11-17613-35-23-27-51764-0-10-43-16-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788873162, "last_seen": 1788873162, "transport": "t", "ja3_hash": "b234ee5c834c442ab2f2102109901d7a", "ja3_variant_count": 1, "ja3_variants": [ "b234ee5c834c442ab2f2102109901d7a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_09c52da4402a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "09c52da4402a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-27-65037-51764-18-17613-65281-0-35-43-5-23-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469410, "last_seen": 1789469410, "transport": "t", "ja3_hash": "a0a4cfc778967a1b0a541f71aad34632", "ja3_variant_count": 1, "ja3_variants": [ "a0a4cfc778967a1b0a541f71aad34632" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_295563cfc3bd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "295563cfc3bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-10-13-45-43-23-65037-0-65281-11-51764-18-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790517365, "last_seen": 1790517365, "transport": "t", "ja3_hash": "2899f07f4bc701562fab119109c4cc6d", "ja3_variant_count": 1, "ja3_variants": [ "2899f07f4bc701562fab119109c4cc6d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_730db0fdce76", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "730db0fdce76", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-27-0-45-11-5-43-65037-17613-65281-35-51764-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789002914, "last_seen": 1789002914, "transport": "t", "ja3_hash": "19a7eebf94abb8782029234930022f40", "ja3_variant_count": 1, "ja3_variants": [ "19a7eebf94abb8782029234930022f40" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_8deda503e862", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "8deda503e862", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-43-27-23-13-65037-17613-65281-10-0-11-5-45-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789906984, "last_seen": 1789906984, "transport": "t", "ja3_hash": "c7fdb27aa93629ce11e0d656b8dc956a", "ja3_variant_count": 1, "ja3_variants": [ "c7fdb27aa93629ce11e0d656b8dc956a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_a4f2a1ba388c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "a4f2a1ba388c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-18-0-10-13-17613-65037-27-43-51764-45-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790436982, "last_seen": 1790436982, "transport": "t", "ja3_hash": "092b9e94dd08cf95f73c51896a5682c5", "ja3_variant_count": 1, "ja3_variants": [ "092b9e94dd08cf95f73c51896a5682c5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_ab471963beb1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "ab471963beb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-17613-65281-11-45-27-5-10-13-18-35-43-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790605457, "last_seen": 1790605457, "transport": "t", "ja3_hash": "dd20f47664d2eb6d726332244b0f5e2c", "ja3_variant_count": 1, "ja3_variants": [ "dd20f47664d2eb6d726332244b0f5e2c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151500_8daaf6152771_be94ad370b21", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151500", "b": "8daaf6152771", "c": "be94ad370b21", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-23-43-17613-51764-65281-0-35-18-10-65037-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790948084, "last_seen": 1791117648, "transport": "t", "ja3_hash": "d163596896729716ee2a4658187781e4", "ja3_variant_count": 2, "ja3_variants": [ "d163596896729716ee2a4658187781e4", "d171b5fb25ff25a1b64fb70b1c5cc1cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_04db9f4cbeef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "04db9f4cbeef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-65037-18-17613-43-51764-65281-11-5-35-13-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789795447, "last_seen": 1789795447, "transport": "t", "ja3_hash": "fb09960f1f920b19659ec2745dad512d", "ja3_variant_count": 1, "ja3_variants": [ "fb09960f1f920b19659ec2745dad512d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_06d0a3ff5c2c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "06d0a3ff5c2c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,45-65037-5-10-11-0-16-65281-13-18-35-43-17613-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788444967, "last_seen": 1789656798, "transport": "t", "ja3_hash": "7e126675ad0ba6cbb7f4f2a037beca20", "ja3_variant_count": 2, "ja3_variants": [ "7e126675ad0ba6cbb7f4f2a037beca20", "bd8ac2d9cc60665f778002237c732c47" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_104436a1aaef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "104436a1aaef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-65281-35-5-10-65037-13-45-0-43-18-51764-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789794961, "last_seen": 1789794961, "transport": "t", "ja3_hash": "5b60c03cd9bec620abe6ecebf9045ff7", "ja3_variant_count": 1, "ja3_variants": [ "5b60c03cd9bec620abe6ecebf9045ff7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_14eeedd17c72", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "14eeedd17c72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-51764-5-23-17613-0-18-16-65037-45-27-43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790905735, "last_seen": 1790905735, "transport": "t", "ja3_hash": "fe66a92a6d0c5f39501c7e0546c794c4", "ja3_variant_count": 1, "ja3_variants": [ "fe66a92a6d0c5f39501c7e0546c794c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_28730066799e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "28730066799e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51764-13-65281-10-0-65037-5-35-16-27-43-17613-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791253985, "last_seen": 1791253985, "transport": "t", "ja3_hash": "4f48bbf04a59e4fda1caa341a0116445", "ja3_variant_count": 1, "ja3_variants": [ "4f48bbf04a59e4fda1caa341a0116445" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_2b66d956728c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "2b66d956728c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-51764-35-65037-13-43-18-11-45-10-65281-23-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789749889, "last_seen": 1789749889, "transport": "t", "ja3_hash": "4107c617b3cb40009aaf25bbc6780047", "ja3_variant_count": 1, "ja3_variants": [ "4107c617b3cb40009aaf25bbc6780047" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_2c016527e42d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "2c016527e42d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-51764-0-27-11-10-23-43-18-65281-16-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791121245, "last_seen": 1791121245, "transport": "t", "ja3_hash": "c9640360017923c9337683255bf8567c", "ja3_variant_count": 1, "ja3_variants": [ "c9640360017923c9337683255bf8567c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_2e8e981ce7c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "2e8e981ce7c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-17613-23-0-43-10-51764-11-16-35-45-27-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791209796, "last_seen": 1791209796, "transport": "t", "ja3_hash": "22d7d82add13ff13e31e1ee9a529443e", "ja3_variant_count": 1, "ja3_variants": [ "22d7d82add13ff13e31e1ee9a529443e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_3241686c8acb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "3241686c8acb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-65037-11-23-43-51764-35-16-5-17613-27-10-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469864, "last_seen": 1789469864, "transport": "t", "ja3_hash": "8583d782e4511ccd016f46d2642720d0", "ja3_variant_count": 1, "ja3_variants": [ "8583d782e4511ccd016f46d2642720d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_32d24de4348b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "32d24de4348b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-23-65281-18-13-10-35-43-5-27-16-51-45-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790663849, "last_seen": 1790663849, "transport": "t", "ja3_hash": "61d332464e05404798912cfff1dd00be", "ja3_variant_count": 1, "ja3_variants": [ "61d332464e05404798912cfff1dd00be" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_3cad8663be4a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "3cad8663be4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-11-35-16-65037-17613-45-43-10-0-5-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790356997, "last_seen": 1790356997, "transport": "t", "ja3_hash": "ae44578bdfb91afae2c82f2c6db04548", "ja3_variant_count": 1, "ja3_variants": [ "ae44578bdfb91afae2c82f2c6db04548" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_4355a8b817cc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "4355a8b817cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-11-45-13-17613-23-65281-65037-10-43-51764-35-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791211808, "last_seen": 1791211808, "transport": "t", "ja3_hash": "67abedd8d4f8b0b26813252bad8883af", "ja3_variant_count": 1, "ja3_variants": [ "67abedd8d4f8b0b26813252bad8883af" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_52a5f3d6f9a2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "52a5f3d6f9a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-5-65281-18-16-10-35-27-17613-13-65037-0-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790940997, "last_seen": 1790940997, "transport": "t", "ja3_hash": "5fbebcd637c0754d353cbf4dd5f43017", "ja3_variant_count": 1, "ja3_variants": [ "5fbebcd637c0754d353cbf4dd5f43017" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_56f664cc71ab", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "56f664cc71ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-65281-35-23-16-0-13-65037-10-43-51764-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790775874, "last_seen": 1790775874, "transport": "t", "ja3_hash": "da418bc8d5e3a769cb7618cc2c1f2519", "ja3_variant_count": 1, "ja3_variants": [ "da418bc8d5e3a769cb7618cc2c1f2519" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_5c616093a437", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "5c616093a437", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65037-17613-23-35-16-0-65281-27-10-43-18-45-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790340578, "last_seen": 1790340578, "transport": "t", "ja3_hash": "bef5c61ff4677dfc8ff6ad7c5628bbe7", "ja3_variant_count": 1, "ja3_variants": [ "bef5c61ff4677dfc8ff6ad7c5628bbe7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_61c29ddb3825", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "61c29ddb3825", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-45-35-23-10-17613-65281-16-18-5-0-43-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789391192, "last_seen": 1789391192, "transport": "t", "ja3_hash": "f1810c440f16649b88923ef24e85919f", "ja3_variant_count": 1, "ja3_variants": [ "f1810c440f16649b88923ef24e85919f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_63b09f26f246", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "63b09f26f246", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-35-43-45-27-13-16-51764-23-11-5-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788508371, "last_seen": 1788508371, "transport": "t", "ja3_hash": "3a11de10d327d7bf41ad91752416bf90", "ja3_variant_count": 1, "ja3_variants": [ "3a11de10d327d7bf41ad91752416bf90" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_69f02df65d98", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "69f02df65d98", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-10-11-51764-0-13-65037-17613-43-65281-18-5-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790320824, "last_seen": 1790320824, "transport": "t", "ja3_hash": "ef0e79678cbebe60ee138683debc2de6", "ja3_variant_count": 1, "ja3_variants": [ "ef0e79678cbebe60ee138683debc2de6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_724be30be121", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "724be30be121", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-43-0-65281-35-16-11-18-23-65037-45-17613-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790878140, "last_seen": 1790878140, "transport": "t", "ja3_hash": "5a78362acdd3ac39a79e766fa8ed13db", "ja3_variant_count": 1, "ja3_variants": [ "5a78362acdd3ac39a79e766fa8ed13db" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_78d0c14139ed", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "78d0c14139ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-34-18-51-43-13-45-28-65037,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790637105, "last_seen": 1790637105, "transport": "t", "ja3_hash": "a785f081e266c36f5f2c976fc5c5d785", "ja3_variant_count": 1, "ja3_variants": [ "a785f081e266c36f5f2c976fc5c5d785" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_7bfca9a91c1b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "7bfca9a91c1b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-17613-65037-18-65281-16-23-45-27-11-0-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788670825, "last_seen": 1788670825, "transport": "t", "ja3_hash": "cca464d9dbc801c9d1fbbf3a43f3c953", "ja3_variant_count": 1, "ja3_variants": [ "cca464d9dbc801c9d1fbbf3a43f3c953" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_824e585b2b31", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "824e585b2b31", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-51764-13-35-17613-65037-10-23-65281-11-43-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788514918, "last_seen": 1788514918, "transport": "t", "ja3_hash": "e48aa80d4e5847599287db8ec1621c92", "ja3_variant_count": 1, "ja3_variants": [ "e48aa80d4e5847599287db8ec1621c92" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_8b0f009436a4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "8b0f009436a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-45-11-65281-17613-0-23-16-5-65037-43-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790075620, "last_seen": 1791283427, "transport": "t", "ja3_hash": "8cc28d97849b97cbf8df977052f66b33", "ja3_variant_count": 2, "ja3_variants": [ "8cc28d97849b97cbf8df977052f66b33", "f12d2948e19ba4ebae3cdced2e5a5e46" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_8e6441488796", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "8e6441488796", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-16-27-5-45-13-35-10-17613-43-65037-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552180, "last_seen": 1788552180, "transport": "t", "ja3_hash": "fdf7161a20a266023718b1643081a846", "ja3_variant_count": 1, "ja3_variants": [ "fdf7161a20a266023718b1643081a846" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_90647d171d49", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "90647d171d49", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-65037-43-0-13-35-45-65281-51764-18-27-5-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791225966, "last_seen": 1791225966, "transport": "t", "ja3_hash": "9a322690be5675d83a517d9d05a3584b", "ja3_variant_count": 1, "ja3_variants": [ "9a322690be5675d83a517d9d05a3584b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_91e7438793ab", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "91e7438793ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-65037-23-35-13-0-16-43-10-45-18-65281-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789269656, "last_seen": 1789269656, "transport": "t", "ja3_hash": "7e4548719290f44da16633e97908be26", "ja3_variant_count": 1, "ja3_variants": [ "7e4548719290f44da16633e97908be26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_9207388eafde", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "9207388eafde", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-45-43-27-17613-5-11-10-35-23-0-16-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790064593, "last_seen": 1790064593, "transport": "t", "ja3_hash": "2d0ce64574006c4540eeda152c530428", "ja3_variant_count": 1, "ja3_variants": [ "2d0ce64574006c4540eeda152c530428" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_968165097b0e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "968165097b0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-43-51764-18-35-0-17613-23-65037-13-65281-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789391192, "last_seen": 1789391192, "transport": "t", "ja3_hash": "b8e19b3849f70511060f16ac35cd46f7", "ja3_variant_count": 1, "ja3_variants": [ "b8e19b3849f70511060f16ac35cd46f7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_9c9bbf113d65", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "9c9bbf113d65", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-65281-16-45-35-27-43-23-11-18-5-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789309286, "last_seen": 1789309286, "transport": "t", "ja3_hash": "e75daf8bcd25df2e013cab0af959ee36", "ja3_variant_count": 1, "ja3_variants": [ "e75daf8bcd25df2e013cab0af959ee36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a04544c6a29b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a04544c6a29b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-65281-45-13-51764-65037-18-43-17613-11-0-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791178096, "last_seen": 1791178096, "transport": "t", "ja3_hash": "750a6ddbb7c73c14bac66beb3244872b", "ja3_variant_count": 1, "ja3_variants": [ "750a6ddbb7c73c14bac66beb3244872b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a54f389dc709", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a54f389dc709", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-0-43-10-27-35-16-17613-65281-13-51764-45-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788816019, "last_seen": 1788816019, "transport": "t", "ja3_hash": "5f1abe5a808aaf9dbb693746ffb76298", "ja3_variant_count": 1, "ja3_variants": [ "5f1abe5a808aaf9dbb693746ffb76298" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_a80335266c50", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a80335266c50", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-0-43-27-18-5-35-11-13-45-10-51764-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789469866, "last_seen": 1789469866, "transport": "t", "ja3_hash": "950981128203ee2f9a67f7e17312fb53", "ja3_variant_count": 1, "ja3_variants": [ "950981128203ee2f9a67f7e17312fb53" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_ac9cb79ee855", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "ac9cb79ee855", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-35-5-65037-51764-45-11-13-43-0-23-17613-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789049851, "last_seen": 1789049851, "transport": "t", "ja3_hash": "4c2278002ec5e9d2b327e0056aac5ef0", "ja3_variant_count": 1, "ja3_variants": [ "4c2278002ec5e9d2b327e0056aac5ef0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_bbebbf6fcd10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "bbebbf6fcd10", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-0-5-18-11-27-10-16-17613-65037-23-13-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789680979, "last_seen": 1789680979, "transport": "t", "ja3_hash": "ab0f71000e2bc4d0949df424981a7dd1", "ja3_variant_count": 1, "ja3_variants": [ "ab0f71000e2bc4d0949df424981a7dd1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_cb5aba928501", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "cb5aba928501", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-51-35-45-0-18-23-65281-43-27-16-5-17613-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789077097, "last_seen": 1789077097, "transport": "t", "ja3_hash": "b339a1596b5acd44b80e69ceb971d132", "ja3_variant_count": 1, "ja3_variants": [ "b339a1596b5acd44b80e69ceb971d132" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_d31ac00a47f5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "d31ac00a47f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51764-10-65281-17613-65037-27-45-13-43-16-35-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791170273, "last_seen": 1791170273, "transport": "t", "ja3_hash": "0814a04e96013210a94278ab81f1c686", "ja3_variant_count": 1, "ja3_variants": [ "0814a04e96013210a94278ab81f1c686" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_e0cddad42026", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "e0cddad42026", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-0-45-16-18-11-27-43-65281-10-65037-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788911283, "last_seen": 1788911283, "transport": "t", "ja3_hash": "d3e92309a0b99467a26ec5e367ce1c72", "ja3_variant_count": 1, "ja3_variants": [ "d3e92309a0b99467a26ec5e367ce1c72" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_e4a07cf5a3ae", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "e4a07cf5a3ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-17613-10-35-11-18-13-43-65037-23-65281-16-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790357008, "last_seen": 1790357008, "transport": "t", "ja3_hash": "90e5c0342f7a7c1408b1b46831a3f8d0", "ja3_variant_count": 1, "ja3_variants": [ "90e5c0342f7a7c1408b1b46831a3f8d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f6d0a1d840c6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f6d0a1d840c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-65281-18-43-45-0-17613-13-10-16-23-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789782400, "last_seen": 1789782400, "transport": "t", "ja3_hash": "e3bcfd13266be31dd0b07eda5d7d2cb0", "ja3_variant_count": 1, "ja3_variants": [ "e3bcfd13266be31dd0b07eda5d7d2cb0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_f7e764339e63", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f7e764339e63", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-51764-10-23-17613-13-27-0-18-5-35-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788595379, "last_seen": 1788595379, "transport": "t", "ja3_hash": "e0657215f5cd73e013625dc810840256", "ja3_variant_count": 1, "ja3_variants": [ "e0657215f5cd73e013625dc810840256" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_fc952a4c9ea0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "fc952a4c9ea0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-23-16-27-35-13-65281-0-65037-43-11-45-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791049984, "last_seen": 1791049984, "transport": "t", "ja3_hash": "2c2047d794a82073d7e9b5f04bd8aad9", "ja3_variant_count": 1, "ja3_variants": [ "2c2047d794a82073d7e9b5f04bd8aad9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_fe64589bb50b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "fe64589bb50b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-11-51764-18-13-23-35-16-5-43-17613-0-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789653430, "last_seen": 1789653430, "transport": "t", "ja3_hash": "4c1e757433dd5c82228500dc3f56553b", "ja3_variant_count": 1, "ja3_variants": [ "4c1e757433dd5c82228500dc3f56553b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_fee7349fb889", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "fee7349fb889", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51764-43-27-65037-65281-23-16-13-45-35-11-0-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790820598, "last_seen": 1790820598, "transport": "t", "ja3_hash": "fe4147c85b75936f2e4ac6151256a67d", "ja3_variant_count": 1, "ja3_variants": [ "fe4147c85b75936f2e4ac6151256a67d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1515h2_8daaf6152771_ff5ce3736216", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "ff5ce3736216", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-27-5-17613-43-10-65281-13-16-0-65037-45-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789980352, "last_seen": 1789980352, "transport": "t", "ja3_hash": "5402c5cb10d66caef73b290d043abd80", "ja3_variant_count": 1, "ja3_variants": [ "5402c5cb10d66caef73b290d043abd80" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_71c124bd0b40", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "71c124bd0b40", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-5-4832-10-23-51764-65037-43-0-45-27-35-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587732, "last_seen": 1789587732, "transport": "t", "ja3_hash": "96d1821550e125bce79220445fc2cdec", "ja3_variant_count": 1, "ja3_variants": [ "96d1821550e125bce79220445fc2cdec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_adb48eee9fdd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "adb48eee9fdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-51764-27-35-45-17613-23-10-11-13-18-5-65037-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790541161, "last_seen": 1790541161, "transport": "t", "ja3_hash": "fa023d32adfff774bc3aebd930d72a8d", "ja3_variant_count": 1, "ja3_variants": [ "fa023d32adfff774bc3aebd930d72a8d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_bf8d9114bb09", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "bf8d9114bb09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-0-17613-23-10-43-27-51764-13-35-65281-45-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789989760, "last_seen": 1789989760, "transport": "t", "ja3_hash": "d22725a5e41a3b68b4f6c058b210a3ea", "ja3_variant_count": 1, "ja3_variants": [ "d22725a5e41a3b68b4f6c058b210a3ea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_c0c477cde423", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "c0c477cde423", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-51764-35-11-17613-10-18-65037-13-27-43-23-0-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789469867, "last_seen": 1791015667, "transport": "t", "ja3_hash": "63a8534476a00547be3439a35ba11283", "ja3_variant_count": 2, "ja3_variants": [ "63a8534476a00547be3439a35ba11283", "39aa9c291432ee40d8ec62345e3a9105" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d151600_8daaf6152771_d9d40f4a71d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d151600", "b": "8daaf6152771", "c": "d9d40f4a71d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51764-18-17613-43-65281-13-35-27-45-5-65037-0-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027374, "last_seen": 1789027374, "transport": "t", "ja3_hash": "3e50db706fd0ff040cdea3b3a8f1dcfc", "ja3_variant_count": 1, "ja3_variants": [ "3e50db706fd0ff040cdea3b3a8f1dcfc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_0840309269b6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "0840309269b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-5-17613-0-51764-23-43-65281-10-27-11-16-35-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789906988, "last_seen": 1789906988, "transport": "t", "ja3_hash": "3e718a2153517706b95ff13287047c87", "ja3_variant_count": 1, "ja3_variants": [ "3e718a2153517706b95ff13287047c87" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_0c586802a5fa", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "0c586802a5fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-16-35-27-65281-17613-51764-43-45-18-23-0-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789658269, "last_seen": 1789658269, "transport": "t", "ja3_hash": "c760de83409b1c0776eba2ed454db043", "ja3_variant_count": 1, "ja3_variants": [ "c760de83409b1c0776eba2ed454db043" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_12b110271bcc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "12b110271bcc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-11-18-35-13-16-51764-27-0-65281-17613-43-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789338151, "last_seen": 1789338151, "transport": "t", "ja3_hash": "a0c67b2ee4edb505e8737ce350d12033", "ja3_variant_count": 1, "ja3_variants": [ "a0c67b2ee4edb505e8737ce350d12033" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_14256baa9601", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "14256baa9601", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-27-43-23-0-45-35-16-5-65281-11-13-51764-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789196277, "last_seen": 1789196277, "transport": "t", "ja3_hash": "c1ce0b127dfb321514ed7e9e857c99f9", "ja3_variant_count": 1, "ja3_variants": [ "c1ce0b127dfb321514ed7e9e857c99f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_18202f497713", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "18202f497713", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-18-17613-0-27-51764-65037-10-35-13-45-43-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790124043, "last_seen": 1790124043, "transport": "t", "ja3_hash": "f2b8d79a4feda9b7f5083dc217bb6a19", "ja3_variant_count": 1, "ja3_variants": [ "f2b8d79a4feda9b7f5083dc217bb6a19" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_1bc2137c6720", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "1bc2137c6720", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-16-65281-27-45-65037-35-0-51764-43-11-10-17613-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790325732, "last_seen": 1790325732, "transport": "t", "ja3_hash": "4291141aefd6893983d7ce1af076dffb", "ja3_variant_count": 1, "ja3_variants": [ "4291141aefd6893983d7ce1af076dffb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_23c0c426964a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "23c0c426964a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-0-65037-13-10-51764-65281-27-11-16-35-18-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790860251, "last_seen": 1790860251, "transport": "t", "ja3_hash": "d0a19c4bd0a1a79ccc09c0c07ea1302f", "ja3_variant_count": 1, "ja3_variants": [ "d0a19c4bd0a1a79ccc09c0c07ea1302f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_27b64e10e4de", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "27b64e10e4de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-27-16-10-51764-13-0-35-65037-18-11-17613-65281-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789353213, "last_seen": 1790360810, "transport": "t", "ja3_hash": "71438ca29b024eaf7636552ca6ce2e60", "ja3_variant_count": 2, "ja3_variants": [ "71438ca29b024eaf7636552ca6ce2e60", "3f761849120cb5fc6db0f2936f47b94a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_479e70ed1a91", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "479e70ed1a91", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-10-0-65281-43-23-13-65037-51764-35-11-27-18-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791017584, "last_seen": 1791017584, "transport": "t", "ja3_hash": "f79c5d0891eb49aef5a0351980e339c4", "ja3_variant_count": 1, "ja3_variants": [ "f79c5d0891eb49aef5a0351980e339c4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_49b3eecc765b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "49b3eecc765b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-27-18-65037-43-13-23-51764-65281-17613-0-16-35-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789196274, "last_seen": 1789196274, "transport": "t", "ja3_hash": "f1193b978f0ea42e24d569118b040e15", "ja3_variant_count": 1, "ja3_variants": [ "f1193b978f0ea42e24d569118b040e15" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_6a83e66a3bc9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "6a83e66a3bc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-16-35-43-17613-23-45-65281-13-11-18-65037-10-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788988734, "last_seen": 1790004398, "transport": "t", "ja3_hash": "90d543426da57670d3ae732d97ff6675", "ja3_variant_count": 2, "ja3_variants": [ "90d543426da57670d3ae732d97ff6675", "dca8c99f6c6bb322088105a5163c4acf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_702a8e37e392", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "702a8e37e392", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-10-43-17613-51764-27-5-18-16-45-65037-23-13-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791197787, "last_seen": 1791197787, "transport": "t", "ja3_hash": "7705e7c0b1b43b6f81f7557d40fedd74", "ja3_variant_count": 1, "ja3_variants": [ "7705e7c0b1b43b6f81f7557d40fedd74" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_757e7cbf1563", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "757e7cbf1563", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-0-16-18-10-11-17613-35-13-51764-45-65037-65281-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790329999, "last_seen": 1790329999, "transport": "t", "ja3_hash": "3bc431f43ef537889e20e36f13a21773", "ja3_variant_count": 1, "ja3_variants": [ "3bc431f43ef537889e20e36f13a21773" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_841ced489e53", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "841ced489e53", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-34-18-51-43-13-45-28-27-65037,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790637105, "last_seen": 1790637105, "transport": "t", "ja3_hash": "a379b7991ba322fd30628d6b2e28256d", "ja3_variant_count": 1, "ja3_variants": [ "a379b7991ba322fd30628d6b2e28256d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_8eab51d747d1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "8eab51d747d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-27-13-5-23-51764-45-11-0-17613-43-65037-16-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791312110, "last_seen": 1791312110, "transport": "t", "ja3_hash": "5609c937c8f91ca40a25ca867c82e09d", "ja3_variant_count": 1, "ja3_variants": [ "5609c937c8f91ca40a25ca867c82e09d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_8f97fa7637ac", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "8f97fa7637ac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-5-0-27-13-45-17613-65037-51764-11-18-10-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790086088, "last_seen": 1790086088, "transport": "t", "ja3_hash": "353a27c6da53e39b4678341c01423ab8", "ja3_variant_count": 1, "ja3_variants": [ "353a27c6da53e39b4678341c01423ab8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_9338e1cc4b02", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "9338e1cc4b02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-11-65037-35-43-5-17613-51764-16-23-18-65281-13-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789488129, "last_seen": 1789488129, "transport": "t", "ja3_hash": "4f36f8d9a53fc8624fb0c08411cf4b1f", "ja3_variant_count": 1, "ja3_variants": [ "4f36f8d9a53fc8624fb0c08411cf4b1f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_9bfd97c2868e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "9bfd97c2868e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-18-51764-35-0-43-5-65037-13-10-16-17613-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789923849, "last_seen": 1789923849, "transport": "t", "ja3_hash": "5ac63dcd51f9c954fcb2638dfc273492", "ja3_variant_count": 1, "ja3_variants": [ "5ac63dcd51f9c954fcb2638dfc273492" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_9e3709048d71", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "9e3709048d71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-13-17613-45-16-35-43-5-10-23-27-65037-65281-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789989766, "last_seen": 1789989766, "transport": "t", "ja3_hash": "f3639708fdc265b4740609159751d3c3", "ja3_variant_count": 1, "ja3_variants": [ "f3639708fdc265b4740609159751d3c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_a13c1e3390d8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a13c1e3390d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-51764-43-18-11-65037-65281-16-23-0-17613-35-13-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789729276, "last_seen": 1790361320, "transport": "t", "ja3_hash": "e9ebfdd723a50547e8584558d83b68cc", "ja3_variant_count": 2, "ja3_variants": [ "e9ebfdd723a50547e8584558d83b68cc", "887f2d33e668ef5ce0e121cc6d3afec5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_a48c93702c46", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a48c93702c46", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-23-16-17613-13-18-51764-0-45-43-65281-10-5-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790959713, "last_seen": 1790959713, "transport": "t", "ja3_hash": "e7c0385c4cda57449e89fa12f61b0144", "ja3_variant_count": 1, "ja3_variants": [ "e7c0385c4cda57449e89fa12f61b0144" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_a4aaaa739397", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a4aaaa739397", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-35-23-13-11-65037-5-43-17613-27-45-0-51764-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788743655, "last_seen": 1788743655, "transport": "t", "ja3_hash": "9d782c00fa959dea4e3d3cc0ce94a65a", "ja3_variant_count": 1, "ja3_variants": [ "9d782c00fa959dea4e3d3cc0ce94a65a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_aa65eb61695f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "aa65eb61695f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-35-13-51764-5-0-43-16-10-65037-45-23-18-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790331191, "last_seen": 1790331191, "transport": "t", "ja3_hash": "1723d3c4a9c10e21d60dbe421212e88b", "ja3_variant_count": 1, "ja3_variants": [ "1723d3c4a9c10e21d60dbe421212e88b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_b204b28ef744", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "b204b28ef744", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-0-16-17613-13-23-51764-43-18-65037-45-10-5-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790512871, "last_seen": 1790512871, "transport": "t", "ja3_hash": "be86fdf0a431d8b42c52b86fde6f23d3", "ja3_variant_count": 1, "ja3_variants": [ "be86fdf0a431d8b42c52b86fde6f23d3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_b3d3ac4dbbfd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "b3d3ac4dbbfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-35-65037-17613-18-13-10-43-65281-5-27-51764-16-23-51,514-4588-24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789387674, "last_seen": 1789387674, "transport": "t", "ja3_hash": "6382a49e55e35731a64fa92e78b9843e", "ja3_variant_count": 1, "ja3_variants": [ "6382a49e55e35731a64fa92e78b9843e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_d109364f852d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "d109364f852d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-17613-10-5-18-16-43-0-13-65037-45-51764-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788441655, "last_seen": 1788441655, "transport": "t", "ja3_hash": "84ab776fcdcef56c079cd6b42ed0546d", "ja3_variant_count": 1, "ja3_variants": [ "84ab776fcdcef56c079cd6b42ed0546d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1516h2_8daaf6152771_eb3f4f7706fd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "eb3f4f7706fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-13-17613-51764-10-35-65281-43-16-45-5-23-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789063162, "last_seen": 1789063162, "transport": "t", "ja3_hash": "31ac1be7a3c60b702ba8ac2abc47e416", "ja3_variant_count": 1, "ja3_variants": [ "31ac1be7a3c60b702ba8ac2abc47e416" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_15cadc52a526", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "15cadc52a526", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-11-51764-23-65037-18-35-4832-0-16-17613-45-27-43-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789292866, "last_seen": 1789292866, "transport": "t", "ja3_hash": "b3323d59c6e9cbf7210cb5a5a185644a", "ja3_variant_count": 1, "ja3_variants": [ "b3323d59c6e9cbf7210cb5a5a185644a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_18cb75aa8097", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "18cb75aa8097", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-0-11-27-51764-13-45-5-16-23-35-65281-4832-17613-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386542, "last_seen": 1789386542, "transport": "t", "ja3_hash": "06c115a014f886cc6819f306ec56eaa3", "ja3_variant_count": 1, "ja3_variants": [ "06c115a014f886cc6819f306ec56eaa3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_29e459b1510e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "29e459b1510e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-43-4832-10-16-11-17613-51764-45-5-35-65281-51-23-13-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789386539, "last_seen": 1789386544, "transport": "t", "ja3_hash": "a6c6c50a7537c9da5ba686248be1c559", "ja3_variant_count": 2, "ja3_variants": [ "a6c6c50a7537c9da5ba686248be1c559", "4e28ae3f3c9df64ec989cf59e31cda1f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_3840b61cd663", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "3840b61cd663", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-35-5-51764-13-17613-10-16-0-27-11-65037-4832-45-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587731, "last_seen": 1789587731, "transport": "t", "ja3_hash": "6c73bea76cfcd383e774cd047cb04c70", "ja3_variant_count": 1, "ja3_variants": [ "6c73bea76cfcd383e774cd047cb04c70" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_4cb6c97dc859", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "4cb6c97dc859", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-11-18-16-65281-10-45-13-17613-35-5-51764-0-27-4832-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386538, "last_seen": 1789386538, "transport": "t", "ja3_hash": "a2d2756263c81df5e1f50ee88e6360f8", "ja3_variant_count": 1, "ja3_variants": [ "a2d2756263c81df5e1f50ee88e6360f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_60dbb3a1db10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "60dbb3a1db10", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-4832-27-45-65281-13-51764-23-16-10-18-43-5-11-35-0-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386540, "last_seen": 1789386540, "transport": "t", "ja3_hash": "4768821ba9983c5ec19f068f8f00c7bc", "ja3_variant_count": 1, "ja3_variants": [ "4768821ba9983c5ec19f068f8f00c7bc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_836209a337de", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "836209a337de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-13-27-10-51764-18-4832-35-23-43-11-17613-65281-0-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386541, "last_seen": 1789386541, "transport": "t", "ja3_hash": "5513bbf28f3c08f69cb81cd48ec79ee4", "ja3_variant_count": 1, "ja3_variants": [ "5513bbf28f3c08f69cb81cd48ec79ee4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_929279cec7b9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "929279cec7b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-18-51764-4832-11-51-45-0-16-23-17613-43-10-27-5-35,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789386544, "last_seen": 1789386544, "transport": "t", "ja3_hash": "a96b38919ec0f977fa1f7bff62cb3358", "ja3_variant_count": 1, "ja3_variants": [ "a96b38919ec0f977fa1f7bff62cb3358" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_cf425ff07b50", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "cf425ff07b50", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-51-18-27-43-4832-5-51764-16-11-10-13-23-17613-45-65281,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789386540, "last_seen": 1789386540, "transport": "t", "ja3_hash": "730031b335277fc1ca60e26f70ad5ded", "ja3_variant_count": 2, "ja3_variants": [ "730031b335277fc1ca60e26f70ad5ded", "bf3d1471d4d944a5764dc240eedf07e4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1517h2_8daaf6152771_e7f01c9c10c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "e7f01c9c10c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-5-43-65281-4832-51764-18-23-16-11-10-45-27-17613-0-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789386539, "last_seen": 1789386541, "transport": "t", "ja3_hash": "774df307cd3553c8cfee2d7746df1061", "ja3_variant_count": 2, "ja3_variants": [ "774df307cd3553c8cfee2d7746df1061", "37d56761e389345daea8322477a1ae80" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1518h2_8daaf6152771_a41cfd0d7ccb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1518h2", "b": "8daaf6152771", "c": "a41cfd0d7ccb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 18, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-51-11-27-65037-65281-16-35-45-51764-10-0-13-18-43-23-17613-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789702385, "last_seen": 1791337475, "transport": "t", "ja3_hash": "ccd4ad80d8146a8c4700cb00124770fd", "ja3_variant_count": 4, "ja3_variants": [ "ccd4ad80d8146a8c4700cb00124770fd", "3742898a5b75ed4e6ae2e0d896fabe1f", "af9a3b50149f6647dc97552be7954261", "b56a0ffe13a878ca16c10f0640a24897" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1519h2_8daaf6152771_b1f7e646b769", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1519h2", "b": "8daaf6152771", "c": "b1f7e646b769", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 19, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-0-43-18-51-27-65281-65037-13-4832-51764-16-17613-45-5-35-23-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790351016, "last_seen": 1790351016, "transport": "t", "ja3_hash": "33bab2def2d70582e947b7127eeabd0a", "ja3_variant_count": 1, "ja3_variants": [ "33bab2def2d70582e947b7127eeabd0a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1610h2_46e7e9700bed_34c01d0633e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1610h2", "b": "46e7e9700bed", "c": "34c01d0633e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-5-10-11-13-35-16-43-51,4588-4587-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 336, "first_seen": 1787509860, "last_seen": 1791290847, "transport": "t", "ja3_hash": "ca63abdbdae85b0332b1032e455bff7a", "ja3_variant_count": 2, "ja3_variants": [ "ca63abdbdae85b0332b1032e455bff7a", "1becc76b28948474472f56d050c36ff0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d161200_ab7c39c05d37_c2e98932a8c7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d161200", "b": "ab7c39c05d37", "c": "c2e98932a8c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4867-4865-4866-157-49200-52393-52392-49196-49191-49199-156-49162-53-49171-49170-49172,5-23-11-10-51-35-18-45-0-65281-43-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790874991, "last_seen": 1790874991, "transport": "t", "ja3_hash": "8608784efde0d076a2d75823445cd76e", "ja3_variant_count": 1, "ja3_variants": [ "8608784efde0d076a2d75823445cd76e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1612h2_bd0db5e96f7f_a96f78ab38f2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1612h2", "b": "bd0db5e96f7f", "c": "a96f78ab38f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-52393-49199-49200-49196-60-52392-49191-49195-156-47-49162-49170-49171,65281-43-51-35-23-17513-45-16-0-11-13-10,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790621982, "last_seen": 1790621982, "transport": "t", "ja3_hash": "74068acf3b96472fce4c18dd03fe1be4", "ja3_variant_count": 1, "ja3_variants": [ "74068acf3b96472fce4c18dd03fe1be4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1613h2_1711a4c0508c_d9f1b18a60e3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1613h2", "b": "1711a4c0508c", "c": "d9f1b18a60e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-255,0-11-10-35-5-16-18-23-13-43-45-51-21,29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789926410, "last_seen": 1789926688, "transport": "t", "ja3_hash": "7c822e5e821268e8bd01b70e9cad0b85", "ja3_variant_count": 1, "ja3_variants": [ "7c822e5e821268e8bd01b70e9cad0b85" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1613h2_381e52ff873f_6067a83c28d3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1613h2", "b": "381e52ff873f", "c": "6067a83c28d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-157-49199-60-49200-49187-49196-52392-52393-49170-49161-47-49171,16-11-35-65281-10-45-13-43-18-17513-0-5-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790798211, "last_seen": 1790798211, "transport": "t", "ja3_hash": "71fe03ee5dce5cb4424d9d454a70b106", "ja3_variant_count": 1, "ja3_variants": [ "71fe03ee5dce5cb4424d9d454a70b106" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1613h2_8b7ed0b7403b_277dd3cf83a4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1613h2", "b": "8b7ed0b7403b", "c": "277dd3cf83a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865-49191-49187-52393-157-52392-49196-49199-156-49200-60-49161-49162-49170,21-11-10-43-51-45-16-0-13-35-5-65281-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 21, "name": "padding", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788700621, "last_seen": 1788700621, "transport": "t", "ja3_hash": "33e7f24650158d46e9a9ff06afe74d01", "ja3_variant_count": 1, "ja3_variants": [ "33e7f24650158d46e9a9ff06afe74d01" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1614h2_9e7ea7ef26e6_5e84a08b8441", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1614h2", "b": "9e7ea7ef26e6", "c": "5e84a08b8441", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-157-52393-60-156-49200-49199-53-49171-10-47-49161-49172,35-11-0-43-17513-16-23-5-65281-10-51-13-18-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788907512, "last_seen": 1788907512, "transport": "t", "ja3_hash": "081ad0458b6b47543b8c744ac402f20f", "ja3_variant_count": 1, "ja3_variants": [ "081ad0458b6b47543b8c744ac402f20f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d171000_5b57614c22b0_56fbe12fd207", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d171000", "b": "5b57614c22b0", "c": "56fbe12fd207", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-52392-49161-49162-49171-49172-156-157-47-53,0-23-65281-10-11-5-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788230183, "last_seen": 1790769852, "transport": "t", "ja3_hash": "c4d9c7fc50e1fd2ebf09e3d9a2a31b33", "ja3_variant_count": 1, "ja3_variants": [ "c4d9c7fc50e1fd2ebf09e3d9a2a31b33" ], "user_agents": { "ZoominfoBot (zoominfobot at zoominfo dot com)": 8 }, "ua_disagreement": false } }, { "hash": "t13d171100_5b57614c22b0_6b891f5cadd1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d171100", "b": "5b57614c22b0", "c": "6b891f5cadd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-52392-49161-49162-49171-49172-156-157-47-53,0-23-65281-10-11-5-13-51-45-43-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1788230180, "last_seen": 1790769851, "transport": "t", "ja3_hash": "33b38c8778b29bc991b5200b6141f35e", "ja3_variant_count": 1, "ja3_variants": [ "33b38c8778b29bc991b5200b6141f35e" ], "user_agents": { "ZoominfoBot (zoominfobot at zoominfo dot com)": 8 }, "ua_disagreement": false } }, { "hash": "t13d1713h2_6c438ad0f6f9_4291a918cdf1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1713h2", "b": "6c438ad0f6f9", "c": "4291a918cdf1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-156-49195-52392-157-49199-49196-60-49187-49200-49171-49170-49161-49172-49162,10-5-23-43-16-45-35-13-11-18-0-65281-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790489610, "last_seen": 1790489610, "transport": "t", "ja3_hash": "d6da9432434aa46fa85043052743adf1", "ja3_variant_count": 1, "ja3_variants": [ "d6da9432434aa46fa85043052743adf1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1713ht_5b57614c22b0_73c8ae8dda93", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1713ht", "b": "5b57614c22b0", "c": "73c8ae8dda93", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 29, "first_seen": 1788548721, "last_seen": 1791262214, "transport": "t", "ja3_hash": "1523504b38f0fae0d881d4b6554aac1b", "ja3_variant_count": 1, "ja3_variants": [ "1523504b38f0fae0d881d4b6554aac1b" ], "user_agents": { "Bun/1.4.2": 25, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OpenCode-User/1.0; +https://opencode.ai": 3, "Bun/1.4.1": 2 }, "ua_disagreement": false } }, { "hash": "t13d1714h1_ab0a1bf427ad_ed8524ea7a97", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d1714h1", "b": "ab0a1bf427ad", "c": "ed8524ea7a97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 14, "alpn": "h1" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1790834753, "last_seen": 1790834754, "transport": "t", "ja3_hash": "ebed420a5a445535c05da9e8349f4e4a", "ja3_variant_count": 1, "ja3_variants": [ "ebed420a5a445535c05da9e8349f4e4a" ], "user_agents": { "KeywordSiteFinder/0.1 (+http://127.0.0.1/)": 3 }, "ua_disagreement": false } }, { "hash": "t13d1810h2_29a2cd9e9f10_4a1f08c76dc1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1810h2", "b": "29a2cd9e9f10", "c": "4a1f08c76dc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-51-57-47-53-10,65281-0-5-10-11-13-35-16-43-51,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509864, "last_seen": 1791290845, "transport": "t", "ja3_hash": "9626b0ce2d7692abf2455051ab4b1b9c", "ja3_variant_count": 1, "ja3_variants": [ "9626b0ce2d7692abf2455051ab4b1b9c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1810h2_b672a73b9056_50fe97754b19", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1810h2", "b": "b672a73b9056", "c": "50fe97754b19", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49199-49196-49187-156-60-49195-49200-52393-157-47-49171-53-49162-49161-10,65281-35-10-43-51-13-16-45-0-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790064867, "last_seen": 1790064867, "transport": "t", "ja3_hash": "08c6bce25f55f7da0df5bee76b238925", "ja3_variant_count": 1, "ja3_variants": [ "08c6bce25f55f7da0df5bee76b238925" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1812h2_2b16edd4e08c_98a1ca769b00", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1812h2", "b": "2b16edd4e08c", "c": "98a1ca769b00", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-156-60-49195-52393-49200-49187-52392-49199-157-49196-49191-53-49162-49170-47,5-23-11-13-0-35-10-65281-51-16-43-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790570072, "last_seen": 1790570072, "transport": "t", "ja3_hash": "0854c96b0697b111cf2801e83f5fc84a", "ja3_variant_count": 1, "ja3_variants": [ "0854c96b0697b111cf2801e83f5fc84a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1813h2_b672a73b9056_5426470b89c9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1813h2", "b": "b672a73b9056", "c": "5426470b89c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865-52393-60-49196-49187-156-49195-49199-157-49200-10-49162-49171-49161-47-53,11-13-5-35-23-51-43-10-45-18-0-65281-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789286597, "last_seen": 1789286597, "transport": "t", "ja3_hash": "a0cc2f1164259fcbc7b4ec6a1d6f0245", "ja3_variant_count": 1, "ja3_variants": [ "a0cc2f1164259fcbc7b4ec6a1d6f0245" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1814h2_29a2cd9e9f10_84f228ded5bd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1814h2", "b": "29a2cd9e9f10", "c": "84f228ded5bd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-51-57-47-53-10,0-23-65281-10-11-35-16-5-51-43-13-45-28-21,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787753286, "last_seen": 1791063133, "transport": "t", "ja3_hash": "b20b44b18b853ef29ab773e921b03422", "ja3_variant_count": 1, "ja3_variants": [ "b20b44b18b853ef29ab773e921b03422" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1814h2_f408b8ac563e_e1cce271c5f5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1814h2", "b": "f408b8ac563e", "c": "e1cce271c5f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4867-49191-49199-49187-157-49196-52392-49195-156-49200-53-10-49170-49171-49161-47-49162,18-45-5-23-65281-16-10-43-0-21-13-51-35-11,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790531382, "last_seen": 1790531382, "transport": "t", "ja3_hash": "a0747e2a74ac157111f961bb91007d9d", "ja3_variant_count": 1, "ja3_variants": [ "a0747e2a74ac157111f961bb91007d9d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1815h2_9c6c53ab7e3e_5c81a89c5e8e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1815h2", "b": "9c6c53ab7e3e", "c": "5c81a89c5e8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-52393-156-49200-49195-49196-49191-49199-157-49187-52392-10-49171-53-47-49162,16-51-35-5-0-18-17513-65281-45-11-43-10-13-21-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790444085, "last_seen": 1790444085, "transport": "t", "ja3_hash": "baf4481939e8c1926fefb9ff9f436c04", "ja3_variant_count": 1, "ja3_variants": [ "baf4481939e8c1926fefb9ff9f436c04" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d191100_0682645293b3_665d9ee1cc2f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d191100", "b": "0682645293b3", "c": "665d9ee1cc2f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-4867-52393-52392-60-49191-49187-156-49196-49195-157-49200-49171-49161-49170-49162-53-10,11-5-0-43-51-35-45-23-10-65281-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789896174, "last_seen": 1789896174, "transport": "t", "ja3_hash": "d5df376c5785942d6228d119912d1454", "ja3_variant_count": 1, "ja3_variants": [ "d5df376c5785942d6228d119912d1454" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1911h2_11bd188f2ca6_bf209d6362ca", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1911h2", "b": "11bd188f2ca6", "c": "bf209d6362ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49200-52393-156-49187-49196-52392-49199-157-49191-47-49171-53-49161-49170-49162,51-10-35-0-17513-13-16-11-45-65281-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790275201, "last_seen": 1790275201, "transport": "t", "ja3_hash": "dc3c6e33f4beab9abb8d30a687a70641", "ja3_variant_count": 1, "ja3_variants": [ "dc3c6e33f4beab9abb8d30a687a70641" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d1913h2_81b38ba04ab7_661bee32bcd9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d1913h2", "b": "81b38ba04ab7", "c": "661bee32bcd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865-49191-156-52393-49196-157-60-49195-49200-49187-49162-47-10-49170-49171-53-49172,23-5-21-10-0-35-45-51-11-43-16-65281-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789754533, "last_seen": 1789754533, "transport": "t", "ja3_hash": "0a6d051b99c01f19a7d0512d993d9e71", "ja3_variant_count": 1, "ja3_variants": [ "0a6d051b99c01f19a7d0512d993d9e71" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2011h2_d71cdf2c13a7_70bf55093985", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2011h2", "b": "d71cdf2c13a7", "c": "70bf55093985", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-157-49187-49195-49200-52393-49196-60-52392-49199-156-49170-53-49172-47-49171-10-49162,13-11-23-35-5-43-16-45-51-10-0,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789216356, "last_seen": 1789216356, "transport": "t", "ja3_hash": "d5f9c01689f6c575b43c0c0d37ee12a1", "ja3_variant_count": 1, "ja3_variants": [ "d5f9c01689f6c575b43c0c0d37ee12a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2014h2_a09f3c656075_cbe3c5c47ebd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d2014h2", "b": "a09f3c656075", "c": "cbe3c5c47ebd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-41,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789703753, "last_seen": 1789703753, "transport": "t", "ja3_hash": "7afab366a384524b5f6e3f1fdf084ed6", "ja3_variant_count": 1, "ja3_variants": [ "7afab366a384524b5f6e3f1fdf084ed6" ], "user_agents": { "dp-discover/1.0 (+https://godigitalpigeon.com/bot)": 1 }, "ua_disagreement": false } }, { "hash": "t13d2015h2_17e9a8af7860_380c79957f8f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2015h2", "b": "17e9a8af7860", "c": "380c79957f8f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-157-52392-52393-49199-49187-49195-49191-60-156-49196-49161-49172-49162-53-49171-10-47,16-5-11-13-51-35-18-21-17513-45-10-65281-43-23-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789761442, "last_seen": 1789761442, "transport": "t", "ja3_hash": "8617543f4d007d9a954d5c8d60e9c290", "ja3_variant_count": 1, "ja3_variants": [ "8617543f4d007d9a954d5c8d60e9c290" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d210800_bb0fcf8f19ae_565c6736bc0c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d210800", "b": "bb0fcf8f19ae", "c": "565c6736bc0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-4868-4869-49195-49199-49196-49200-52393-52392-49171-49172-158-159-156-157-47-53-10-255,0-23-35-13-11-10-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788868027, "last_seen": 1788868027, "transport": "t", "ja3_hash": "c5aab6de2edb73d37015a409db665fe2", "ja3_variant_count": 1, "ja3_variants": [ "c5aab6de2edb73d37015a409db665fe2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2111h2_27eb464290be_7e6ea3086605", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2111h2", "b": "27eb464290be", "c": "7e6ea3086605", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-52392-49195-52393-49187-49191-157-60-156-49199-49172-49161-49171-49170-10-47-53-49162,35-0-45-23-10-51-43-16-5-13-11,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789817890, "last_seen": 1789817890, "transport": "t", "ja3_hash": "e2d31475c912f74dc5757d6aa837ed39", "ja3_variant_count": 1, "ja3_variants": [ "e2d31475c912f74dc5757d6aa837ed39" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d211200_cbb8954facf6_8a58e916c4e1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d211200", "b": "cbb8954facf6", "c": "8a58e916c4e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4867-4866-4865-49195-49196-49187-52392-52393-157-49199-49200-156-60-10-49170-49172-49161-49171-53-47-49162,18-10-35-0-11-23-5-45-51-65281-43-13,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789808841, "last_seen": 1789808841, "transport": "t", "ja3_hash": "b8a131b22b910f60364b3009eee2c432", "ja3_variant_count": 1, "ja3_variants": [ "b8a131b22b910f60364b3009eee2c432" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2112h2_ec0dba2c1a22_6fccd2e4d827", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2112h2", "b": "ec0dba2c1a22", "c": "6fccd2e4d827", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49191-52392-49187-156-49200-49199-49196-157-60-49195-47-10-49171-49170-49172-49162-49161-53,10-45-5-13-16-23-43-11-0-35-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789015943, "last_seen": 1789015943, "transport": "t", "ja3_hash": "8eb8cb5d2ea13e1c6ca30f14c621a98f", "ja3_variant_count": 1, "ja3_variants": [ "8eb8cb5d2ea13e1c6ca30f14c621a98f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2113h2_84d092389717_687dbf40044d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2113h2", "b": "84d092389717", "c": "687dbf40044d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 21, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-52392-49191-49195-49199-156-157-49196-60-49187-49200-52393-10-49171-47-49170-49161-53-49172,43-65281-11-16-13-23-35-51-45-5-10-21-0,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789745997, "last_seen": 1789745997, "transport": "t", "ja3_hash": "27015a42021824a4d620602e8187312e", "ja3_variant_count": 1, "ja3_variants": [ "27015a42021824a4d620602e8187312e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2212h2_231e334592e8_ce35c396a636", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d2212h2", "b": "231e334592e8", "c": "ce35c396a636", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-16-51-49-23-65281-45-41,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 7, "first_seen": 1789223338, "last_seen": 1790292069, "transport": "t", "ja3_hash": "2470f363b30ea74adfde345b4e84a7b8", "ja3_variant_count": 1, "ja3_variants": [ "2470f363b30ea74adfde345b4e84a7b8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 431 }, "ua_disagreement": false } }, { "hash": "t13d2309h2_bc6434d430c8_2977e3beeb43", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2309h2", "b": "bc6434d430c8", "c": "2977e3beeb43", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 23, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-4868-4869-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-158-159-156-157-47-53-10-255,0-23-13-11-10-43-16-45-51,29-23-24-25-256,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 123, "first_seen": 1787558092, "last_seen": 1791358815, "transport": "t", "ja3_hash": "133e24b7641cba6242249229374d88fb", "ja3_variant_count": 3, "ja3_variants": [ "133e24b7641cba6242249229374d88fb", "8d2da38d73b3904ef23dc62220d682be", "b3278df1e4d901e1ffd85ce6f09e6931" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2410h2_d7cd690ac7b2_4e19d925c509", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2410h2", "b": "d7cd690ac7b2", "c": "4e19d925c509", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 24, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-4869-4868-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-255,0-11-10-35-16-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 16, "first_seen": 1790755300, "last_seen": 1790755365, "transport": "t", "ja3_hash": "1506c3f77a3ada5d4d4482a218e2b752", "ja3_variant_count": 1, "ja3_variants": [ "1506c3f77a3ada5d4d4482a218e2b752" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d241100_df98b6d6dfe4_5e24af367e18", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d241100", "b": "df98b6d6dfe4", "c": "5e24af367e18", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 24, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49187-49191-49188-49192-49161-49171-49162-49172-156-157-60-61-47-53-255,0-11-10-35-5-22-23-13-43-45-51,29-23-24-25-30,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1791353988, "last_seen": 1791353992, "transport": "t", "ja3_hash": "77ca12fa3dda1e49dccae157f2e2c73d", "ja3_variant_count": 1, "ja3_variants": [ "77ca12fa3dda1e49dccae157f2e2c73d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d251100_b78ed14e2fd0_4ecd95ca9718", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d251100", "b": "b78ed14e2fd0", "c": "4ecd95ca9718", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1788460419, "last_seen": 1791178645, "transport": "t", "ja3_hash": "e462a2d49ed929ffb9992303209802d1", "ja3_variant_count": 1, "ja3_variants": [ "e462a2d49ed929ffb9992303209802d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2610h2_2802a3db6c62_af16a61e292d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d2610h2", "b": "2802a3db6c62", "c": "af16a61e292d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-5-10-11-13-13172-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 112, "first_seen": 1787509863, "last_seen": 1791290849, "transport": "t", "ja3_hash": "8a4db2db564bf8abeee77aa435a9a1d8", "ja3_variant_count": 1, "ja3_variants": [ "8a4db2db564bf8abeee77aa435a9a1d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d291200_dc38afafcfec_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d291200", "b": "dc38afafcfec", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4867-4866-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-27,4588-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791303625, "last_seen": 1791303625, "transport": "t", "ja3_hash": "9ac6e367fd9ad888b93ac39bd1ca54d9", "ja3_variant_count": 1, "ja3_variants": [ "9ac6e367fd9ad888b93ac39bd1ca54d9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d2912h2_723694b0fccc_62e135c949f9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d2912h2", "b": "723694b0fccc", "c": "62e135c949f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,11-0-65281-22-16-23-10-5-43-28-13-51,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789619502, "last_seen": 1790226039, "transport": "t", "ja3_hash": "3684b2a2e950de8fee4b496da097468d", "ja3_variant_count": 3, "ja3_variants": [ "3684b2a2e950de8fee4b496da097468d", "530ee99d727e4a08ffdee109609239d9", "eb5226ca4ca04d14584126cab970fca3" ], "user_agents": { "git/2.43.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d291300_723694b0fccc_610fde5e45f0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d291300", "b": "723694b0fccc", "c": "610fde5e45f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,5-10-11-13-35-51-43-49-65281-0-45-28-21,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1790158132, "last_seen": 1790976661, "transport": "t", "ja3_hash": "bb4f9fef542ff6b4b29aa653bf0c1d31", "ja3_variant_count": 1, "ja3_variants": [ "bb4f9fef542ff6b4b29aa653bf0c1d31" ], "user_agents": { "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)": 5 }, "ua_disagreement": false } }, { "hash": "t13d2914h2_723694b0fccc_eb2f5f0023c9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d2914h2", "b": "723694b0fccc", "c": "eb2f5f0023c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,16-35-13-45-28-23-43-51-22-65281-5-11-0-10,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789619442, "last_seen": 1790093975, "transport": "t", "ja3_hash": "a02adf7c049910f605f0faa0ee0fa1d6", "ja3_variant_count": 2, "ja3_variants": [ "a02adf7c049910f605f0faa0ee0fa1d6", "fbbbf3eae98b87ab83c60196bcd7daea" ], "user_agents": { "git/2.53.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d301000_1d37bd780c83_f6ff4d51d997", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d301000", "b": "1d37bd780c83", "c": "f6ff4d51d997", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-10-35-22-23-13-43-45-51,517,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 517, "name": "517 (0x0205)", "known": false } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791337042, "last_seen": 1791337042, "transport": "t", "ja3_hash": "065b4eb526b155620f8ea26a9aa6e28f", "ja3_variant_count": 1, "ja3_variants": [ "065b4eb526b155620f8ea26a9aa6e28f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d301100_128a2ad15645_dd22a05640e6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d301100", "b": "128a2ad15645", "c": "dd22a05640e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-162-49191-49187-49171-49161-49192-49188-49172-49162-103-51-64-107-56-57-156-157-60-61-47-53-255,0-11-10-35-5-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790649072, "last_seen": 1790649072, "transport": "t", "ja3_hash": "5483ee2193748cf7906d75aa019a1766", "ja3_variant_count": 1, "ja3_variants": [ "5483ee2193748cf7906d75aa019a1766" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d301100_1d37bd780c83_270ffd6f0af9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d301100", "b": "1d37bd780c83", "c": "270ffd6f0af9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-10-35-22-23-13-43-45-51-27,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 7, "first_seen": 1789129672, "last_seen": 1791337042, "transport": "t", "ja3_hash": "504f4b612cfb4114ccc67729d387723b", "ja3_variant_count": 6, "ja3_variants": [ "504f4b612cfb4114ccc67729d387723b", "5b5878450788e4e205987cc5bac6a7f5", "cf0bb6417c404d07a5a267ce260ec315", "4d4d8ffa35f9431ee76b1c88f07644a7", "dbfac660a49f6d27d76ecead0efa11b0", "8754a9d65edc6dcc92719750852762f9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d301100_1d37bd780c83_61f00507a320", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d301100", "b": "1d37bd780c83", "c": "61f00507a320", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790889287, "last_seen": 1790935337, "transport": "t", "ja3_hash": "caf4ec11cce2d9dba8e2575080fc4dfb", "ja3_variant_count": 1, "ja3_variants": [ "caf4ec11cce2d9dba8e2575080fc4dfb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d301300_1d37bd780c83_d0a5066ca47b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d301300", "b": "1d37bd780c83", "c": "d0a5066ca47b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-5-22-23-13-43-45-51-27,4588-4587-4589-25497-25498-12092-12093-570-572-573-512-513-514-580-581-582-12100-12208-516-515-517-12032-12160-29-30-23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 25498, "name": "25498 (0x639a)", "known": false }, { "value": 12092, "name": "12092 (0x2f3c)", "known": false }, { "value": 12093, "name": "12093 (0x2f3d)", "known": false }, { "value": 570, "name": "570 (0x023a)", "known": false }, { "value": 572, "name": "572 (0x023c)", "known": false }, { "value": 573, "name": "573 (0x023d)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 580, "name": "580 (0x0244)", "known": false }, { "value": 581, "name": "581 (0x0245)", "known": false }, { "value": 582, "name": "582 (0x0246)", "known": false }, { "value": 12100, "name": "12100 (0x2f44)", "known": false }, { "value": 12208, "name": "12208 (0x2fb0)", "known": false }, { "value": 516, "name": "516 (0x0204)", "known": false }, { "value": 515, "name": "515 (0x0203)", "known": false }, { "value": 517, "name": "517 (0x0205)", "known": false }, { "value": 12032, "name": "12032 (0x2f00)", "known": false }, { "value": 12160, "name": "12160 (0x2f80)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7559, "first_seen": 1787442799, "last_seen": 1791363210, "transport": "t", "ja3_hash": "5bb06b0330d11973e4dc558f5fccd10f", "ja3_variant_count": 4, "ja3_variants": [ "5bb06b0330d11973e4dc558f5fccd10f", "58c0afa1c2a7c2e675a79b81c77a4925", "86e269c013ca22815e1b6af62e63076e", "84e5d38a9a4494313b37f385eeb74ba3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d3013h2_1d37bd780c83_f823e3592142", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d3013h2", "b": "1d37bd780c83", "c": "f823e3592142", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-5-16-23-13-43-45-51-21,29-23-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1791225964, "last_seen": 1791225964, "transport": "t", "ja3_hash": "a6e2d0a4f074bfcd3cc54108a0bad9e6", "ja3_variant_count": 1, "ja3_variants": [ "a6e2d0a4f074bfcd3cc54108a0bad9e6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d3014h2_1d37bd780c83_17ac7a7984ce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d3014h2", "b": "1d37bd780c83", "c": "17ac7a7984ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2187, "first_seen": 1787442806, "last_seen": 1789313140, "transport": "t", "ja3_hash": "11334b3fbd23edf608d61f771bc2f1d6", "ja3_variant_count": 1, "ja3_variants": [ "11334b3fbd23edf608d61f771bc2f1d6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d310700_e8f1e7e78f70_9b05390bb1b0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d310700", "b": "e8f1e7e78f70", "c": "9b05390bb1b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-10-11-13-35-43-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509864, "last_seen": 1791290847, "transport": "t", "ja3_hash": "c28ad0f183cfd790592a25e3dcb9d54b", "ja3_variant_count": 1, "ja3_variants": [ "c28ad0f183cfd790592a25e3dcb9d54b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d310900_e8f1e7e78f70_47d8a05ee563", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d310900", "b": "e8f1e7e78f70", "c": "47d8a05ee563", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-10-35-22-23-13-43-45-51,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788989752, "last_seen": 1788989757, "transport": "t", "ja3_hash": "8c8a5254dca4d8541f62b597efaab2c9", "ja3_variant_count": 1, "ja3_variants": [ "8c8a5254dca4d8541f62b597efaab2c9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d3109h1_e8f1e7e78f70_34f3f84e03b6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d3109h1", "b": "e8f1e7e78f70", "c": "34f3f84e03b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,43-11-10-0-16-13-23-45-51,29-23-30-25-24-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790864532, "last_seen": 1790864532, "transport": "t", "ja3_hash": "22680aae5ebee87bc32c46f5fb9d17fb", "ja3_variant_count": 1, "ja3_variants": [ "22680aae5ebee87bc32c46f5fb9d17fb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d311000_1d947a95fc68_3d8249404ed1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d311000", "b": "1d947a95fc68", "c": "3d8249404ed1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,43-11-10-0-5-13-50-23-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790060938, "last_seen": 1790060938, "transport": "t", "ja3_hash": "64ee152cf8cd400c50d36f94e70c50bc", "ja3_variant_count": 1, "ja3_variants": [ "64ee152cf8cd400c50d36f94e70c50bc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d311100_e8f1e7e78f70_dd22a05640e6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "dd22a05640e6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-5-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1787697744, "last_seen": 1790717120, "transport": "t", "ja3_hash": "46bb4b3029ca544e39e1c0a2783e2de5", "ja3_variant_count": 1, "ja3_variants": [ "46bb4b3029ca544e39e1c0a2783e2de5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_47129f976243", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "47129f976243", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-5-13172-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 13, "first_seen": 1787697745, "last_seen": 1790717120, "transport": "t", "ja3_hash": "27aa226a438f84089010afba37b2351b", "ja3_variant_count": 1, "ja3_variants": [ "27aa226a438f84089010afba37b2351b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d311200_e8f1e7e78f70_8f5ca734410c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d311200", "b": "e8f1e7e78f70", "c": "8f5ca734410c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-158-49188-49192-49187-49191-107-103-49162-49172-49161-49171-57-51-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1789798581, "last_seen": 1790209288, "transport": "t", "ja3_hash": "60f3e2285bc991c380f822c6ac51f947", "ja3_variant_count": 1, "ja3_variants": [ "60f3e2285bc991c380f822c6ac51f947" ], "user_agents": { "Mozilla/5.0 (compatible; Dataprovider.com)": 4 }, "ua_disagreement": false } }, { "hash": "t13d351200_bfa337485184_0670afe6a16d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d351200", "b": "bfa337485184", "c": "0670afe6a16d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790398390, "last_seen": 1790398390, "transport": "t", "ja3_hash": "ad1fc53770976791f020d7f2fc75f81e", "ja3_variant_count": 1, "ja3_variants": [ "ad1fc53770976791f020d7f2fc75f81e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d361200_36d08471d71c_f0d148687978", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d361200", "b": "36d08471d71c", "c": "f0d148687978", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-156-60-47-4866-4867-157-61-53-255-49195-49199-49187-49191-49197-49201-49189-49193-49161-49171-49156-49166-49196-52393-49200-52392-49188-49192-49198-49202-49190-49194-49162-49172-49157-49167,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 25, "first_seen": 1787516560, "last_seen": 1789041998, "transport": "t", "ja3_hash": "99d04075b77af7a09af10580f3c69459", "ja3_variant_count": 1, "ja3_variants": [ "99d04075b77af7a09af10580f3c69459" ], "user_agents": { "Mozilla/5.0 (compatible; Pinterestbot/1.0; +http://www.pinterest.com/bot.html)": 25 }, "ua_disagreement": false } }, { "hash": "t13d361300_6f3f643b658b_78c283992b26", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d361300", "b": "6f3f643b658b", "c": "78c283992b26", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49200-49196-49199-49195-159-158-57-136-51-49172-49169-49171-22-49159-69-19-49161-49162-49160-49170-50-56-68-135-132-53-150-65-5-47-7-10-255,18-0-11-10-35-5-13172-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 12, "first_seen": 1789125197, "last_seen": 1789289591, "transport": "t", "ja3_hash": "d7b8472451a7e80ecf05084d9df3fb1c", "ja3_variant_count": 1, "ja3_variants": [ "d7b8472451a7e80ecf05084d9df3fb1c" ], "user_agents": { "Mozilla/5.0 (compatible; NetcraftSurveyAgent/1.0; +info@netcraft.com)": 12 }, "ua_disagreement": false } }, { "hash": "t13d3613h2_6f3f643b658b_1f097b6bf5de", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d3613h2", "b": "6f3f643b658b", "c": "1f097b6bf5de", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49200-49196-49199-49195-159-158-57-136-51-49172-49169-49171-22-49159-69-19-49161-49162-49160-49170-50-56-68-135-132-53-150-65-5-47-7-10-255,18-0-11-10-35-5-16-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789125247, "last_seen": 1789125247, "transport": "t", "ja3_hash": "a84c55f4a54b924b0b5ec7720ca1770c", "ja3_variant_count": 1, "ja3_variants": [ "a84c55f4a54b924b0b5ec7720ca1770c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d3613ht_018971650b2c_8bf37a09d688", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d3613ht", "b": "018971650b2c", "c": "8bf37a09d688", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-35-16-22-23-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789553820, "last_seen": 1790790455, "transport": "t", "ja3_hash": "f353ae44df6b4c7735fba2dc8cd86fc2", "ja3_variant_count": 1, "ja3_variants": [ "f353ae44df6b4c7735fba2dc8cd86fc2" ], "user_agents": { "Mozilla/5.0 (compatible; SpiderLing; +https://www.sketchengine.eu/crawler/)": 5 }, "ua_disagreement": false } }, { "hash": "t13d3613ht_bcee18a5b459_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d3613ht", "b": "bcee18a5b459", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1789986858, "last_seen": 1790848061, "transport": "t", "ja3_hash": "25b8751f47d0201ac34951cb90bff78e", "ja3_variant_count": 1, "ja3_variants": [ "25b8751f47d0201ac34951cb90bff78e" ], "user_agents": { "Mozilla/5.0 (compatible; DarkMatterBot/1.0; +https://darkmatterux.com/bot)": 9, "FirmableBot/1.0 (domain-check)": 1 }, "ua_disagreement": false } }, { "hash": "t13d450700_d524c25c267f_566b5f938b58", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d450700", "b": "d524c25c267f", "c": "566b5f938b58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 45, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-49196-49195-49200-157-49198-49202-159-163-49199-156-49197-49201-158-162-49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-255,0-5-10-11-13-43-51,23-24-25-9-10-11-12-13-14-22-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509863, "last_seen": 1791290847, "transport": "t", "ja3_hash": "2a0034455153e5151f731d3cd4b381a9", "ja3_variant_count": 1, "ja3_variants": [ "2a0034455153e5151f731d3cd4b381a9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d490700_0d8feac7bc37_df1bb6f20682", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d490700", "b": "0d8feac7bc37", "c": "df1bb6f20682", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4867-4866-4865-52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,43-51-0-11-10-35-13,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790161419, "last_seen": 1790161419, "transport": "t", "ja3_hash": "6de2ec44c1eaa7a8dc77095db71e25cf", "ja3_variant_count": 1, "ja3_variants": [ "6de2ec44c1eaa7a8dc77095db71e25cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d490700_bd868743f55c_566b5f938b58", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d490700", "b": "bd868743f55c", "c": "566b5f938b58", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-52392-157-49198-49202-159-52394-163-49199-156-49197-49201-158-162-49188-49192-61-49190-49194-107-106-49162-49172-53-49157-49167-57-56-49187-49191-60-49189-49193-103-64-49161-49171-47-49156-49166-51-50-255,0-5-10-11-13-43-51,23-24-25-9-10-11-12-13-14-22-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787509865, "last_seen": 1791290846, "transport": "t", "ja3_hash": "6e1c812546420ab8c6d23ef281c1e46b", "ja3_variant_count": 1, "ja3_variants": [ "6e1c812546420ab8c6d23ef281c1e46b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d5213ht_b262b3658495_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d5213ht", "b": "b262b3658495", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 758, "first_seen": 1790130585, "last_seen": 1791055994, "transport": "t", "ja3_hash": "9bf9a924d7e59ffbef05e1f9c85a7bd6", "ja3_variant_count": 1, "ja3_variants": [ "9bf9a924d7e59ffbef05e1f9c85a7bd6" ], "user_agents": { "node": 12571 }, "ua_disagreement": false } }, { "hash": "t13d5214ht_b262b3658495_17ac7a7984ce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d5214ht", "b": "b262b3658495", "c": "17ac7a7984ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 236, "first_seen": 1790130585, "last_seen": 1791055995, "transport": "t", "ja3_hash": "01104274298d6e15023e0291ff3bf3ea", "ja3_variant_count": 1, "ja3_variants": [ "01104274298d6e15023e0291ff3bf3ea" ], "user_agents": { "node": 2219 }, "ua_disagreement": false } }, { "hash": "t13d591000_a33745022dd6_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d591000", "b": "a33745022dd6", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 59, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 16, "first_seen": 1789798599, "last_seen": 1790209620, "transport": "t", "ja3_hash": "398430069e0a8ecfbc8db0778d658d77", "ja3_variant_count": 1, "ja3_variants": [ "398430069e0a8ecfbc8db0778d658d77" ], "user_agents": { "Mozilla/5.0 (compatible; Dataprovider.com)": 16 }, "ua_disagreement": false } }, { "hash": "t13d5912ht_a33745022dd6_cc39e63c105f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d5912ht", "b": "a33745022dd6", "c": "cc39e63c105f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 59, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-16-22-23-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 115, "first_seen": 1787576127, "last_seen": 1791051802, "transport": "t", "ja3_hash": "70cb5ca646080902703ffda87036a5ea", "ja3_variant_count": 1, "ja3_variants": [ "70cb5ca646080902703ffda87036a5ea" ], "user_agents": { "Mozilla/5.0 (compatible; spamcipher-firmographics)": 1, "mcpsee-observatory/0.1.0 (+https://mcpsee.com)": 1, "node": 588 }, "ua_disagreement": false } }, { "hash": "t13d640600_70d83611e2fb_4f7ec8b79132", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13d640600", "b": "70d83611e2fb", "c": "4f7ec8b79132", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 64, "extension_count": 6, "alpn": null } }, "ja3_string": "771,255-4866-4865-4867-4868-4869-49196-49200-49325-49327-52393-52392-49195-49199-49324-49326-159-163-158-162-52394-107-106-103-64-182-149-148-146-49185-49186-49182-49183-61-60-53-47-10-49160-49170-22-19-49155-49165-21-9-49159-49169-49154-49164-5-4-49162-49172-49157-49167-49161-49171-49156-49166-57-56-51-50,51-11-43-10-13-0,29-30-25-24-23-33-32-31,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1790920936, "last_seen": 1790970663, "transport": "t", "ja3_hash": "5620a856db0c94d0c2412b851f872219", "ja3_variant_count": 1, "ja3_variants": [ "5620a856db0c94d0c2412b851f872219" ], "user_agents": { "Mozilla/5.0 (compatible; ListSignalBot/1.0; +https://listsignal.com/bot)": 9 }, "ua_disagreement": false } }, { "hash": "t13d6412ht_0f757fa8abd0_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d6412ht", "b": "0f757fa8abd0", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 64, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1271, "first_seen": 1787442799, "last_seen": 1791347877, "transport": "t", "ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a", "ja3_variant_count": 1, "ja3_variants": [ "917fde1bf3bcb67f961b77b18d9ee14a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d6912hq_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d6912hq", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "hq" } }, "ja3_string": "771,49170-49171-49159-49191-52244-49199-4865-49172-4866-49192-52393-49200-49267-49248-49266-49249-49196-49270-49327-49271-49325-52392-49188-4869-49162-4868-49195-4867-49326-52243-49324-49169-49187-10-49161-47-49160-60-154-49308-196-49312-136-156-190-53-69-61-159-49309-49315-49313-49311-157-107-65-57-186-158-132-49314-192-49310-7-103-4-51-5-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1267, "first_seen": 1787442801, "last_seen": 1791347877, "transport": "t", "ja3_hash": "7f9ae904ef5a8d37a4028ce5c57bc099", "ja3_variant_count": 1, "ja3_variants": [ "7f9ae904ef5a8d37a4028ce5c57bc099" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d6912ht_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d6912ht", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1788743672, "last_seen": 1790588853, "transport": "t", "ja3_hash": "52368c7984e30470fecde4ccbe536874", "ja3_variant_count": 1, "ja3_variants": [ "52368c7984e30470fecde4ccbe536874" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d700700_1d99d8a1b728_9856f0503da6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d700700", "b": "1d99d8a1b728", "c": "9856f0503da6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 70, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49160-49161-49162-49170-49171-49172-49191-49188-49192-49169-49199-49200-49195-49196-49324-49325-49204-49205-49187-49206-49208-49203-49159-49173-49207-49224-49225-49228-49229-49244-49245-49248-49249-49264-49265-49266-49267-49270-49271-49286-49287-49290-49291-49306-49307-49158-49168-49209-49210-49211-87-88-89-90-49174-49175-49176-49177-52393-52392-49328-49329-49330-49331-49326-49327-52396-52243-52244-52248,11-0-13-43-51-65281-10,60909-15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52248, "name": "52248 (0xcc18)", "known": false } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 60909, "name": "60909 (0xeded)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1790161507, "last_seen": 1790678664, "transport": "t", "ja3_hash": "c1160f3f9e70ee88356ce8ad0985d1df", "ja3_variant_count": 1, "ja3_variants": [ "c1160f3f9e70ee88356ce8ad0985d1df" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d731000_613d769af9d7_ac712e70b3b6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d731000", "b": "613d769af9d7", "c": "ac712e70b3b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 73, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49235-49195-49199-158-49326-49324-49314-49310-49244-49248-49234-49188-49192-107-49267-49271-196-49187-49191-103-49266-49270-190-49162-49172-57-136-49161-49171-51-154-69-49159-49169-49160-49170-22-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-150-65-5-10-255,0-11-10-22-23-13-43-45-51-21,23,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789562616, "last_seen": 1789562616, "transport": "t", "ja3_hash": "baa0ce13c28851c288f2ea0798d2f7ce", "ja3_variant_count": 1, "ja3_variants": [ "baa0ce13c28851c288f2ea0798d2f7ce" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d740800_57a946f9b90a_6778c390f8b7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d740800", "b": "57a946f9b90a", "c": "6778c390f8b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 74, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-57-51-49172-49171-53-47-49200-49199-159-158-107-103-52392-52394-157-156-61-60-49191-49192-49229-49228-49221-196-136-190-69-49220-49213-192-132-186-49212-65-154-150-22-49170-10-49169-5-4-21-9-49162-49161-49196-49195-52393-49187-49188-49224-49225-49160-49159-50-56-163-162-106-64-49219-195-135-189-49218-68-153-19-18-255,43-11-10-0-13-23-45-51,29-30-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788833918, "last_seen": 1788933493, "transport": "t", "ja3_hash": "086919a3c1012de1d9ce4dd39c02f67e", "ja3_variant_count": 2, "ja3_variants": [ "086919a3c1012de1d9ce4dd39c02f67e", "2ada28a3c5bb56da6981359ecda88132" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d740800_57a946f9b90a_bb8c20482853", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d740800", "b": "57a946f9b90a", "c": "bb8c20482853", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 74, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49200-49199-159-158-52392-52394-157-156-49192-49172-49191-49171-107-57-103-51-61-60-53-47-49229-49228-49221-196-136-190-69-49220-49213-192-132-186-49212-65-154-150-22-49170-10-49169-5-4-21-9-49196-49195-52393-49188-49187-49162-49161-49224-49225-49160-49159-163-162-106-64-50-56-49219-195-135-189-49218-68-153-19-18-255,43-11-10-0-13-23-45-51,29-30-23-24-25-26-27-28-22-10-9-12-11-14-13-8-7-6-21-20-5-4-19-18-2-3-1-16-17-15,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1789055330, "last_seen": 1790070949, "transport": "t", "ja3_hash": "b1179b4364af89be0558f0772ead2102", "ja3_variant_count": 1, "ja3_variants": [ "b1179b4364af89be0558f0772ead2102" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d990500_7856cd19dfd7_7f4491e7bc3b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d990500", "b": "7856cd19dfd7", "c": "7f4491e7bc3b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 99, "extension_count": 5, "alpn": null } }, "ja3_string": "771,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-71-72-73-74-75-76-77-78-79-80-81-82-83-84-85-86-87-88-89-90-91-92-96-97-98-99-100-101-102-103-104-105-106-107-108-109-128-129-130-131-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-198-199-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-53249-53250-53251-53253-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-52242-52243-52244-52245-52246-52247-52248-52249-52392-52393-52394-52395-52396-52397-52398-5815-5816-5817-5818-253-65413-65415,10-0-13-43-51,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 52242, "name": "52242 (0xcc12)", "known": false }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52246, "name": "52246 (0xcc16)", "known": false }, { "value": 52247, "name": "52247 (0xcc17)", "known": false }, { "value": 52248, "name": "52248 (0xcc18)", "known": false }, { "value": 52249, "name": "52249 (0xcc19)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 65415, "name": "65415 (0xff87)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1790161482, "last_seen": 1790316656, "transport": "t", "ja3_hash": "8d1efd6a6c7e0258f84f569b91b7aef1", "ja3_variant_count": 1, "ja3_variants": [ "8d1efd6a6c7e0258f84f569b91b7aef1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13d990600_7856cd19dfd7_ec5015a3aa28", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13d990600", "b": "7856cd19dfd7", "c": "ec5015a3aa28", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 99, "extension_count": 6, "alpn": null } }, "ja3_string": "771,0-1-2-3-4-5-6-7-8-9-10-11-12-13-14-15-16-17-18-19-20-21-22-23-24-25-26-27-28-29-30-31-32-33-34-35-36-37-38-39-40-41-42-43-44-45-46-47-48-49-50-51-52-53-54-55-56-57-58-59-60-61-62-63-64-65-66-67-68-69-70-71-72-73-74-75-76-77-78-79-80-81-82-83-84-85-86-87-88-89-90-91-92-96-97-98-99-100-101-102-103-104-105-106-107-108-109-128-129-130-131-132-133-134-135-136-137-138-139-140-141-142-143-144-145-146-147-148-149-150-151-152-153-154-155-156-157-158-159-160-161-162-163-164-165-166-167-168-169-170-171-172-173-174-175-176-177-178-179-180-181-182-183-184-185-186-187-188-189-190-191-192-193-194-195-196-197-198-199-4865-4866-4867-4868-4869-49153-49154-49155-49156-49157-49158-49159-49160-49161-49162-49163-49164-49165-49166-49167-49168-49169-49170-49171-49172-49173-49174-49175-49176-49177-49178-49179-49180-49181-49182-49183-49184-49185-49186-49187-49188-49189-49190-49191-49192-49193-49194-49195-49196-49197-49198-49199-49200-49201-49202-49203-49204-49205-49206-49207-49208-49209-49210-49211-53249-53250-53251-53253-49212-49213-49214-49215-49216-49217-49218-49219-49220-49221-49222-49223-49224-49225-49226-49227-49228-49229-49230-49231-49232-49233-49234-49235-49236-49237-49238-49239-49240-49241-49242-49243-49244-49245-49246-49247-49248-49249-49250-49251-49252-49253-49254-49255-49256-49257-49258-49259-49260-49261-49262-49263-49264-49265-49266-49267-49268-49269-49270-49271-49272-49273-49274-49275-49276-49277-49278-49279-49280-49281-49282-49283-49284-49285-49286-49287-49288-49289-49290-49291-49292-49293-49294-49295-49296-49297-49298-49299-49300-49301-49302-49303-49304-49305-49306-49307-49308-49309-49310-49311-49312-49313-49314-49315-49316-49317-49318-49319-49320-49321-49322-49323-49324-49325-49326-49327-49328-49329-49330-49331-52242-52243-52244-52245-52246-52247-52248-52249-52392-52393-52394-52395-52396-52397-52398-5815-5816-5817-5818-253-65413-65415,10-0-13-43-51-65281,15-16-17-18-19-20-21-22-23-24-25-1-2-3-4-5-6-7-8-9-10-11-12-13-14-29-30-41-26-27-28-31-32-33-256-257-258-259-260-512-513-514-4585-4586-4587-4588-4589-4590,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 198, "name": "198 (0x00c6)", "known": false }, { "value": 199, "name": "199 (0x00c7)", "known": false }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 52242, "name": "52242 (0xcc12)", "known": false }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52246, "name": "52246 (0xcc16)", "known": false }, { "value": 52247, "name": "52247 (0xcc17)", "known": false }, { "value": 52248, "name": "52248 (0xcc18)", "known": false }, { "value": 52249, "name": "52249 (0xcc19)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 5815, "name": "5815 (0x16b7)", "known": false }, { "value": 5816, "name": "5816 (0x16b8)", "known": false }, { "value": 5817, "name": "5817 (0x16b9)", "known": false }, { "value": 5818, "name": "5818 (0x16ba)", "known": false }, { "value": 253, "name": "253 (0x00fd)", "known": false }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 65415, "name": "65415 (0xff87)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 4585, "name": "4585 (0x11e9)", "known": false }, { "value": 4586, "name": "4586 (0x11ea)", "known": false }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 4590, "name": "4590 (0x11ee)", "known": false } ], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1790232667, "last_seen": 1790678630, "transport": "t", "ja3_hash": "d11146ece09a1c32dc44de85eb87a92e", "ja3_variant_count": 1, "ja3_variants": [ "d11146ece09a1c32dc44de85eb87a92e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i0306ht_55b375c5d22e_c4674d4f439d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i0306ht", "b": "55b375c5d22e", "c": "c4674d4f439d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 6, "alpn": "ht" } }, "ja3_string": "771,4867-4866-4865,43-10-51-13-16-58,23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 205, "first_seen": 1787497600, "last_seen": 1791308061, "transport": "t", "ja3_hash": "65bd2d0dd766e11ea0569bd103303509", "ja3_variant_count": 1, "ja3_variants": [ "65bd2d0dd766e11ea0569bd103303509" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i0308h2_55b375c5d22e_f150a32a4db6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i0308h2", "b": "55b375c5d22e", "c": "f150a32a4db6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865,43-10-51-13-16-45-28-58,25-24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "curves": [ { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 104, "first_seen": 1787497563, "last_seen": 1791307994, "transport": "t", "ja3_hash": "d76e2a7867d2a625c20b11ae64315363", "ja3_variant_count": 1, "ja3_variants": [ "d76e2a7867d2a625c20b11ae64315363" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i0311h2_55b375c5d22e_efd07e248838", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i0311h2", "b": "55b375c5d22e", "c": "efd07e248838", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865,43-10-51-13-16-27-28-17513-49-45-58,24-23-29,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [] }, "observed": { "count": 103, "first_seen": 1787497536, "last_seen": 1791307960, "transport": "t", "ja3_hash": "a36685c7f7e7d3f87710730524787b6f", "ja3_variant_count": 1, "ja3_variants": [ "a36685c7f7e7d3f87710730524787b6f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1010h1_61a7ad8aa9b6_0b042736a1c5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1010h1", "b": "61a7ad8aa9b6", "c": "0b042736a1c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-5-13-16-43-11-10-35-51-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1790471146, "last_seen": 1790603098, "transport": "t", "ja3_hash": "144ea81e7cc863fbcb10f25310bc65ba", "ja3_variant_count": 8, "ja3_variants": [ "144ea81e7cc863fbcb10f25310bc65ba", "857ebfabfe547f455e77f6a3cd3eb60e", "90ddd77a4c52a748e5351ebc60581601", "e824c130812c0c84eadc1f8cf14aa7f2", "dbe1669ab93bda52bb628baed63ad621", "132d48dbd3200cfe83c274d02e8e0efe", "c62ca8c17e4561258e7e7dfe15e5d0d4", "66bd0567abf94346c7319cdc158e6f36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1010h1_61a7ad8aa9b6_130134e41230", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13i1010h1", "b": "61a7ad8aa9b6", "c": "130134e41230", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-11-13-45-51-10-23-35-43-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1790503858, "last_seen": 1791126104, "transport": "t", "ja3_hash": "8283d6cd32067ef1810be29429dcd5cd", "ja3_variant_count": 9, "ja3_variants": [ "8283d6cd32067ef1810be29429dcd5cd", "28d4312ac10dfee0a4be706038dc662d", "ce4f81c7ff89b2f8d863ccc15ca8218e", "ae6cc80edbe702ffc7c360ffe7accea4", "0a1dac8904b640aaef2a011f4b383954", "1a64def184355d3b84a0dfcdedff2d11", "56942c34e792d06a5c9e77de7a47f613", "3be973d079d62a1064f171f1f22ba112", "f04b22401af3f3c195ce1e6dc2222609" ], "user_agents": { "odin-scanner/0.4": 9 }, "ua_disagreement": false } }, { "hash": "t13i1010h1_61a7ad8aa9b6_4cbc7d17bd20", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13i1010h1", "b": "61a7ad8aa9b6", "c": "4cbc7d17bd20", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-23-43-5-10-51-11-45-13-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791016034, "last_seen": 1791016034, "transport": "t", "ja3_hash": "6dc026c9edebf40d587990c8ad959ab5", "ja3_variant_count": 1, "ja3_variants": [ "6dc026c9edebf40d587990c8ad959ab5" ], "user_agents": { "odin-scanner/0.4": 1 }, "ua_disagreement": false } }, { "hash": "t13i1010h2_61a7ad8aa9b6_881d5e41be7c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Presented a User-Agent we cannot attribute to a known client.", "ja4": { "a": "t13i1010h2", "b": "61a7ad8aa9b6", "c": "881d5e41be7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-51-5-10-16-23-43-35-45-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790577645, "last_seen": 1790577645, "transport": "t", "ja3_hash": "d03abeb6c04ed7038c2856faaeca6686", "ja3_variant_count": 1, "ja3_variants": [ "d03abeb6c04ed7038c2856faaeca6686" ], "user_agents": { "Mozilla/5.0 (compatible; ip_scanner/1.0)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1504h2_8daaf6152771_3df7d66bf4e1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1504h2", "b": "8daaf6152771", "c": "3df7d66bf4e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789366470, "last_seen": 1789366470, "transport": "t", "ja3_hash": "0d60a763717a07dfdafe0ea0bc1bf6ff", "ja3_variant_count": 1, "ja3_variants": [ "0d60a763717a07dfdafe0ea0bc1bf6ff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_2a184be5a224", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "2a184be5a224", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-43-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790737802, "last_seen": 1790737802, "transport": "t", "ja3_hash": "5f2c537db7fc560a4825c2c21dac191a", "ja3_variant_count": 1, "ja3_variants": [ "5f2c537db7fc560a4825c2c21dac191a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_46992f46ec4a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "46992f46ec4a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-43-13-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202578, "last_seen": 1790202578, "transport": "t", "ja3_hash": "f6dbdc368c0422de73031da382efb875", "ja3_variant_count": 1, "ja3_variants": [ "f6dbdc368c0422de73031da382efb875" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_57e7de9f1d95", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "57e7de9f1d95", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-16-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790929014, "last_seen": 1790929014, "transport": "t", "ja3_hash": "60e625251d3385c4d9f7a9a1f47e86f1", "ja3_variant_count": 1, "ja3_variants": [ "60e625251d3385c4d9f7a9a1f47e86f1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_7e8e1ea23386", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "7e8e1ea23386", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-13-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791040176, "last_seen": 1791040176, "transport": "t", "ja3_hash": "ed524b12751e72ee611a9a30734cf7bc", "ja3_variant_count": 1, "ja3_variants": [ "ed524b12751e72ee611a9a30734cf7bc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_8dab02b44749", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "8dab02b44749", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789654100, "last_seen": 1789654100, "transport": "t", "ja3_hash": "6a77f8224661253c4b10abcc02ea97e1", "ja3_variant_count": 1, "ja3_variants": [ "6a77f8224661253c4b10abcc02ea97e1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_9a13ff371813", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "9a13ff371813", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-43-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790357005, "last_seen": 1790357005, "transport": "t", "ja3_hash": "7017edd81cdda9088fff8b6430c55cbc", "ja3_variant_count": 1, "ja3_variants": [ "7017edd81cdda9088fff8b6430c55cbc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_a953251d7ea5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "a953251d7ea5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-45-43-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789984924, "last_seen": 1789984924, "transport": "t", "ja3_hash": "3b49449e270e07497eb75da7f228eaf6", "ja3_variant_count": 1, "ja3_variants": [ "3b49449e270e07497eb75da7f228eaf6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_c0347ed14505", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "c0347ed14505", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791253976, "last_seen": 1791253976, "transport": "t", "ja3_hash": "0a65455baaf2623201c1e8ef8626687c", "ja3_variant_count": 1, "ja3_variants": [ "0a65455baaf2623201c1e8ef8626687c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_d260895d0103", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "d260895d0103", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-27-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789704608, "last_seen": 1790577937, "transport": "t", "ja3_hash": "b4e20206f3d24ee3ab579037953a3b84", "ja3_variant_count": 2, "ja3_variants": [ "b4e20206f3d24ee3ab579037953a3b84", "914fe4b02a3fa3670d4ffb7e8fbba207" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_db6878ad9092", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "db6878ad9092", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-43-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790568113, "last_seen": 1790568113, "transport": "t", "ja3_hash": "f9f0bdbdb5c9eb078771b572f438694d", "ja3_variant_count": 1, "ja3_variants": [ "f9f0bdbdb5c9eb078771b572f438694d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_dbb23eabd7ce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "dbb23eabd7ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-51764-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790519565, "last_seen": 1790519565, "transport": "t", "ja3_hash": "76b0128653402a1eba18a78383acf2b7", "ja3_variant_count": 1, "ja3_variants": [ "76b0128653402a1eba18a78383acf2b7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_e9201eeed93e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "e9201eeed93e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-16-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790045614, "last_seen": 1790045614, "transport": "t", "ja3_hash": "514821cca26b5807116d47dbe8373a15", "ja3_variant_count": 1, "ja3_variants": [ "514821cca26b5807116d47dbe8373a15" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_f749701cb9f0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "f749701cb9f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-16-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790128880, "last_seen": 1790128880, "transport": "t", "ja3_hash": "731dcc16de6bc5b5a463cc8a642cadaf", "ja3_variant_count": 1, "ja3_variants": [ "731dcc16de6bc5b5a463cc8a642cadaf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1505h2_8daaf6152771_ff2a414e0694", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1505h2", "b": "8daaf6152771", "c": "ff2a414e0694", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-23-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789218772, "last_seen": 1789218772, "transport": "t", "ja3_hash": "e3da5653aa9a1f3200c58920cef47200", "ja3_variant_count": 1, "ja3_variants": [ "e3da5653aa9a1f3200c58920cef47200" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_3eb18aeec323", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "3eb18aeec323", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-16-43-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788442019, "last_seen": 1788442019, "transport": "t", "ja3_hash": "48c5dcb84b561b11a197afe146166153", "ja3_variant_count": 1, "ja3_variants": [ "48c5dcb84b561b11a197afe146166153" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_78fbab140894", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "78fbab140894", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-5-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789923851, "last_seen": 1789923851, "transport": "t", "ja3_hash": "0c360d55bfb45b8c93a83e4c436783c6", "ja3_variant_count": 1, "ja3_variants": [ "0c360d55bfb45b8c93a83e4c436783c6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_88437c8aa2f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "88437c8aa2f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-16-23-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790163839, "last_seen": 1790163839, "transport": "t", "ja3_hash": "d1622b8ae5183504c7bd46dc89eb7aea", "ja3_variant_count": 1, "ja3_variants": [ "d1622b8ae5183504c7bd46dc89eb7aea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_98303a930387", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "98303a930387", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-16-51-45-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790308457, "last_seen": 1790308457, "transport": "t", "ja3_hash": "11d65da33dace0b149d0fea02e2e4455", "ja3_variant_count": 1, "ja3_variants": [ "11d65da33dace0b149d0fea02e2e4455" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_a940fb8f7c10", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "a940fb8f7c10", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51-45-16-65281-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789531335, "last_seen": 1789531335, "transport": "t", "ja3_hash": "602a90470917345d7fe0d1853284268c", "ja3_variant_count": 1, "ja3_variants": [ "602a90470917345d7fe0d1853284268c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_b1d72b4b9139", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "b1d72b4b9139", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-16-51-43-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788912483, "last_seen": 1788912483, "transport": "t", "ja3_hash": "72b9f553b095353738213ebb911c71c8", "ja3_variant_count": 1, "ja3_variants": [ "72b9f553b095353738213ebb911c71c8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_b3a5ef3b7ae2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "b3a5ef3b7ae2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-35-45-16-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789214372, "last_seen": 1789214372, "transport": "t", "ja3_hash": "ce9a82c8badcb70cfa3e1134676fab74", "ja3_variant_count": 1, "ja3_variants": [ "ce9a82c8badcb70cfa3e1134676fab74" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1506h2_8daaf6152771_dc0fbbb9e544", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1506h2", "b": "8daaf6152771", "c": "dc0fbbb9e544", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-23-43-51-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789366304, "last_seen": 1789366304, "transport": "t", "ja3_hash": "5297600f5bc62b52f486d81d0992cc3a", "ja3_variant_count": 1, "ja3_variants": [ "5297600f5bc62b52f486d81d0992cc3a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_0b03179d0d9f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "0b03179d0d9f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-23-45-43-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788508485, "last_seen": 1788508485, "transport": "t", "ja3_hash": "642cc771717143e402967dfc757d88fc", "ja3_variant_count": 1, "ja3_variants": [ "642cc771717143e402967dfc757d88fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_0bcd6d2af923", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "0bcd6d2af923", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-16-27-10-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788535349, "last_seen": 1788535349, "transport": "t", "ja3_hash": "0a6ed87f0fc1798fba7aadc2ec645de3", "ja3_variant_count": 1, "ja3_variants": [ "0a6ed87f0fc1798fba7aadc2ec645de3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_1994fa819c0f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "1994fa819c0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-43-51-27-16-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790340577, "last_seen": 1790340577, "transport": "t", "ja3_hash": "e4fbfb6d50a0846d1e8df80449abc297", "ja3_variant_count": 1, "ja3_variants": [ "e4fbfb6d50a0846d1e8df80449abc297" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_1dadfcf2f95b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "1dadfcf2f95b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-11-13-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789118380, "last_seen": 1789118380, "transport": "t", "ja3_hash": "387527a5dd28baa65467acf5b6707fd3", "ja3_variant_count": 1, "ja3_variants": [ "387527a5dd28baa65467acf5b6707fd3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_30945e89cfc2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "30945e89cfc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-65281-45-16-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791025394, "last_seen": 1791025394, "transport": "t", "ja3_hash": "1ee787565b9bbc21ce578c668574b05b", "ja3_variant_count": 1, "ja3_variants": [ "1ee787565b9bbc21ce578c668574b05b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_346cdd067199", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "346cdd067199", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-65281-13-43-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789027381, "last_seen": 1789027381, "transport": "t", "ja3_hash": "076c3506d857690f9860de4be5792f1a", "ja3_variant_count": 1, "ja3_variants": [ "076c3506d857690f9860de4be5792f1a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_3e36865328f2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "3e36865328f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-51764-13-16-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789015029, "last_seen": 1789015029, "transport": "t", "ja3_hash": "d3509b4d74274b2422c3bdf855e6cef3", "ja3_variant_count": 1, "ja3_variants": [ "d3509b4d74274b2422c3bdf855e6cef3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_3ff929da8650", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "3ff929da8650", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-51-5-17613-43-27-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789740302, "last_seen": 1789740302, "transport": "t", "ja3_hash": "129ea1c18f853d45a748fb31128d83dc", "ja3_variant_count": 1, "ja3_variants": [ "129ea1c18f853d45a748fb31128d83dc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_5a129f0e4836", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "5a129f0e4836", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-16-17613-23-5-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788932410, "last_seen": 1788932410, "transport": "t", "ja3_hash": "819b52a62eca5b6b19c3e70652bfe8b8", "ja3_variant_count": 1, "ja3_variants": [ "819b52a62eca5b6b19c3e70652bfe8b8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_62f180a26051", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "62f180a26051", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-43-65037-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789744527, "last_seen": 1789744527, "transport": "t", "ja3_hash": "e13190080c7ef5454e5ffd8678d64877", "ja3_variant_count": 1, "ja3_variants": [ "e13190080c7ef5454e5ffd8678d64877" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_78a8c4237393", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "78a8c4237393", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-65037-16-17613-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202578, "last_seen": 1790202578, "transport": "t", "ja3_hash": "a832df2686487d0d4e0cdf2911deb9b7", "ja3_variant_count": 1, "ja3_variants": [ "a832df2686487d0d4e0cdf2911deb9b7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_7bffb6c38e59", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "7bffb6c38e59", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-16-45-18-51-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791222064, "last_seen": 1791222064, "transport": "t", "ja3_hash": "98dba220da7748afdb4e971a4bbb43e0", "ja3_variant_count": 1, "ja3_variants": [ "98dba220da7748afdb4e971a4bbb43e0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_8bd50ec00f33", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "8bd50ec00f33", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-45-23-43-5-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790929087, "last_seen": 1790929087, "transport": "t", "ja3_hash": "cf257e6a8b42dbcae4359303162a3c80", "ja3_variant_count": 1, "ja3_variants": [ "cf257e6a8b42dbcae4359303162a3c80" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_aafc51e2d66f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "aafc51e2d66f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-43-16-51764-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791151885, "last_seen": 1791151885, "transport": "t", "ja3_hash": "5d1a7b933f2d3e71e893f42c68703c41", "ja3_variant_count": 1, "ja3_variants": [ "5d1a7b933f2d3e71e893f42c68703c41" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_b25a227f4836", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "b25a227f4836", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-65037-13-16-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790878022, "last_seen": 1790878022, "transport": "t", "ja3_hash": "cd219da070658e02e040cfb2b2f9210b", "ja3_variant_count": 1, "ja3_variants": [ "cd219da070658e02e040cfb2b2f9210b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_baca9b622a06", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "baca9b622a06", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-27-5-43-16-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791035359, "last_seen": 1791035359, "transport": "t", "ja3_hash": "85d673ae787fd6315b75d8d73012fd86", "ja3_variant_count": 1, "ja3_variants": [ "85d673ae787fd6315b75d8d73012fd86" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_bf60d4742a2d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "bf60d4742a2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-18-43-23-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791312111, "last_seen": 1791312111, "transport": "t", "ja3_hash": "b792eed2e540d3fea195bf369aa4035e", "ja3_variant_count": 1, "ja3_variants": [ "b792eed2e540d3fea195bf369aa4035e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_dc81255aecda", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "dc81255aecda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-43-10-51-45-35-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790764067, "last_seen": 1790764067, "transport": "t", "ja3_hash": "80e6d8e47500181429e286d22577d46b", "ja3_variant_count": 1, "ja3_variants": [ "80e6d8e47500181429e286d22577d46b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_fc7e7bf80214", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "fc7e7bf80214", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-13-65037-16-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789626388, "last_seen": 1789626388, "transport": "t", "ja3_hash": "1aa7646f0f8f05bfac7340967f3e9cb6", "ja3_variant_count": 1, "ja3_variants": [ "1aa7646f0f8f05bfac7340967f3e9cb6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1507h2_8daaf6152771_feab2b2c4080", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1507h2", "b": "8daaf6152771", "c": "feab2b2c4080", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-65037-17613-35-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791192397, "last_seen": 1791192397, "transport": "t", "ja3_hash": "6f0d5e30f717cea2e4b44a50fb8130b4", "ja3_variant_count": 1, "ja3_variants": [ "6f0d5e30f717cea2e4b44a50fb8130b4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_022b0f967e84", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "022b0f967e84", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-5-65037-45-16-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790931415, "last_seen": 1790931415, "transport": "t", "ja3_hash": "ebe7407c412461781668606b1cc71a28", "ja3_variant_count": 1, "ja3_variants": [ "ebe7407c412461781668606b1cc71a28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_13129611a485", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "13129611a485", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-5-17613-35-13-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790218767, "last_seen": 1790218767, "transport": "t", "ja3_hash": "394a3a4894683bcbe9622e7786321764", "ja3_variant_count": 1, "ja3_variants": [ "394a3a4894683bcbe9622e7786321764" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_2dc8aed1eccc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "2dc8aed1eccc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-16-17613-65281-5-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790556366, "last_seen": 1790556366, "transport": "t", "ja3_hash": "677ee7d0673cdf91bb29aa82f05540fc", "ja3_variant_count": 1, "ja3_variants": [ "677ee7d0673cdf91bb29aa82f05540fc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_2fe69b12b5ab", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "2fe69b12b5ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-16-17613-13-43-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788533136, "last_seen": 1788533136, "transport": "t", "ja3_hash": "ab59bd58206d0d03d4802879ceb0496c", "ja3_variant_count": 1, "ja3_variants": [ "ab59bd58206d0d03d4802879ceb0496c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_458a8c3634b9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "458a8c3634b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-65281-10-23-17613-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790933524, "last_seen": 1790933524, "transport": "t", "ja3_hash": "0c5335075d0633f594949324b2f7ea54", "ja3_variant_count": 1, "ja3_variants": [ "0c5335075d0633f594949324b2f7ea54" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_4a4563ba4388", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "4a4563ba4388", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-10-43-16-27-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790106275, "last_seen": 1790106275, "transport": "t", "ja3_hash": "7b3b1bf815ea604cd0259ec3ac2ad351", "ja3_variant_count": 1, "ja3_variants": [ "7b3b1bf815ea604cd0259ec3ac2ad351" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_4c9ab3d858df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "4c9ab3d858df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-43-5-16-51-11-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788866486, "last_seen": 1788866486, "transport": "t", "ja3_hash": "85258a92336aadfd40d279557ccf117b", "ja3_variant_count": 1, "ja3_variants": [ "85258a92336aadfd40d279557ccf117b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_4e8e7a8eabd3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "4e8e7a8eabd3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-65037-5-43-17613-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788520299, "last_seen": 1788520299, "transport": "t", "ja3_hash": "1cef5044f77ffcc0a82e0f8469ffe46a", "ja3_variant_count": 1, "ja3_variants": [ "1cef5044f77ffcc0a82e0f8469ffe46a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_6073bcaae699", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "6073bcaae699", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-18-11-5-16-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791241332, "last_seen": 1791241332, "transport": "t", "ja3_hash": "608196a438a076b817906c58070e60c1", "ja3_variant_count": 1, "ja3_variants": [ "608196a438a076b817906c58070e60c1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_62f0e46f36f3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "62f0e46f36f3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-43-13-27-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790074351, "last_seen": 1790074351, "transport": "t", "ja3_hash": "c6d780d905c8277261aeb7ce5372622e", "ja3_variant_count": 1, "ja3_variants": [ "c6d780d905c8277261aeb7ce5372622e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_75584149502a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "75584149502a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-43-23-11-18-16-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791017584, "last_seen": 1791017584, "transport": "t", "ja3_hash": "b3aabf31ac17641d94b156d1f56ec3c3", "ja3_variant_count": 1, "ja3_variants": [ "b3aabf31ac17641d94b156d1f56ec3c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_9c3383f116e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "9c3383f116e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-18-23-51764-43-11-0,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789850391, "last_seen": 1789850391, "transport": "t", "ja3_hash": "1dae795bd484a02d92596c630d2fb62b", "ja3_variant_count": 1, "ja3_variants": [ "1dae795bd484a02d92596c630d2fb62b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_9e41d4bd8d69", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "9e41d4bd8d69", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,43-16-13-10-18-65281-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789719554, "last_seen": 1789719554, "transport": "t", "ja3_hash": "9baa6de9a8bb68f8eba784ef9beab425", "ja3_variant_count": 1, "ja3_variants": [ "9baa6de9a8bb68f8eba784ef9beab425" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_c003b214c87f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "c003b214c87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-23-43-35-65281-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789980965, "last_seen": 1789980965, "transport": "t", "ja3_hash": "39090becdfe2f6b8c28f323480d05353", "ja3_variant_count": 1, "ja3_variants": [ "39090becdfe2f6b8c28f323480d05353" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_c876b4be2538", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "c876b4be2538", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-10-11-5-13-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791044486, "last_seen": 1791044486, "transport": "t", "ja3_hash": "afbe8e913d250de038abaad00575cdef", "ja3_variant_count": 1, "ja3_variants": [ "afbe8e913d250de038abaad00575cdef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_ca78c6148bda", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "ca78c6148bda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-43-45-16-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788535350, "last_seen": 1788535350, "transport": "t", "ja3_hash": "aafd5001143fef996c126abc9bae546b", "ja3_variant_count": 1, "ja3_variants": [ "aafd5001143fef996c126abc9bae546b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_cfed6827f30c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "cfed6827f30c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-51-35-16-10-45-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790307909, "last_seen": 1790307909, "transport": "t", "ja3_hash": "6a6e3d68bdb6a5b2e7b68c6a1055b6c1", "ja3_variant_count": 1, "ja3_variants": [ "6a6e3d68bdb6a5b2e7b68c6a1055b6c1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_dfedc6462446", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "dfedc6462446", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-43-10-35-51-16-23-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791180408, "last_seen": 1791180408, "transport": "t", "ja3_hash": "cda1f05548692346c55c579051f773fa", "ja3_variant_count": 1, "ja3_variants": [ "cda1f05548692346c55c579051f773fa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_e271068dc5a4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "e271068dc5a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-27-13-16-51-43-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790168400, "last_seen": 1790168400, "transport": "t", "ja3_hash": "36ce542092d6e2d22e28be6488d1d066", "ja3_variant_count": 1, "ja3_variants": [ "36ce542092d6e2d22e28be6488d1d066" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1508h2_8daaf6152771_fb9c90ea36c3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "fb9c90ea36c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-43-35-10-23-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790229427, "last_seen": 1790229427, "transport": "t", "ja3_hash": "b502ad63fb725b7b56779e764671fe70", "ja3_variant_count": 1, "ja3_variants": [ "b502ad63fb725b7b56779e764671fe70" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h1_8daaf6152771_aacab029beac", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h1", "b": "8daaf6152771", "c": "aacab029beac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-16-11-43-18-65281-51-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790657092, "last_seen": 1790657092, "transport": "t", "ja3_hash": "70410355a5e4c6c54d277da13ba81c6b", "ja3_variant_count": 1, "ja3_variants": [ "70410355a5e4c6c54d277da13ba81c6b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_1fed6ac615b3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "1fed6ac615b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-45-23-43-51764-18-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789587733, "last_seen": 1789587733, "transport": "t", "ja3_hash": "f1c4d80c119e6d0e4bb4803337a386cf", "ja3_variant_count": 1, "ja3_variants": [ "f1c4d80c119e6d0e4bb4803337a386cf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_2c39d0c819dc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "2c39d0c819dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-18-11-10-16-35-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789906987, "last_seen": 1789906987, "transport": "t", "ja3_hash": "0138a4f102a97581f71bb3f8dbdb846b", "ja3_variant_count": 1, "ja3_variants": [ "0138a4f102a97581f71bb3f8dbdb846b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_30e02203ccdb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "30e02203ccdb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-27-17613-10-16-65281-18-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789678217, "last_seen": 1789678217, "transport": "t", "ja3_hash": "b25f85b2ba32ca0efe3204841be5d5a1", "ja3_variant_count": 1, "ja3_variants": [ "b25f85b2ba32ca0efe3204841be5d5a1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_3b283875dcb0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "3b283875dcb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-43-10-5-65037-16-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790360808, "last_seen": 1790360808, "transport": "t", "ja3_hash": "83870bf5809b844919e6548adbee098a", "ja3_variant_count": 1, "ja3_variants": [ "83870bf5809b844919e6548adbee098a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_41e711bc7aef", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "41e711bc7aef", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-45-65037-13-43-17613-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790400253, "last_seen": 1790400253, "transport": "t", "ja3_hash": "fc045331db87288a9cea1b4ed0accdc0", "ja3_variant_count": 1, "ja3_variants": [ "fc045331db87288a9cea1b4ed0accdc0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_5adff2a27cd6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "5adff2a27cd6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-10-45-43-11-17613-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790332932, "last_seen": 1790332932, "transport": "t", "ja3_hash": "6b4c78998f4a610ffe795405866b489c", "ja3_variant_count": 1, "ja3_variants": [ "6b4c78998f4a610ffe795405866b489c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_84f0b90a4ef6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "84f0b90a4ef6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,43-10-13-65037-65281-45-16-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789841716, "last_seen": 1789841716, "transport": "t", "ja3_hash": "803d794c71651a3955e2fa708116b1ad", "ja3_variant_count": 1, "ja3_variants": [ "803d794c71651a3955e2fa708116b1ad" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_8e9fa813db07", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "8e9fa813db07", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,11-18-16-43-35-5-51764-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788887850, "last_seen": 1788887850, "transport": "t", "ja3_hash": "5f7346810da9cfaa088b2d98973d4185", "ja3_variant_count": 1, "ja3_variants": [ "5f7346810da9cfaa088b2d98973d4185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_8f16dd777698", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "8f16dd777698", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-65037-35-11-13-10-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790576785, "last_seen": 1790576785, "transport": "t", "ja3_hash": "29c1ffd09424b69b790e5d97392b1167", "ja3_variant_count": 1, "ja3_variants": [ "29c1ffd09424b69b790e5d97392b1167" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_91786f7c983b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "91786f7c983b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-16-5-10-35-43-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391191, "last_seen": 1789391191, "transport": "t", "ja3_hash": "21216ba986604b3a73e3771cea5f312b", "ja3_variant_count": 1, "ja3_variants": [ "21216ba986604b3a73e3771cea5f312b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_9350fc70f9d9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "9350fc70f9d9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-45-65281-35-43-17613-16-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790249320, "last_seen": 1790249320, "transport": "t", "ja3_hash": "bfea686f3820b4d31f2f79445ae5a748", "ja3_variant_count": 1, "ja3_variants": [ "bfea686f3820b4d31f2f79445ae5a748" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_9988eb27965e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "9988eb27965e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-23-27-45-16-43-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789782407, "last_seen": 1789782407, "transport": "t", "ja3_hash": "1b9371e9361ea393bf34f12a5fda1a0b", "ja3_variant_count": 1, "ja3_variants": [ "1b9371e9361ea393bf34f12a5fda1a0b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_9b4003f4233b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "9b4003f4233b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-65037-16-45-10-35-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788444962, "last_seen": 1788444962, "transport": "t", "ja3_hash": "6f2088423684447b6d62a4ba84a88d36", "ja3_variant_count": 1, "ja3_variants": [ "6f2088423684447b6d62a4ba84a88d36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_9f6a67ccbb24", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "9f6a67ccbb24", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-23-43-11-16-45-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790202577, "last_seen": 1790202577, "transport": "t", "ja3_hash": "96346a0fddc40d3978aa75aa57229b8d", "ja3_variant_count": 1, "ja3_variants": [ "96346a0fddc40d3978aa75aa57229b8d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_aa69ecebf247", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "aa69ecebf247", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-16-5-13-23-18-51764-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789820708, "last_seen": 1789820708, "transport": "t", "ja3_hash": "9ad86f2d7881941b91260f33e7d1118e", "ja3_variant_count": 1, "ja3_variants": [ "9ad86f2d7881941b91260f33e7d1118e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_bdb22fb92531", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "bdb22fb92531", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-11-65281-35-16-51-5-10,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791038804, "last_seen": 1791038804, "transport": "t", "ja3_hash": "adb4926e7e9a65f2cd1ea5d034a563ec", "ja3_variant_count": 1, "ja3_variants": [ "adb4926e7e9a65f2cd1ea5d034a563ec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_c929afe22e0e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "c929afe22e0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-18-65281-16-43-10-45-27-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789391193, "last_seen": 1789391193, "transport": "t", "ja3_hash": "da6b37c7108322f0ecc97d4c42544185", "ja3_variant_count": 1, "ja3_variants": [ "da6b37c7108322f0ecc97d4c42544185" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_d5183483289b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "d5183483289b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-45-10-65037-16-65281-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790340578, "last_seen": 1790340578, "transport": "t", "ja3_hash": "54b161a456ce953d189e5c8fbee464f3", "ja3_variant_count": 1, "ja3_variants": [ "54b161a456ce953d189e5c8fbee464f3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_e268e400fca7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "e268e400fca7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-27-45-10-16-18-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790789968, "last_seen": 1790789968, "transport": "t", "ja3_hash": "15c305ec03ab2641c7e66f5f5103d381", "ja3_variant_count": 1, "ja3_variants": [ "15c305ec03ab2641c7e66f5f5103d381" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_f2e24db3e0dc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "f2e24db3e0dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-5-51764-43-65281-10-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789775629, "last_seen": 1789775629, "transport": "t", "ja3_hash": "291e9476e27eaa5e7c5513a20867edf6", "ja3_variant_count": 1, "ja3_variants": [ "291e9476e27eaa5e7c5513a20867edf6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_fdf6e4dfc96f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "fdf6e4dfc96f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-16-35-11-10-5-51-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788774301, "last_seen": 1788774301, "transport": "t", "ja3_hash": "ff69dea1f38243785fe7c32eafd6b466", "ja3_variant_count": 1, "ja3_variants": [ "ff69dea1f38243785fe7c32eafd6b466" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_fe179e5973f2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "fe179e5973f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-51764-65037-43-16-35-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790885118, "last_seen": 1790885118, "transport": "t", "ja3_hash": "453889edb8261805e066cf766289c2d1", "ja3_variant_count": 1, "ja3_variants": [ "453889edb8261805e066cf766289c2d1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1509h2_8daaf6152771_fe5de01693b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1509h2", "b": "8daaf6152771", "c": "fe5de01693b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-10-16-27-35-65281-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789418203, "last_seen": 1789418203, "transport": "t", "ja3_hash": "4a13229abfb1df710624a5a2d548c112", "ja3_variant_count": 1, "ja3_variants": [ "4a13229abfb1df710624a5a2d548c112" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h1_8daaf6152771_76127b0f2068", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h1", "b": "8daaf6152771", "c": "76127b0f2068", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-45-23-18-65037-43-27-10-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790997008, "last_seen": 1790997008, "transport": "t", "ja3_hash": "30c938684fb885e460b53a3661ca8dff", "ja3_variant_count": 1, "ja3_variants": [ "30c938684fb885e460b53a3661ca8dff" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_044a1a682098", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "044a1a682098", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-65037-5-23-43-27-65281-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789306591, "last_seen": 1789306591, "transport": "t", "ja3_hash": "d0af70a570259c1b6f7f567d6dbdd107", "ja3_variant_count": 1, "ja3_variants": [ "d0af70a570259c1b6f7f567d6dbdd107" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_10412b81caa9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "10412b81caa9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-11-17613-35-51-16-65281-5-18-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788967861, "last_seen": 1788967861, "transport": "t", "ja3_hash": "8b3c626e544e81afaee5ed492a6080c7", "ja3_variant_count": 1, "ja3_variants": [ "8b3c626e544e81afaee5ed492a6080c7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_1830e330277b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "1830e330277b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-13-27-43-17613-65281-16-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789702107, "last_seen": 1789702107, "transport": "t", "ja3_hash": "d468cf8d1f9448f45e3993d4be799232", "ja3_variant_count": 1, "ja3_variants": [ "d468cf8d1f9448f45e3993d4be799232" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_1d809016a9ff", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "1d809016a9ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-5-18-10-35-13-27-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790160093, "last_seen": 1790160093, "transport": "t", "ja3_hash": "6ddce29d6b07491dfa1b67d8f7b7a9b5", "ja3_variant_count": 1, "ja3_variants": [ "6ddce29d6b07491dfa1b67d8f7b7a9b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_1f67a48d0638", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "1f67a48d0638", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-10-43-65037-35-23-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788931409, "last_seen": 1788931409, "transport": "t", "ja3_hash": "6e3f830b89d8e5d909581ec90b6f0b23", "ja3_variant_count": 1, "ja3_variants": [ "6e3f830b89d8e5d909581ec90b6f0b23" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_31254715ad9d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "31254715ad9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-35-23-16-5-17613-10-65281-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789460106, "last_seen": 1789460106, "transport": "t", "ja3_hash": "164f79b7b985af09dac4df7656ccb470", "ja3_variant_count": 1, "ja3_variants": [ "164f79b7b985af09dac4df7656ccb470" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_3823b72ec821", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "3823b72ec821", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-5-35-51764-10-43-45-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789923848, "last_seen": 1789923848, "transport": "t", "ja3_hash": "00e6aad09092c2302307d7b770b4620b", "ja3_variant_count": 1, "ja3_variants": [ "00e6aad09092c2302307d7b770b4620b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_3860589775e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "3860589775e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-5-17613-45-16-43-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789730577, "last_seen": 1789730577, "transport": "t", "ja3_hash": "315cdd7c82e3017f20ff6963c7fa04db", "ja3_variant_count": 1, "ja3_variants": [ "315cdd7c82e3017f20ff6963c7fa04db" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_4ea40d3583fa", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "4ea40d3583fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-27-43-11-45-18-13-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789430929, "last_seen": 1789430929, "transport": "t", "ja3_hash": "64ab79d368544a38013ba408488cafc8", "ja3_variant_count": 1, "ja3_variants": [ "64ab79d368544a38013ba408488cafc8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_50d934d753f9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "50d934d753f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-16-13-45-43-65037-51764-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790605456, "last_seen": 1790605456, "transport": "t", "ja3_hash": "0823557f5bf46656a99daf4a7ed4dcd7", "ja3_variant_count": 1, "ja3_variants": [ "0823557f5bf46656a99daf4a7ed4dcd7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_60714cf682f4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "60714cf682f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-11-18-23-43-35-16-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788454615, "last_seen": 1788454615, "transport": "t", "ja3_hash": "959e11d4df5a0e55757a1f9d4814b07d", "ja3_variant_count": 1, "ja3_variants": [ "959e11d4df5a0e55757a1f9d4814b07d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_76127b0f2068", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "76127b0f2068", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-10-18-35-45-43-16-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790188053, "last_seen": 1790188053, "transport": "t", "ja3_hash": "3f3dcb5c32844e8ae3381f26089c7212", "ja3_variant_count": 1, "ja3_variants": [ "3f3dcb5c32844e8ae3381f26089c7212" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_91860ce74887", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "91860ce74887", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-16-43-45-11-5-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789402736, "last_seen": 1789402736, "transport": "t", "ja3_hash": "a90c5676e924a5b263cfe07e056a0f08", "ja3_variant_count": 1, "ja3_variants": [ "a90c5676e924a5b263cfe07e056a0f08" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_9441bb5508b5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "9441bb5508b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-13-35-11-45-43-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789366302, "last_seen": 1789366302, "transport": "t", "ja3_hash": "e62cce2563d8b2a4baf3b79777d1addc", "ja3_variant_count": 1, "ja3_variants": [ "e62cce2563d8b2a4baf3b79777d1addc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_98cc64a37b71", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "98cc64a37b71", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-65037-10-5-45-13-23-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789889714, "last_seen": 1789889714, "transport": "t", "ja3_hash": "a3dcac40650a405c9432f98ce4a9bc62", "ja3_variant_count": 1, "ja3_variants": [ "a3dcac40650a405c9432f98ce4a9bc62" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_a07bb36fdc4b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "a07bb36fdc4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-16-43-65281-18-35-13-45-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790330369, "last_seen": 1790330369, "transport": "t", "ja3_hash": "19672a1a2e96afa7b66c8e4a989aa596", "ja3_variant_count": 1, "ja3_variants": [ "19672a1a2e96afa7b66c8e4a989aa596" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_a6e04712e4be", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "a6e04712e4be", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-65037-16-11-18-35-13-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788442223, "last_seen": 1788442223, "transport": "t", "ja3_hash": "efab5e284344d4e4160e62a326003bb2", "ja3_variant_count": 1, "ja3_variants": [ "efab5e284344d4e4160e62a326003bb2" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_ad0c51765a13", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "ad0c51765a13", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-65281-18-43-65037-27-17513-13-10,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790954432, "last_seen": 1790954432, "transport": "t", "ja3_hash": "f09b33a4e636495694852b98c05b2cdb", "ja3_variant_count": 1, "ja3_variants": [ "f09b33a4e636495694852b98c05b2cdb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_b324f17a43e3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "b324f17a43e3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-35-65037-51764-45-43-27-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789697084, "last_seen": 1789697084, "transport": "t", "ja3_hash": "3a184029f17a0685cf6b33004efd3871", "ja3_variant_count": 1, "ja3_variants": [ "3a184029f17a0685cf6b33004efd3871" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_ba2b6cdd4090", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "ba2b6cdd4090", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-18-43-10-51764-16-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790905753, "last_seen": 1790905753, "transport": "t", "ja3_hash": "a27b1d39515920893b32b657435ab898", "ja3_variant_count": 1, "ja3_variants": [ "a27b1d39515920893b32b657435ab898" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_be4270e92056", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "be4270e92056", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-65037-43-27-35-10-13-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789704608, "last_seen": 1789704608, "transport": "t", "ja3_hash": "21c8affeeec99229a1631e62a19c6d36", "ja3_variant_count": 1, "ja3_variants": [ "21c8affeeec99229a1631e62a19c6d36" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_d8ad9301608f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "d8ad9301608f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-43-18-10-23-16-65037-13-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791022203, "last_seen": 1791022203, "transport": "t", "ja3_hash": "6c666736be7dba13af7aea323a812cba", "ja3_variant_count": 1, "ja3_variants": [ "6c666736be7dba13af7aea323a812cba" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_e34d6c7c522c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "e34d6c7c522c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-18-43-16-35-51764-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791293995, "last_seen": 1791293995, "transport": "t", "ja3_hash": "73650710d0bf7259505045fbeda8e20d", "ja3_variant_count": 1, "ja3_variants": [ "73650710d0bf7259505045fbeda8e20d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_e8b6f1b47a64", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "e8b6f1b47a64", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-43-11-45-17613-16-23-65037-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790360806, "last_seen": 1790360806, "transport": "t", "ja3_hash": "e3cdfb2e162be4ee8641e5bc265f6a07", "ja3_variant_count": 1, "ja3_variants": [ "e3cdfb2e162be4ee8641e5bc265f6a07" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_f957e4343dc4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "f957e4343dc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-43-11-51764-35-17613-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788714104, "last_seen": 1788714104, "transport": "t", "ja3_hash": "bd880e83810750ac9abf7a5500249bd6", "ja3_variant_count": 1, "ja3_variants": [ "bd880e83810750ac9abf7a5500249bd6" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1510h2_8daaf6152771_fdfbf3f6120a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "fdfbf3f6120a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-23-43-11-45-35-5-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790938611, "last_seen": 1790938611, "transport": "t", "ja3_hash": "60f4fd8aef4481fdab38f85b5e974405", "ja3_variant_count": 1, "ja3_variants": [ "60f4fd8aef4481fdab38f85b5e974405" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h1_8daaf6152771_2a457a82df9c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h1", "b": "8daaf6152771", "c": "2a457a82df9c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-65037-16-23-11-10-35-5-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790555618, "last_seen": 1790555618, "transport": "t", "ja3_hash": "1c9ffdc4c375305ad4bc96c057bc7516", "ja3_variant_count": 1, "ja3_variants": [ "1c9ffdc4c375305ad4bc96c057bc7516" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_1aeaa96351f4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "1aeaa96351f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-11-18-10-5-45-13-43-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790868921, "last_seen": 1790868921, "transport": "t", "ja3_hash": "10641e50394edaa34d60d53895375244", "ja3_variant_count": 1, "ja3_variants": [ "10641e50394edaa34d60d53895375244" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_3df62c94ca67", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "3df62c94ca67", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-35-43-65281-23-10-27-16-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791240850, "last_seen": 1791240850, "transport": "t", "ja3_hash": "d07641efd690a087595246ce830ae719", "ja3_variant_count": 1, "ja3_variants": [ "d07641efd690a087595246ce830ae719" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_3f5af3bb931a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "3f5af3bb931a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-45-23-65037-13-27-17613-35-5-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790283549, "last_seen": 1790283549, "transport": "t", "ja3_hash": "c31103f0ac005d7a3105d0c5f36cb72f", "ja3_variant_count": 1, "ja3_variants": [ "c31103f0ac005d7a3105d0c5f36cb72f" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_442c5ce8f8df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "442c5ce8f8df", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-23-11-18-43-45-51764-35-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790790168, "last_seen": 1790790168, "transport": "t", "ja3_hash": "4c71a1cbd0d385650ba065cbbee0dd55", "ja3_variant_count": 1, "ja3_variants": [ "4c71a1cbd0d385650ba065cbbee0dd55" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_4a9ae9f8fc91", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "4a9ae9f8fc91", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-11-17613-23-13-45-16-43-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790621418, "last_seen": 1790621418, "transport": "t", "ja3_hash": "2db72c0961aad9d667f2b03e13d3402d", "ja3_variant_count": 1, "ja3_variants": [ "2db72c0961aad9d667f2b03e13d3402d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_52cded8f1e0e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "52cded8f1e0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-10-18-13-5-43-45-65037-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789214140, "last_seen": 1789214140, "transport": "t", "ja3_hash": "c5c8cf995bd0aad0d0d18e6455a218e7", "ja3_variant_count": 1, "ja3_variants": [ "c5c8cf995bd0aad0d0d18e6455a218e7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_53c04b2846ba", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "53c04b2846ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-43-51764-23-16-5-13-27-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791219044, "last_seen": 1791219044, "transport": "t", "ja3_hash": "6ff04ab81903b4e85073fc29f900999d", "ja3_variant_count": 1, "ja3_variants": [ "6ff04ab81903b4e85073fc29f900999d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_5acc01713e0b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "5acc01713e0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-13-65037-23-43-27-16-35-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790230463, "last_seen": 1790230463, "transport": "t", "ja3_hash": "702c103018735986b97b12ac13e0ef15", "ja3_variant_count": 1, "ja3_variants": [ "702c103018735986b97b12ac13e0ef15" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_6ca389a5e912", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "6ca389a5e912", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-13-35-43-16-10-27-18-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790266471, "last_seen": 1790266471, "transport": "t", "ja3_hash": "25531a6255c1ec55c1e265f363814d61", "ja3_variant_count": 1, "ja3_variants": [ "25531a6255c1ec55c1e265f363814d61" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_7409daeab43f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "7409daeab43f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-18-13-23-45-10-16-65037-27-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789490173, "last_seen": 1789490173, "transport": "t", "ja3_hash": "27cd66dface84592a881b793605731f1", "ja3_variant_count": 1, "ja3_variants": [ "27cd66dface84592a881b793605731f1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_80bf485ad126", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "80bf485ad126", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-18-23-11-10-5-35-43-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790791340, "last_seen": 1790791340, "transport": "t", "ja3_hash": "665d8fb9c31037ff331a6b24b385c884", "ja3_variant_count": 1, "ja3_variants": [ "665d8fb9c31037ff331a6b24b385c884" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_8e975052ff5d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "8e975052ff5d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-13-35-43-27-11-17613-18-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791022074, "last_seen": 1791022074, "transport": "t", "ja3_hash": "48d9d1202bc8586739f964109c554122", "ja3_variant_count": 1, "ja3_variants": [ "48d9d1202bc8586739f964109c554122" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_a036f2ddd51c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "a036f2ddd51c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-5-51764-10-11-27-16-17613-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789641711, "last_seen": 1789641711, "transport": "t", "ja3_hash": "21864fefa4e4c339c582ad7e62f78657", "ja3_variant_count": 1, "ja3_variants": [ "21864fefa4e4c339c582ad7e62f78657" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_a4ad27427dea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "a4ad27427dea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-16-23-45-18-5-10-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790779009, "last_seen": 1790779009, "transport": "t", "ja3_hash": "5ca1f0d9bf512c626ddf99018d9f8d01", "ja3_variant_count": 1, "ja3_variants": [ "5ca1f0d9bf512c626ddf99018d9f8d01" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_bd168f6167c5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "bd168f6167c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-13-18-43-23-11-35-10-17513-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788777048, "last_seen": 1788777048, "transport": "t", "ja3_hash": "c0c7a9f2be05af81f6e79dac349c4acb", "ja3_variant_count": 1, "ja3_variants": [ "c0c7a9f2be05af81f6e79dac349c4acb" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_cce42d99da2b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "cce42d99da2b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-43-11-13-27-10-5-65037-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791020751, "last_seen": 1791020751, "transport": "t", "ja3_hash": "a802c9bb9985b65a6aa39213a762df34", "ja3_variant_count": 1, "ja3_variants": [ "a802c9bb9985b65a6aa39213a762df34" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_d2cd53ee5da4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "d2cd53ee5da4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-35-11-27-23-10-5-16-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790532666, "last_seen": 1790532666, "transport": "t", "ja3_hash": "7ccb238ddb9ce4d729e404f5166f32b9", "ja3_variant_count": 1, "ja3_variants": [ "7ccb238ddb9ce4d729e404f5166f32b9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_d3c6ff16a764", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "d3c6ff16a764", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-65281-16-45-27-51-18-5-35-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788774103, "last_seen": 1788774103, "transport": "t", "ja3_hash": "64c847b1dd43989de05b6e354e7e77d0", "ja3_variant_count": 1, "ja3_variants": [ "64c847b1dd43989de05b6e354e7e77d0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_dae2e08b9725", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "dae2e08b9725", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-23-35-18-16-17613-10-45-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789436550, "last_seen": 1789436550, "transport": "t", "ja3_hash": "3eabab3bdb62efd56e58e34c17a37f5d", "ja3_variant_count": 1, "ja3_variants": [ "3eabab3bdb62efd56e58e34c17a37f5d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_dbfa395aa8b8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "dbfa395aa8b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-17613-65037-18-23-16-65281-10-35-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789511116, "last_seen": 1790327067, "transport": "t", "ja3_hash": "e5ae67c52fe86288667e627c491f7ecd", "ja3_variant_count": 2, "ja3_variants": [ "e5ae67c52fe86288667e627c491f7ecd", "da73d2a582b9824523953cc9a75132f8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_dc896c8e5b7d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "dc896c8e5b7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-45-65037-35-5-51764-43-13-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789478743, "last_seen": 1789478743, "transport": "t", "ja3_hash": "4386efc8ca49b63ea8ee08a666afbaf0", "ja3_variant_count": 1, "ja3_variants": [ "4386efc8ca49b63ea8ee08a666afbaf0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_e3fa93bc5222", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "e3fa93bc5222", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65037-16-65281-18-13-11-27-17613-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789957549, "last_seen": 1789957549, "transport": "t", "ja3_hash": "49a89e548440f260edcf30afbbd6a0f5", "ja3_variant_count": 1, "ja3_variants": [ "49a89e548440f260edcf30afbbd6a0f5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_e40b21ff3ecd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "e40b21ff3ecd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51764-43-35-16-18-5-17613-45-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790400254, "last_seen": 1790400254, "transport": "t", "ja3_hash": "500bd9beccb68787fd81ae4e0a14e8dd", "ja3_variant_count": 1, "ja3_variants": [ "500bd9beccb68787fd81ae4e0a14e8dd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_ef4e6a619ddd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "ef4e6a619ddd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-23-16-43-13-11-17613-18-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791251152, "last_seen": 1791251152, "transport": "t", "ja3_hash": "fda5a52cd5bf4e66472c4a9170f21adc", "ja3_variant_count": 1, "ja3_variants": [ "fda5a52cd5bf4e66472c4a9170f21adc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_efdf557855fa", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "efdf557855fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-65281-5-18-11-17613-43-16-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791137975, "last_seen": 1791137975, "transport": "t", "ja3_hash": "04b12cffc3f6ca2b20fa0fc6a0d385a4", "ja3_variant_count": 1, "ja3_variants": [ "04b12cffc3f6ca2b20fa0fc6a0d385a4" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_f6906f6a6679", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "f6906f6a6679", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-18-27-5-45-16-43-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789657003, "last_seen": 1789657003, "transport": "t", "ja3_hash": "91f8d071abe2678b7c50d8d2fcff2a5d", "ja3_variant_count": 1, "ja3_variants": [ "91f8d071abe2678b7c50d8d2fcff2a5d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_0841db47a058", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "0841db47a058", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-43-35-45-18-13-65281-11-16-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790442950, "last_seen": 1790442950, "transport": "t", "ja3_hash": "feadf4b2ad53c74ba78e277f4acaab81", "ja3_variant_count": 1, "ja3_variants": [ "feadf4b2ad53c74ba78e277f4acaab81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_50756406e409", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "50756406e409", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-13-65281-27-35-5-16-23-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791022074, "last_seen": 1791022074, "transport": "t", "ja3_hash": "19c5e4ed586d89d21e35972ef840aedf", "ja3_variant_count": 1, "ja3_variants": [ "19c5e4ed586d89d21e35972ef840aedf" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_5321df321023", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "5321df321023", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-43-65037-23-17613-45-27-65281-16-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790273614, "last_seen": 1790273614, "transport": "t", "ja3_hash": "352fe53e36e23b7db6495de70bebe636", "ja3_variant_count": 1, "ja3_variants": [ "352fe53e36e23b7db6495de70bebe636" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_604a77d41e9e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "604a77d41e9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-17513-45-51-43-35-16-5-10-23-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791270785, "last_seen": 1791270785, "transport": "t", "ja3_hash": "09879785ccbef4aa43061bc796a74951", "ja3_variant_count": 1, "ja3_variants": [ "09879785ccbef4aa43061bc796a74951" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_64e188f86a8a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "64e188f86a8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-16-13-65281-11-5-43-27-23-17513-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789305066, "last_seen": 1789305066, "transport": "t", "ja3_hash": "92e89c334b057782f84fba56dc61de58", "ja3_variant_count": 1, "ja3_variants": [ "92e89c334b057782f84fba56dc61de58" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_6839f114548f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "6839f114548f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-23-11-13-51764-16-35-43-5-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789355784, "last_seen": 1789355784, "transport": "t", "ja3_hash": "e3e3ad652d6d0d9db1aadc9ca8767bd1", "ja3_variant_count": 1, "ja3_variants": [ "e3e3ad652d6d0d9db1aadc9ca8767bd1" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_68811b12ddc9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "68811b12ddc9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-13-16-43-27-65281-45-51764-65037-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789423581, "last_seen": 1789423581, "transport": "t", "ja3_hash": "eaba366a010035f2a71a11fa192aa3c3", "ja3_variant_count": 1, "ja3_variants": [ "eaba366a010035f2a71a11fa192aa3c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_700462ac8fbb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "700462ac8fbb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-27-35-45-23-5-11-16-18-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790930582, "last_seen": 1790930582, "transport": "t", "ja3_hash": "f2d7be423e873607cf0ac30cff96bd1e", "ja3_variant_count": 1, "ja3_variants": [ "f2d7be423e873607cf0ac30cff96bd1e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_81d51d8f8665", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "81d51d8f8665", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-43-5-16-23-45-10-65281-13-17613-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791184298, "last_seen": 1791184298, "transport": "t", "ja3_hash": "a7dd2b42c6f22f15812d443b5a1a0c16", "ja3_variant_count": 1, "ja3_variants": [ "a7dd2b42c6f22f15812d443b5a1a0c16" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_8d15754befd1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "8d15754befd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-17613-18-35-43-13-65037-5-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790483306, "last_seen": 1790483306, "transport": "t", "ja3_hash": "8d1fe7c4806c36cd5281ea8ce1233b90", "ja3_variant_count": 1, "ja3_variants": [ "8d1fe7c4806c36cd5281ea8ce1233b90" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_bb51edaa0473", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "bb51edaa0473", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-43-10-45-27-65281-23-17613-13-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791275414, "last_seen": 1791275414, "transport": "t", "ja3_hash": "31bd31516d043a2f811f88451530291c", "ja3_variant_count": 1, "ja3_variants": [ "31bd31516d043a2f811f88451530291c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_d31e2fee521e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "d31e2fee521e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-65037-10-35-11-27-23-13-45-43-17513,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791105454, "last_seen": 1791105454, "transport": "t", "ja3_hash": "ca31d0b25f8a5e32098bde3fcf660864", "ja3_variant_count": 1, "ja3_variants": [ "ca31d0b25f8a5e32098bde3fcf660864" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_f28af1907610", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "f28af1907610", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-23-10-17513-13-35-16-65037-65281-11-43-27,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791123873, "last_seen": 1791123873, "transport": "t", "ja3_hash": "89878ab4732fa73137274f2ef202d34b", "ja3_variant_count": 1, "ja3_variants": [ "89878ab4732fa73137274f2ef202d34b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_f3a465bf2bcd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "f3a465bf2bcd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-45-18-35-5-65037-43-17613-65281-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791250324, "last_seen": 1791250324, "transport": "t", "ja3_hash": "6a92eae0c720317c53e312ad42209bd0", "ja3_variant_count": 1, "ja3_variants": [ "6a92eae0c720317c53e312ad42209bd0" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_f8b9424fcd73", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "f8b9424fcd73", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-43-65281-16-11-51764-27-5-23-35-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791201467, "last_seen": 1791201467, "transport": "t", "ja3_hash": "29c18034b68d9bf5d4a8e9a7add27099", "ja3_variant_count": 1, "ja3_variants": [ "29c18034b68d9bf5d4a8e9a7add27099" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1512h2_8daaf6152771_fb20ce2203f7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1512h2", "b": "8daaf6152771", "c": "fb20ce2203f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-13-65037-23-5-10-43-16-51764-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790610077, "last_seen": 1790610077, "transport": "t", "ja3_hash": "e6b96d87764d64d73c6ad0f95fc8c0fd", "ja3_variant_count": 1, "ja3_variants": [ "e6b96d87764d64d73c6ad0f95fc8c0fd" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h1_8daaf6152771_005eabb71a4e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h1", "b": "8daaf6152771", "c": "005eabb71a4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-65037-18-16-5-43-13-11-23-35-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790656463, "last_seen": 1790656463, "transport": "t", "ja3_hash": "5a491da850845d888a252793d8983787", "ja3_variant_count": 1, "ja3_variants": [ "5a491da850845d888a252793d8983787" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_005eabb71a4e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "005eabb71a4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-45-5-13-18-43-11-10-35-65037-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789200135, "last_seen": 1789200135, "transport": "t", "ja3_hash": "b21a2d83aaeb7a1c1d85faad50965206", "ja3_variant_count": 1, "ja3_variants": [ "b21a2d83aaeb7a1c1d85faad50965206" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_1830445880ea", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "1830445880ea", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-65037-11-27-17613-10-18-5-16-43-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790794647, "last_seen": 1790794647, "transport": "t", "ja3_hash": "a85499274f93783dd21572c01d4c11aa", "ja3_variant_count": 1, "ja3_variants": [ "a85499274f93783dd21572c01d4c11aa" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_1bde32107572", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "1bde32107572", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-10-35-16-45-65037-17613-13-27-51764-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790130725, "last_seen": 1790130725, "transport": "t", "ja3_hash": "96c0feb30624633e1159054bd8cf316b", "ja3_variant_count": 1, "ja3_variants": [ "96c0feb30624633e1159054bd8cf316b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_3b1d558f143e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "3b1d558f143e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-65281-27-35-16-43-18-65037-13-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788777959, "last_seen": 1788777959, "transport": "t", "ja3_hash": "85b6b91ebfa82c73167da76be0f26520", "ja3_variant_count": 1, "ja3_variants": [ "85b6b91ebfa82c73167da76be0f26520" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_408af5835eb9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "408af5835eb9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-43-35-10-65037-17613-5-11-18-13-45-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790623184, "last_seen": 1790623184, "transport": "t", "ja3_hash": "e573a3cdda32b0bdb059791cf0b6de25", "ja3_variant_count": 1, "ja3_variants": [ "e573a3cdda32b0bdb059791cf0b6de25" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_52c029195883", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "52c029195883", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-16-51764-65281-35-43-13-45-5-18-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789469867, "last_seen": 1789469867, "transport": "t", "ja3_hash": "6efe673477968010395aa98444d8f9b5", "ja3_variant_count": 1, "ja3_variants": [ "6efe673477968010395aa98444d8f9b5" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_60664fc7a528", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "60664fc7a528", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-35-17613-18-10-43-65037-5-65281-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790833990, "last_seen": 1790833990, "transport": "t", "ja3_hash": "1134d0a7d14eb638564f5605a35e1b25", "ja3_variant_count": 1, "ja3_variants": [ "1134d0a7d14eb638564f5605a35e1b25" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_6ce24cebef81", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "6ce24cebef81", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-11-5-65281-10-16-43-13-45-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790650563, "last_seen": 1790650563, "transport": "t", "ja3_hash": "c30dcb6bc610731748b421533dff0a82", "ja3_variant_count": 1, "ja3_variants": [ "c30dcb6bc610731748b421533dff0a82" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_7730a271a43a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "7730a271a43a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-16-65037-43-23-45-51764-13-65281-27-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789490306, "last_seen": 1789490306, "transport": "t", "ja3_hash": "7d2c7d6497d4aaebb029f2e0fe57c821", "ja3_variant_count": 1, "ja3_variants": [ "7d2c7d6497d4aaebb029f2e0fe57c821" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_7f2037aa1c7d", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "7f2037aa1c7d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-45-51764-43-23-10-18-65281-35-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788499352, "last_seen": 1790159456, "transport": "t", "ja3_hash": "a93c20ff63c930339ce4fefa9b9b0083", "ja3_variant_count": 2, "ja3_variants": [ "a93c20ff63c930339ce4fefa9b9b0083", "ac6cb07f67c21027a39a41dfbb7c2708" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_9a47ed8bf678", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "9a47ed8bf678", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-16-11-23-27-35-18-10-17613-13-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788867384, "last_seen": 1788867384, "transport": "t", "ja3_hash": "963232d9269c83fb61bfd6f81ea27d8b", "ja3_variant_count": 1, "ja3_variants": [ "963232d9269c83fb61bfd6f81ea27d8b" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_9e57e796060b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "9e57e796060b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-11-10-27-65281-43-51764-65037-17613-5-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790334191, "last_seen": 1790334191, "transport": "t", "ja3_hash": "e20effed3b3ea3b4b35da420bc95b17c", "ja3_variant_count": 1, "ja3_variants": [ "e20effed3b3ea3b4b35da420bc95b17c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_a47b94ab433f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "a47b94ab433f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-10-27-43-45-51764-23-17613-18-65281-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788461778, "last_seen": 1788461778, "transport": "t", "ja3_hash": "27ee73bb478ecea0c2634edfeb56ff26", "ja3_variant_count": 1, "ja3_variants": [ "27ee73bb478ecea0c2634edfeb56ff26" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_b77322f6088b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "b77322f6088b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-43-5-65037-45-16-10-18-51764-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790789116, "last_seen": 1790789116, "transport": "t", "ja3_hash": "859b6908bb036506a2dd1aa78d96aeb9", "ja3_variant_count": 1, "ja3_variants": [ "859b6908bb036506a2dd1aa78d96aeb9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_b7a99e67b1e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "b7a99e67b1e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-65037-43-5-16-27-45-11-13-51764-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790789228, "last_seen": 1790789228, "transport": "t", "ja3_hash": "e3d6fbd9eb7917b37be2f5647097c7a7", "ja3_variant_count": 1, "ja3_variants": [ "e3d6fbd9eb7917b37be2f5647097c7a7" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_b81965684095", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "b81965684095", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-43-45-11-10-65037-23-13-65281-17613-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789630810, "last_seen": 1789630810, "transport": "t", "ja3_hash": "0fe4b3d581453b77c6e2dfbe0d2da802", "ja3_variant_count": 1, "ja3_variants": [ "0fe4b3d581453b77c6e2dfbe0d2da802" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_df29c376febd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "df29c376febd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-45-43-17613-5-18-10-35-51764-16-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790360824, "last_seen": 1790360824, "transport": "t", "ja3_hash": "c4837b9b9b0678e39f200ee1e7851f50", "ja3_variant_count": 1, "ja3_variants": [ "c4837b9b9b0678e39f200ee1e7851f50" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1513h2_8daaf6152771_f0baea1b3350", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1513h2", "b": "8daaf6152771", "c": "f0baea1b3350", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-23-65037-5-10-65281-16-27-35-13-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791035382, "last_seen": 1791035382, "transport": "t", "ja3_hash": "9d8045e1ab17c81674f0a675eacb5690", "ja3_variant_count": 1, "ja3_variants": [ "9d8045e1ab17c81674f0a675eacb5690" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_4ab3e390d7e5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "4ab3e390d7e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-35-5-27-45-13-16-23-43-11-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789567936, "last_seen": 1789567936, "transport": "t", "ja3_hash": "6256b236be793ef7b7f7353ec03217fe", "ja3_variant_count": 1, "ja3_variants": [ "6256b236be793ef7b7f7353ec03217fe" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_56a286331089", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "56a286331089", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-10-35-18-13-23-11-5-45-65037-27-17613-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789273186, "last_seen": 1789273186, "transport": "t", "ja3_hash": "eb5f343d38b8e99da499ada98bca3c97", "ja3_variant_count": 1, "ja3_variants": [ "eb5f343d38b8e99da499ada98bca3c97" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_6e438e904768", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "6e438e904768", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-65037-51764-65281-23-45-35-11-16-13-18-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791201467, "last_seen": 1791201467, "transport": "t", "ja3_hash": "5c41db6fd49b5d1cbb291869c4f23248", "ja3_variant_count": 1, "ja3_variants": [ "5c41db6fd49b5d1cbb291869c4f23248" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_76ab02fbf0c2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "76ab02fbf0c2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-27-65281-11-16-35-18-45-43-5-23-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790765465, "last_seen": 1790765465, "transport": "t", "ja3_hash": "6efdb03c90abcbb5550409d1eb591f81", "ja3_variant_count": 1, "ja3_variants": [ "6efdb03c90abcbb5550409d1eb591f81" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_8868437b8b45", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "8868437b8b45", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-23-18-10-5-11-51764-43-16-13-65281-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790526976, "last_seen": 1790526976, "transport": "t", "ja3_hash": "504ed1913f5b3b2df6bf61671ffd94ea", "ja3_variant_count": 1, "ja3_variants": [ "504ed1913f5b3b2df6bf61671ffd94ea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_9c397acbd780", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "9c397acbd780", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-18-27-13-10-17613-43-16-23-45-11-65037-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788931104, "last_seen": 1788931104, "transport": "t", "ja3_hash": "423bf08eb490c579ab82c6ddeaa8e5ec", "ja3_variant_count": 1, "ja3_variants": [ "423bf08eb490c579ab82c6ddeaa8e5ec" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_a119e46ba42c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "a119e46ba42c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-23-18-51764-43-16-65037-17613-13-11-27-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790008485, "last_seen": 1790008485, "transport": "t", "ja3_hash": "708b6c802228bb6e36281119cabb0ee8", "ja3_variant_count": 1, "ja3_variants": [ "708b6c802228bb6e36281119cabb0ee8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_b9c352a595c8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "b9c352a595c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-10-27-23-5-16-11-35-51764-65037-43-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789671192, "last_seen": 1789671192, "transport": "t", "ja3_hash": "a6e2236c397d1768ffba6a395b09a796", "ja3_variant_count": 1, "ja3_variants": [ "a6e2236c397d1768ffba6a395b09a796" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_cd4096077622", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "cd4096077622", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-45-43-27-51764-13-35-10-16-18-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789499989, "last_seen": 1789499989, "transport": "t", "ja3_hash": "7a9bad7cff5c65351dfcbaa4441cac5a", "ja3_variant_count": 1, "ja3_variants": [ "7a9bad7cff5c65351dfcbaa4441cac5a" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_cf6e1259dba2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "cf6e1259dba2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-65037-10-16-43-45-17613-5-65281-23-13-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788776661, "last_seen": 1788776661, "transport": "t", "ja3_hash": "85c9dde6eafd68f4e4a0e3aba79e8326", "ja3_variant_count": 1, "ja3_variants": [ "85c9dde6eafd68f4e4a0e3aba79e8326" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_f27a46184afd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "f27a46184afd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-13-45-23-11-65037-65281-10-17613-27-5-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789681703, "last_seen": 1789681703, "transport": "t", "ja3_hash": "16ec5ba4aac6ab1bd459f1dfe962cce9", "ja3_variant_count": 1, "ja3_variants": [ "16ec5ba4aac6ab1bd459f1dfe962cce9" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_fae72dc20b90", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "fae72dc20b90", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-13-16-27-17613-18-23-65281-35-45-65037-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790099790, "last_seen": 1790099790, "transport": "t", "ja3_hash": "7615424183c97d2a026d467fd7d588c3", "ja3_variant_count": 1, "ja3_variants": [ "7615424183c97d2a026d467fd7d588c3" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_0eb9bc577cc8", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "0eb9bc577cc8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-5-43-10-17613-16-13-27-11-35-51764-18-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790905489, "last_seen": 1790905489, "transport": "t", "ja3_hash": "18935d06f618c595abd15218c42eb6cc", "ja3_variant_count": 1, "ja3_variants": [ "18935d06f618c595abd15218c42eb6cc" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_55449e25bcac", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "55449e25bcac", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-65037-51764-10-13-23-45-11-17613-18-27-65281-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789907464, "last_seen": 1790669848, "transport": "t", "ja3_hash": "ab9b94f67dead44454a41b5859308a64", "ja3_variant_count": 2, "ja3_variants": [ "ab9b94f67dead44454a41b5859308a64", "edfeb6a593407d0864f6ad9a20767819" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_7f650891f045", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "7f650891f045", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-65037-43-51764-23-35-27-10-16-17613-13-18-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790633711, "last_seen": 1790633711, "transport": "t", "ja3_hash": "ecb33497b4d508fccb778c818731de9c", "ja3_variant_count": 1, "ja3_variants": [ "ecb33497b4d508fccb778c818731de9c" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_d85f6c676370", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "d85f6c676370", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-16-11-45-27-23-65037-5-43-17613-18-10-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790576788, "last_seen": 1790576788, "transport": "t", "ja3_hash": "a7bbe709b8ab8215acab9b100d706e6d", "ja3_variant_count": 1, "ja3_variants": [ "a7bbe709b8ab8215acab9b100d706e6d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_ec7d4e755158", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "ec7d4e755158", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-10-5-11-16-65281-18-35-65037-17613-43-27-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789149822, "last_seen": 1789149822, "transport": "t", "ja3_hash": "d6d14146b306e445654dc47f605b73ef", "ja3_variant_count": 1, "ja3_variants": [ "d6d14146b306e445654dc47f605b73ef" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1515h2_8daaf6152771_f5728d627f6c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "f5728d627f6c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-65281-23-65037-27-45-10-18-43-16-13-51764-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789461357, "last_seen": 1789461357, "transport": "t", "ja3_hash": "3b02b462b23478ab91694d7b2f6645de", "ja3_variant_count": 1, "ja3_variants": [ "3b02b462b23478ab91694d7b2f6645de" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1516h2_8daaf6152771_9d0d4a7883f6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1516h2", "b": "8daaf6152771", "c": "9d0d4a7883f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-43-17613-10-23-45-13-65037-18-5-11-65281-35-16-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789336229, "last_seen": 1789336231, "transport": "t", "ja3_hash": "54e4b1d2ea495f717704922da7d5d2d3", "ja3_variant_count": 2, "ja3_variants": [ "54e4b1d2ea495f717704922da7d5d2d3", "183a825edfa88023c87a29892ff2eaea" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1516h2_8daaf6152771_ce66b3a31f3e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1516h2", "b": "8daaf6152771", "c": "ce66b3a31f3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-16-13-43-35-65037-23-65281-10-27-17613-45-51764-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790400252, "last_seen": 1790400252, "transport": "t", "ja3_hash": "99994d5c0a0683233ec06fe50377c62d", "ja3_variant_count": 1, "ja3_variants": [ "99994d5c0a0683233ec06fe50377c62d" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1516h2_8daaf6152771_e7524cb1b1c7", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1516h2", "b": "8daaf6152771", "c": "e7524cb1b1c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-13-23-18-5-27-35-51764-45-16-43-65281-17613-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789196281, "last_seen": 1789196281, "transport": "t", "ja3_hash": "10ccdb888d1fbbca82a17842fb86b426", "ja3_variant_count": 1, "ja3_variants": [ "10ccdb888d1fbbca82a17842fb86b426" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1517h2_8daaf6152771_68e2f8e9952f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1517h2", "b": "8daaf6152771", "c": "68e2f8e9952f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-18-65037-13-4832-43-51764-27-45-17613-16-10-5-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789587729, "last_seen": 1789587729, "transport": "t", "ja3_hash": "1aaa1575e0925751bcab8d9a46ef8517", "ja3_variant_count": 1, "ja3_variants": [ "1aaa1575e0925751bcab8d9a46ef8517" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t13i1713h1_ab0a1bf427ad_ea1f8af03a23", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Completed a TLS handshake but never an HTTP request, so no User-Agent was ever presented.", "ja4": { "a": "t13i1713h1", "b": "ab0a1bf427ad", "c": "ea1f8af03a23", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 17, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-11-10-35-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790669065, "last_seen": 1790669065, "transport": "t", "ja3_hash": "b55f33c5b918d9cf7abc779f8a69be6c", "ja3_variant_count": 1, "ja3_variants": [ "b55f33c5b918d9cf7abc779f8a69be6c" ], "user_agents": [], "ua_disagreement": false } } ] }